One Million Web Sites Infected At End of 2010

There was a sharp jump in the prevalence of malicious Web advertisements in the final quarter of 2010, with loosely monitored "remnant" ad networks responsible for an increasing share of the attacks, according to a report from the firm Dasient. The Dasient Q4 Malware Update reported that more than one million Web sites were infected in the last quarter of 2010. That period saw a 25% growth in malicious advertisements from the previous quarter, as attackers found ways to sneak malicious code into widely used syndicated online ad networks. Its a trend that security experts see accelerating in 2011, as malicious advertisements, sometimes referred to as 'malvertisements,' crop up on high profile sites, said Neil Daswani, Chief Technology Officer at Dasient.

Daswani said that, overall, his company saw a 100% increase in the amount of malicious advertising from the third- to fourth quarters, 2010. However, much of that was due to an expansion of the sites Dasient monitored, with an increasing focus on so-called 'remnant' ad networks, which aggregate 'remnant' advertisements from direct marketers, who often have little oversight about where the ads appear.

Though most remnant ad networks are legitimate businesses, many are also susceptible to manipulation. Malicious hackers have found a variety of ways to insert malicious content into their legitimate ad streams: either compromising the ad network's ad server and replacing a legitimate ad with a malicious one, or by submitting a legitimate ad image, then replacing it with a malicious image after a set period of time, Daswani said.

Those images can find their way even to high value sites, because top tier online ad networks often syndicate ads from other publishers to fill in gaps in their own service, Daswani said. In recent weeks, well-ranked sites such as Autotrader.co.uk, cinema site Myvue.com and londonstockexchange.com were reported to have served up malicious advertisements. Malicious ads are commonly used to display pop up messages with links that will take users to a drive by download Web site download rogue anti virus programs or other threats.

Daswani said that  firms that serve advertisements need to do a better job vetting the content of the images they serve for malicious code, and detecting Web based attacks, including malicious ads, when they appear.

Malicious ads are, by no means, limited to remnant ad networks. In January, major ad networks DoubleClick and MSN were duped into serving malicious ads from attackers who registered a malicious site that masqueraded as AdShuffle.com, an online advertising technology firm.

[ThreatPost]

New net rules set to make cookies crumble

How websites track visitors and tailor ads to their behaviour is about to undergo a big shake-up.

From 25 May, European laws dictate that "explicit consent" must be gathered from web users who are being tracked via text files called "cookies".

These files are widely used to help users navigate faster around sites they visit regularly.

Businesses are being urged to sort out how they get consent so they can keep on using cookies.
Track changes


The changes are demanded by the European e-Privacy directive which comes into force in the UK in late May.

The section of the directive dealing with cookies was drawn up in an attempt to protect privacy and, in particular, limit how much use could be made of behavioural advertising.

This form of marketing involves people being tracked across websites, with their behaviour used to create a profile that dictates the type of adverts they see.

As part of its work to comply with the directive, the IAB - an industry body that represents web ad firms - created a site that explains how behavioural advertising works and lets people opt out of it.

The directive demands that users be fully informed about the information being stored in cookies and told why they see particular adverts.

Specifically excluded by the directive are cookies that log what people have put in online shopping baskets.

However, the directive is likely to have an impact on the more general use of cookies that remember login details and enable people to speed up their use of sites they visit regularly.

It could mean that after 25 May, users see many more pop-up windows and dialogue boxes asking them to let sites gather data.

Data delay


The exact steps that businesses have to go through to comply with the law and gain consent from customers and users are being drawn up by the Department for Culture, Media and Sport (DCMS).
A spokesman for the DCMS said that work on the regulations was "ongoing" but would not be complete by 25 May.

In a statement, Ed Vaizey, minister for Culture, Communications and the Creative Industries, said he recognised that the delay would "cause uncertainty for businesses and consumers".

 

"Therefore we do not expect the Information Commissioner's Office (ICO) to take enforcement action in the short term against businesses and organisations as they work out how to address their use of cookies," he added.

Information Commissioner Christopher Graham said: "I cannot bark at the industry at the moment because I have not got the regulations."

However, Mr Graham stressed that the government's confession that the regulations will be delayed should not be a spur to inaction.

"My message is that this is not your 'get out of jail free' card," he said.

The response to complaints about firms that flout the directive will be viewed in light of what they have done to prepare for it, continued Mr Graham.

Businesses should be considering how they will communicate with customers to get consent and look at the technical steps that might make that process easier, he explained.

Early work by the ICO suggests that gathering consent by changing settings on browsers may not be sophisticated enough for the demands of the directive.

"They have to think seriously about this," said Mr Graham. "It's going to happen and it's the law."

[BBC]

Malvertising attacks surge

Malvertising is on a significant rise, having doubled from Q3 to Q4 2010, according to Dasient.

Based on Q4 estimates, three million malvertising impressions were served per day, an increase of 100% as compared to 1.5 million malvertising impressions per day in Q3 2010.



The increase in the estimate from the previous quarter comes from a growth in malvertising incidents from networks monitored last quarter, plus malvertising incidents from additional “remnant” ad networks that Dasient started monitoring in Q4.

