Finjan's Latest Web Security Trends Report Reveals New Genre of Evasive Attacks
Evasive Attacks Hit Once and Disappear to Minimize Visibility to Security Products; Financial Incentives Drive Growth of Malicious Website Affiliations
SAN JOSE, California, June 4 -- Finjan, a leader in web security products, today released its Web Security Trends Report (Q2 2007) (http://www.finjan.com/Content.aspx?id=827) which focuses on a new genre of highly sophisticated and evasive attacks designed to potentially bypass signature-based and database-reliant security technology. The report also describes the proliferation of affiliation networks based on a "hosted model" for malicious code, which utilize off-the-shelf malicious code packages to compromise highly popular websites and even government domains. Also following on from the trend revealed in Finjan's Q1 report, new examples show the growing presence of malicious code in online advertising on legitimate websites.
Evasive Attacks Cover Their Tracks to Avoid Detection
Recent findings by Finjan reveal that hackers have created a new class of highly evasive attacks. These attacks represent a quantum leap in terms of their technological sophistication, going far beyond drive-by downloads and code obfuscation. In order to minimize the malicious code's window of exposure, evasive attacks keep track of the actual IP addresses of visitors to a particular website or web page. Using this information, the attackers restrict exposure to the malicious code to a single view from each unique IP address. This means that the second time a given IP address tries to access the malicious page, a benign page will be automatically displayed in its place. All traces of the initial malicious page completely disappear. The report provides examples of evasive attacks, along with the actual code used by the hacker to run them.
"Evasive attack techniques where malicious code is controlled per IP address, country of origin or number of visits provide hackers with the ability to minimize the malicious code's exposure, thereby reducing the likelihood of detection. Moreover, evasive attacks can identify the IP addresses of crawlers used by URL filtering, reputation services and search engines, replying to these engines with legitimate content and increasing the chances of mistakenly being classified by them as a legitimate category,"
said Yuval Ben-Itzhak, CTO, Finjan. "The combination of these evasive attacks with code obfuscation techniques significantly enhances the capability of sophisticated hackers to go undetected."
Hacking for Dollar$ - The Financial Affiliations Behind Modern Website Attacks
Driven by strong financial incentives and using widely available malicious code software packages, "affiliations" are being created that promote infections using a "hosted" model for the malicious code. In this scheme, the malicious code is usually located on a dedicated malicious code server (or a site that has been hacked to host the malicious code), while the participants in the affiliation insert a reference to the malicious code in various websites. The website owners are paid according to the number of infected visitors to the site. Finjan's findings attest to the growing magnitude of these affiliation networks, which have been used to compromise highly popular websites and even government domains. Trojan keylogger log files show that the malicious code is being used to steal sensitive financial and personal information, such as bank account details, credit card numbers and social security IDs, for which e-criminals are willing to pay top dollar.
The report includes statistics and maps showing how a single malicious code server operated by just one hacker has infected thousands of legitimate websites worldwide. As hundreds of hackers are already using this technique, this implies that the magnitude of this problem is already having a global impact.
"Many sites are getting hit by stealthy attacks that leave no visible damage and simply insert a line of HTML code that points to malicious code on an external server," stated Ben-Itzhak. "The upshot is that any visitor to such a website may be jeopardizing his/her personal identity, bank account details and credit card numbers to the e-criminals behind these operations.
Business users that rely solely on signature-based anti-virus or URL filtering solutions might be left vulnerable to these types of attacks."
Malicious Code in Online Advertising
A follow-up study conducted by Finjan's MCRC has shed additional light on the growing presence of malicious code in online advertising. As websites depend more on advertising revenues, they often display ads from third party advertising networks, over which they may have little or no control. While legitimate website owners trust advertisers to display non-malicious content, advertisers sometimes "sublet" their space to others. This hierarchy can often comprise several layers, seriously compromising the level of control the website owner has over advertising content. The report includes a detailed analysis of an innocent blog site that deploys keyword-based advertisements that are placed automatically from an ad server. However, Finjan found that the ad content also included obfuscated references to malicious code on a third site that uses multiple infection techniques to download a Trojan keylogger to the user's machine. Another recent example of this trend was a banner ad hiding code with the ANI exploit that was unknowingly being hosted on one of the most popular techie websites.
"As commercially-motivated hackers look for ways to reach the widest possible audience in the shortest possible time, advertising has become a prime target for malicious code," stated Ben-Itzhak. "By targeting high-volume websites which are generally considered "trusted" by most URL filtering products, hackers can achieve higher infection rates and earn more money."
Parting Advice
Finjan's research confirms that attempts to pattern malicious code and create signatures, or to categorize known malicious sites, are clearly "too little, too late" when it comes to providing adequate protection to today's dynamic and evasive web threats. "There are no second chances when it comes to safeguarding users' personal details and securing confidential corporate information. The way to detect modern malicious code is to be able to understand in real-time what the code intends to do, before it does it,"
concludes Ben-Itzhak.
Finjan offers the following advice for corporate users:
1) Make sure that real-time inspection and protection is added to your web security solution. Chasing the attack vectors after the event is always "too little, too late", particularly if you get hit by a zero day attack that your security solution does not recognize.
2) Make sure that your security solution is updated to handle new technologies and trends. Security products should protect you from the vulnerabilities rather than just attacks and exploits.
3) Check your vendor's research capabilities and their ability to provide up-to-date information which is immediately translated into actionable security measures.
4) Examine your egress data policy to make sure that you cover all known and suspicious sites.
About MCRC
Malicious Code Research Center (MCRC) is the leading research department at Finjan, dedicated to the research and detection of security vulnerabilities in Internet applications, as well as other popular programs.
MCRC's goal is to stay steps ahead of hackers attempting to exploit open platforms and technologies to develop malicious code such as Spyware, Trojans, Phishing attacks, worms and viruses. MCRC shares its research efforts with many of the world's leading software vendors to help patch their security holes. MCRC is a driving force behind the development of next generation security technologies used in Finjan's proactive web security solutions. For more information, visit our MCRC subsite ( www.finjan.com/SecurityLab.aspx?id=547).
About Finjan
Finjan is a global provider of web security solutions for the enterprise market. Our real-time, appliance-based web security solutions deliver the most effective shield against web-borne threats, freeing enterprises to harness the web for maximum commercial results. Finjan's real-time web security solutions utilize patented behavior-based technology to repel all types of threats arriving via the web, such as spyware, phishing, Trojans, obfuscated code and other malicious code, securing businesses against unknown and emerging threats, as well as known malware. Finjan's security solutions have received industry awards and recognition from leading analyst houses and publications, including IDC, Butler Group, SC Magazine, CRN, ITPro, PCPro, ITWeek, Network Computing, and Information Security. With Finjan's award-winning and widely used solutions, businesses can focus on implementing web strategies to realize their full organizational and commercial potential.
For more information about Finjan, please visit: www.finjan.com.
Media Contacts
United States
Jan Wiedrick-Kozlowski
Activa PR
Tel. +1-585-392-7878
jan@activapr.com
UK
Neil Stinchcombe
Eskenzi PR Ltd.
Tel: +44-(0)208-449-1007
neil@eskenzipr.com
Source: Finjan Software
