Report: Cybercriminals Continue To Diversify Attack Tactics To Sustain Spam, Malware Levels
Symantec Corp. recently announced the launch of its MessageLabs Intelligence 2010 Security Report. The annual report details how cyber criminals have diversified their attack tactics to sustain spam and malware at high levels throughout 2010.
The report highlights fluctuating spam levels throughout the year driven by changes in botnet activity. Spam rates peaked in August 2010 at 92.2 percent when the Rustock botnet was being aggressively seeded by new malware variants and quickly put to use, lending to an overall increase in spam activity for the year, with average spam levels reaching 89.1 percent, an increase of 1.4 percent compared with 2009.
For most of 2010 spam from botnets accounted for 88.2 percent of all spam. The end of 2010 saw a reduction in the contribution of botnets to spam, to 77 percent of spam, resulting from the closure of spam affiliate, Spamit, in early October 2010. By the end of 2010, the total number of active bots had returned to roughly the same number as at the end of 2009, increasing by approximately 6 percent in the latter half of 2010. The total number of botnets worldwide is between 3.5 and 5.4 million.
It is predicted that in 2011 botnet controllers will resort to employing steganography techniques to control their computers. This means hiding their commands in plain view -- perhaps within images or music files distributed through file sharing or social networking web sites. This approach will allow criminals to surreptitiously issue instructions to their botnets without relying on an ISP to host their infrastructure thus minimizing the chances of discovery.
Although 2010 has experienced fluctuation in the number of botnets and their associated output, the top three botnets have not changed in the latter half of 2010. Rustock remains the most dominant botnet, with its spam output more than doubled since last year to more than 44 billion spam emails per day and more than one million bots under its control while Grum and Cutwail are the second and third largest respectively. Cutwail and Grum have also been responsible for an increase in the volume of malware being sent in spam from botnets.
“With successful and resilient botnet operations established in prior years, the cyber criminals experimented with many tactics to keep spam campaigns active and fresh this year,” said Paul Wood, MessageLabs Intelligence Senior Analyst, Symantec Hosted Services. “From leveraging newsworthy events like the FIFA World Cup to taking advantage of the widespread popularity of URL shortening services and social networks, the spammers deployed a variety of tricks to bypass spam filters and lure potential victims.”
One noteworthy security threat this year was the ‘Here You Have’ virus which on September 9, 2010 used old mass-mailer techniques to send malicious e-mails, peaking at 2,000 e-mails blocked per minute. In total, MessageLabs AntiVirus service blocked more than 100,000 copies of the virus before it reached any client networks.
The heuristic rule that triggered the detection of the virus was added in May 2008, more than two years earlier. The same rule was again instrumental in stopping a run of attacks spoofing the U.S. Internal Revenue Service in early November.
In 2010, there were more than 339,600 different malware strains identified in malicious emails blocked, representing over a hundred-fold increase since 2009. This massive increase is largely due to the growth in polymorphic malware variants, typically generated from toolkits that allow a new version of the code to be generated quickly and easily.
An example of this includes the Bredolab family of Trojans, a general-purpose botnet commonly distributed via the Cutwail botnet, which accounted for approximately 7.4 percent of all e-mail-borne malware in 2010. Bredolab represents an approach from attackers referred to as “pay per install” (PPI). Although flexible in nature, the malware is designed to seize control of the victim’s computer so that the computer can be used by the Bredolab operators or rented or sold to another attacker. Bredolab is an example of malware contained in a compressed archive and over time has evolved from a simple piece of encrypted malware packed with polymorphic code to a protected version with an updated polymorphic engine designed to behave the same yet evade detection as Bredolab. The final version is an aggressive polymorphic packer released at the end of 2010 which was mass-mailed with hundreds of variants of it to maximize infection.
While Bredolab was being sent en masse, targeted attacks, characterized by their low-volume distribution, have also been on the rise. When targeted attacks, or advanced persistent attacks, first emerged five years ago, MessageLabs Intelligence tracked one to two per week and over the course of the following year, this number rose to between one and two attacks per day. Subsequently, targeted attacks increased from ten per day to approximately 60 per day in 2010 and by the end of the year, MessageLabs Intelligence blocked 77 targeted attacks each day.
“With the rise of targeted attacks come variations in the execution and attack complexity,” Wood said. “Typically, between 200 and 300 organizations are targeted each month but the industry sector varies and high seniority job roles are most frequently targeted yet often by way of a general or assistant’s mailbox. While five years ago large and well-known organizations were often targeted, today the scope of targeted organizations has expanded and now no organization is safe from attack.”
Finally, MessageLabs Intelligence examined the web browsing habits of an increasingly distributed workforce comprised of workers who are on the road or work from home compared to those of office-based workers. The findings revealed that mobile users behave similarly to office-based users and therefore pose little additional threat to an organization whereas workers who have mixed locations, those that work both in and out of the office, appear to relax their browsing habits considerably when out of the office, posing considerably higher risk to the organization. Based on the findings, organizations must determine to what extent they will manage employee online behavior with web policy controls. Recognizing a need for more flexible web access, businesses in 2010 are opting for a more granular approach to control with an increased use of “allow-lists” replacing the blanket “block list” approach from previous years. The number of allow policies has grown at an average rate of 0.8 percent per month in 2010, compared with 0.6 percent per month in 2009.
Top Trends in 2010
Web Security: For 2010, the average number of new malicious websites blocked each day rose to 3,066 compared to 2,465 for 2009, an increase of 24.3 percent. MessageLabs Intelligence identified malicious web threats on 42,926 distinct domains, the majority of which were compromised legitimate domains.
Spam: In 2010 the annual average global spam rate was 89.1 percent, an increase of 1.4 percent on the 2009. In August, the global spam rate peaked at 92.2 percent when the proportion of spam sent from botnets rose to 95 percent as a new variant of the Rustock botnet was seeded and quickly put to use.
Viruses: In 2010, the average rate for malware contained in email traffic was 1 in 284.2 emails (0.352 percent) almost unchanged when compared with 1 in 286.4 (0.349%) for 2009. In 2010, over 115.6 million emails were blocked by Skeptic™ representing an increase of 58.1 percent compared with 2009. There were 339.673 different malware strains identified in the malicious emails blocked. This represents more than a hundred fold increase over 2009 and is due to growth in polymorphic malware variants.
Phishing: In 2010, the average ratio of email traffic blocked as phishing attacks was 1 in 444.5 (0.23 percent), compared with 1 in 325.2 (0.31 percent) in 2009. Approximately 95.1 billion phishing emails were projected to be in circulation in 2010.
The annual MessageLabs Intelligence Report provides greater detail on all the trends and figures noted above, as well as more detailed trends for 2010. The full report is available at http://www.messagelabs.com/intelligence.