More than one million web sites were estimated to be infected in Q4 2010. As compared to data from one year prior (Q4 2009), web malware infections have nearly doubled and are a growing threat that needs to be abated.

The probability that an average Internet user will hit an infected page after three months of web browsing is 95%.

The top attacker domain was ipq.co, a free DNS forwarding service. Cybercriminals are abusing DNS forwarding services in an effort to hide and reduce the cost of executing their attacks.

Dasient found that most social media networks are prone to being used as distribution platforms for malware. They conducted some safe, benign experiments on various social networking sites, and found that infections can occur relatively easily through them via user-generated-content (UGC) interactions and advertisements.

[Net-Security]

Facebook to share home addresses, phone numbers

To the dismay of some, Facebook will indeed introduce a new feature that gives users the option of sharing their home addresses and cellphone numbers with third-party application developers.

Facebook managers are still working out specifics, but under a plan the company outlined late last month, the site would allow users to plug their address and phone number into applications they run on their accounts. The information would be shared only after a user specifically grants permission, and the information could be removed at any time by making a few changes in the user's settings panel.

Facebook already forbids people under 13 to use its services. The company still hasn't decided whether it users under the age of 18 will be permitted to share their address and phone number at all. Facebook also hasn't decided when the new capability will be rolled out.

The plan is being watched carefully by US Representatives Edward Markey and Joe Barton, co-chairs of the House Bi-Partisan Privacy Caucus. When Facebook first announced its intentions in January to allow address and phone number sharing, they objected to the plan, despite its opt-in nature. They said it was problematic “given the sensitivity of personal addresses and mobile phone numbers compared to other information users provide Facebook.”

Markey and Barton, a Massachusetts Democrat and a Texas Republican respectively, voiced their objections in a February 2 letter to CEO Mark Zuckerberg, but by then the criticism was so stiff that Facebook had already put the plan on hold.

Last week, Facebook VP for Global Public Policy Marne Levine sent a response (PDF) to the congressmen reiterating that the additional information would be shared only with a user's explicit permission.

“We allowed applications to ask users for that information, through a permissions screen, represented below, that provided clear and conspicuous notice to the user regarding what information the application is seeking,” Levine wrote. “Nor did we require or encourage users to grant such access.”

Levine went on to explain that users of certain third-party apps, such as those that send text messages to cellphones or deliver printed photos, might benefit from the feature.

The congressmen say the plan is still unsatisfactory.

“I don't believe that applications on Facebook should get this information from teens, and I encourage Facebook to wall off access to teen's contact information if they enable this new feature,” Markey wrote in a press release. “Facebook has indicated that the feature is still a work in progress, and I will continue to monitor the situation closely to ensure that sensitive personal user data, especially those belonging to children and teenagers, are protected.”

People are right to be wary of Facebook. Too many times over the past few years, the social network has betrayed a better-to-beg-for-forgiveness-than-ask-for-permission approach to sharing users' personal information by repeatedly relaxing its privacy policies without first getting explicit approval for the changes. That's not what's happening this time.

It's still questionable whether it's a good idea to share intimate information with a site that generates billions of dollars brokering it to world+dog. But that's life in the 21st Century. Facebook appears to have learned its lesson this time around. Now that the site is seeking informed consent before turning on the feature, it's up to users to decide if they want to use it.

Whether users are too generous with permission screens, as we've worried about in the past, is something better sorted out by Darwinian evolution than politicians. ®

[The Register]

IC3: Internet Crime Up in 2010

Internet crime is on the rise again according to a report recently released by The Internet Crime Complaint Center (IC3). The organization said last week that it received the second-highest number of complaints in its decade long history in 2010.

Released on February 24, the 2010 Internet Crime Report (.PDF) counted 303,809 complaints of Internet crime over the course of the year, down from 2009’s all-time high of 336,655. Nearly 15% of complaints came regarding non-delivery of payment or merchandise, while scams and identity theft rounded out the top three complaints with 13% and 10% respectively.

Cybercriminals are also having success targeting an older demographic than in the past. Complaints from last year came predominantly from the 40-59 year old bracket this year. In the early 2000s, the average age usually fell across the 30-39 age group, IC3 said.

When it came to gender, the IC3 saw even more Internet crime reports coming from males in 2010 as statistics in the report found men reported crime 2.5 to 1 over women.

The heightened complaint numbers over the last several years could be credited to two recent adjustments by the IC3. In 2010 the group added remote access to their database via a Complaint Management System (CMS). In 2009 the IC3 integrated an Internet Complain Search and Investigation System (ICSIS) which allows users of their database to better share information.

[ThreatPost]

The Cyberweapon That Could Take Down the Internet

A new cyberweapon could take down the entire internet – and there's not much that current defences can do to stop it.

So say Max Schuchard at the University of Minnesota in Minneapolis and his colleagues, the masterminds who have created the digital ordnance. But thankfully they have no intention of destroying the net just yet. Instead, they are suggesting improvements to its defences.

