YNOT – Surfers are more likely to be hit with a malware attack as a result of searching for images on major search engines than while surfing porn sites, a web security company has determined.
According to Blue Coat Systems Inc.’s “2011 Mid-Year Web Security Report,” almost 40 percent of malware infections occur as a consequence of “search engine poisoning.” Although the report noted as many as 110,000 new pornography websites go live online daily, surfers are much more likely to encounter malware network entry points while employing a search engine to find any kind of image.
Email and porn as vectors for malware distribution placed a distant third and fourth, respectively, on Blue Coat’s “greatest hits” list — behind warez and file-sharing sites (no surprise there) and search engines, which ranked first and second. Social networks ranked fifth as a source of malware infection.
“Image searches are the most dangerous activity users can engage in on the web,” the report notes, but “[p]ornography remains the last ‘old school’ lure. New adult websites are generated daily, which makes real-time web content analysis and threat detection a requirement.”
Blue Coat’s report also noted “malware delivery networks are now hiding in legitimate sites that are typically allowed by [corporate network] acceptable use policies.”
The company recommends surfers not “search for porn or cracked/pirated software and movies. A high percentage of these are malware lures” used by criminal networks like Shnakule, a particularly malicious operation that employs a wide variety of vectors to distribute “drive-by downloads, fake anti-virus and codecs, fake Flash and Firefox updates, fake warez, and botnet/command and controls. Interrelated activities include pornography, gambling, pharmaceuticals, link farming and work-at-home scams.”
For the first half of 2011, Shnakule was the leading malware delivery network, both in size and effectiveness. On average, the network controlled 2,000 unique host names per day with a peak of more than 4,300 per day. It also proved the most adept at luring users, with an average of more than 21,000 requests and as many as 51,000 requests in a single day.
Not only is Shnakule far-reaching as a standalone malware delivery network, but it also contains many large component malware delivery networks. Ishabor, Kulerib, Rabricote and Albircpana, which all consistently rank among the 10 largest malware delivery networks, actually are components of Shnakule and extend its malicious activities to gambling-themed malware and suspicious link farming.
Regardless its own research findings, Blue Coat could not resist warning corporate netizens about the dangers of pornography. Among the company’s recommendations for safe on-the-job surfing was this piece of advice: “Businesses should consistently block pornography, placeholders, phishing, hacking, online games and illegal/questionable categories to follow best practices for web security.”
