« Spam I Am Not! | Main | Army, Navy, Air Force, IT »

In a marked shift from just a year ago, security experts have noted that for the first time ever, there have been more phishing emails detected than emails infected with viruses. According to MessageLabs, in January 2007, 1 in 93 emails (1.07%) was some sort of phishing attempt, while only 1 in 120 emails (.83%) was found to be infected by a virus.

Part of this can be explained by the new viruses, and that they are much more targeted. As I’ve blogged here before, cybercriminals that launch virus attacks no longer rely on huge macro-attacks in an attempt to infect every computer in the country. This is mainly because this type of attack can be quickly quelled using blacklisting and content analysis, along with the fact that the longer the new viruses goes undetected, and unreported, the more profitable they are to the hackers.

Mark Sunner, chief technology officer at MessageLabs, said: "If you look at infected email traffic for January, it's very spiky. With Storm Worm there are clear spikes, then drops down to normal levels. It's as though someone is turning on the tap briefly, then letting it abate."

At the same time, phishing has become much more sophisticated, with man-in-the-middle attacks, though still rare, increasing. One such attack tries to hijack a user session when a user is tricked into clicking on a link, users go to a fake portal that is hosted on a compromised machine, and any information entered, such as bank details and codes, is relayed through the compromised machine to the real bank site. Once the users have validated themselves on the real system through the compromised relay, hackers kill the user connection through the relay, and take over the session.

This is possible because phishing attacks have become much more personalized and much more believable (which includes sending phishing emails to banks the victims actually use, instead of just using random phishing spam). Also, more phishing sites are using Flash content rather than HTML to avoid the anti-phishing technology deployed in web browsers.

Finally, another reason for this shift is that malware has moved more in the direction of web-based attacks., which simply means the virus level remains constant, only users are more likely to pick it up surfing the web rather than opening an email attachment.

Posted by pschooff in Phishing |Digg This|Add to del.icio.us

Trackback Pings

TrackBack URL for this entry:
http://www.ebizq.net/mt/mt-tb.cgi/1256