Schuchard's new attack pits the structure of the internet against itself. Hundreds of connection points in the net fall offline every minute, but we don't notice because the net routes around them. It can do this because the smaller networks that make up the internet, known as autonomous systems, communicate with each other through routers. When a communication path changes, nearby routers inform their neighbours through a system known as the border gateway protocol (BGP). These routers inform other neighbours in turn, eventually spreading knowledge of the new path throughout the internet.

A previously discovered method of attack, dubbed ZMW – after its three creators Zhang, Mao and Wang, researchers in the US who came up with their version four years ago – disrupts the connection between two routers by interfering with BGP to make it appear that the link is offline. Schuchard and colleagues worked out how to spread this disruption to the entire internet and simulated its effects.

Surgical strike
The attack requires a large botnet – a network of computers infected with software that allows them to be externally controlled: Schuchard reckons 250,000 such machines would be enough to take down the internet. Botnets are often used to perform distributed denial-of-service (DDoS) attacks, which bring web servers down by overloading them with traffic, but this new line of attack is different.

"Normal DDoS is a hammer; this is more of a scalpel," says Schuchard. "If you cut in the wrong places then the attack won't work."

An attacker deploying the Schuchard cyberweapon would send traffic between computers in their botnet to build a map of the paths between them. Then they would identify a link common to many different paths and launch a ZMW attack to bring it down. Neighbouring routers would respond by sending out BGP updates to reroute traffic elsewhere. A short time later, the two sundered routers would reconnect and send out their own BGP updates, upon which attack traffic would start flowing in again, causing them to disconnect once more. This cycle would repeat, with the single breaking and reforming link sending out waves of BGP updates to every router on the internet. Eventually each router in the world would be receiving more updates than it could handle – after 20 minutes of attacking, a queue requiring 100 minutes of processing would have built up.

Clearly, that's a problem. "Routers under extreme computational load tend to do funny things," says Schuchard. With every router in the world preoccupied, natural routing outages wouldn't be fixed, and eventually the internet would be so full of holes that communication would become impossible. Shuchard thinks it would take days to recover.

"Once this attack got launched, it wouldn't be solved by technical means, but by network operators actually talking to each other," he says. Each autonomous system would have to be taken down and rebooted to clear the BGP backlog.

Meltdown not expected
So is internet meltdown now inevitable? Perhaps not. The attack is unlikely to be launched by malicious hackers, because mapping the network to find a target link is a highly technical task, and anyone with a large enough botnet is more likely to be renting it out for a profit.

An alternative scenario would be the nuclear option in a full-blown cyberwar – the last resort in retaliation to other forms of cyberattack. A nation state could pull up the digital drawbridge by adjusting its BGP to disconnect from the internet, just as Egypt did two weeks ago. An agent in another country could then launch the attack, bringing down the internet while preserving the attacking nation's internal network.

Sitting duck
Whoever launched the attack, there's little we could do about it. Schuchard's simulation shows that existing fail-safes built into BGP do little to protect against his attack – they weren't designed to. One solution is to send BGP updates via a separate network from other data, but this is impractical as it would essentially involve building a shadow internet.

Another is to alter the BGP system to assume that links never go down, but this change would have to be made by at least 10 per cent of all autonomous systems on the internet, according to the researchers' model, and would require network operators to monitor the health of connections in other ways.

Schuchard says that convincing enough independent operators to make the change could be difficult.
"Nobody knows if it's possible to bring down the global internet routing system," says Mark Handley, an expert in networked systems at University College London. He suggests that the attack could cause "significant disruption" to the internet, with an effect greater than the Slammer worm of 2003, but it is unlikely to bring the whole thing down.

"The simulations in the paper make a lot of simplifying assumptions, which is necessary to simulate on this scale," he explains. "I doubt the internet would behave as described."

Schuchard and colleagues presented their findings at the Network and Distributed System Security Symposium in San Diego, California, two weeks ago.


[New Scientist] via [Gizmodo]

A civil perspective on cybersecurity

From Wired: Threat Level


"How important is cyberspace? It is hardly possible to overstate it. The internet is an engine of immense wealth creation, a force for openness, transparency, innovation and freedom. Without it, generators stop turning, phones fall silent, critical goods sit on loading docks. Without confidence in the integrity of financial data or health information, the economy trembles. Without connectivity, tens of thousands of communities disappear from view; a deployed solider cannot see her daughter’s swim victory, a multiple sclerosis patient is unable to confer with others about the latest medications, and first responders face an unknown chemical spill untethered.

Cyberspace functions as the very endoskeleton of modern life. So it’s no surprise that when bad actors emerge to exploit or threaten it — whether profit-driven criminals, electronic saboteurs or international espionage rings — there’s a temptation to define the threat in the strongest and simplest terms. These days, some observers are pounding out a persistent and mounting drumbeat of war, calling for preparing the battlefield, even saying that the United States is already fully into a “cyberwar,” that it is, in fact, losing."

To continue reading this article: http://www.wired.com/threatlevel/2011/02/dhs-op-ed/