Filtering Facts

The new Sophos Security Threat Report  is out, with some startling statistics: 

The first half of 2008 has seen an explosion in threats spread via the web, the preferred vector of attack for financially-motivated cybercriminals. On average, Sophos detects 16,173 malicious webpages every day - or one every five seconds. This is three times faster than the rate seen during 2007.  Over 90 per cent of the webpages that are spreading Trojan horses and spyware are legitimate websites (some belonging to household brands and Fortune 500 companies) that have been hacked through SQL injection.  It is estimated that the total number of unique malware samples in existence now exceeds 11 million, with Sophos currently receiving approximately 20,000 new samples of suspicious software every single day - one every four seconds. 

Traditional web filtering software (like traditional anti-virus software) rely on large databases of identified websites (or viruses).  But with proliferation rates like this, it’s hard to see how a list-based approach can succeed - it will simply get overwhelmed.  Filtering vendors will have to rely increasingly on heuristics, and reputation services.  List-based filters will still be need for more static content, but they won’t be enough to block the flood of malware sites.

This from the security vendor Sophos, as reported in InfoWorld: 

Up to 80 percent of Web sites flagged as malicious by anti-virus and search engine indexes are legitimate businesses, according to security experts. Experts said while the security industry is on top of conventional spam and phishing attacks, more effort needs to be put into preventing and eliminating so-called drive-by-downloads. The attacks allow hackers to redirect massive amounts of traffic by inserting malicious iFrames into legitimate Web sites. The hacks are usually invisible to Web site visitors and do not often draw attention from security personnel because they only require a single line of code to be manipulated. A 2007 Sophos survey found that more than 80 percent of Web sites listed as malicious were legitimate organizations that had been compromised by various attacks including iframe injections. 

This is harsh for many small business that depend on search engine traffic for customers.  They get tagged by Google as a malware site and not too many potential customers will visit - or maybe ever go back.  As the article points out, it can very difficult to track down the right webmaster contact: 

“We’ve begun sending email notifications to some of the Web masters of sites that we flag for badware. We don’t have a perfect process for determining a Web master’s e-mail address, so for now we’re sending the notifications to likely Web master aliases for the domain in question,” Harton said. 

When I worked at Secure Computing and N2H2 people would sometimes ask why we didn’t notify webmasters that their site had been blocked, and the answer is that’s a lot more difficult than you would think.