U.S. Remains King of Spam, But China Challenges The Top Position For Web-Based Malware

  According to a new report from security firm Sophos, the United States still retains its title as king of the spam scene, but China is now sharing in the shame as the nation that generated the most malicious code in 2006.

  The security firm Sophos released annual Security Threat Report yesterday. The report shows us that U.S. is still world's spam leader, but China is now sharing the top position for web-based malware source with U.S.

  The Security Threat Report 2007 said the Windows is the primary target for hackers, with internet criminals increasingly manufacturing downloading Trojan horses rather than mass-mailing worms to do their dirty work for them.

  The top ten countries hosting web-based malware during 2006 were:

• United States 34.2%
• China 31.0%
• Russian Federation 9.5%
• Netherlands 4.7%
• Ukraine 3.2%
• France 1.8%
• Taiwan 1.7%
• Germany 1.5%
• Hong Kong 1.0%
• Korea 0.9%
• Others 10.5%

  "The US remains a hot spot for online criminal activity, and despite authorities' continued efforts to clamp down on cyber crime, too many US-hosted websites still have lax security measures in place," said Carole Theriault, senior security consultant for Sophos. "Given the effectiveness of web-based attacks, web hosting companies in the US and elsewhere need to step up their policing of published content, and ensure that malicious code is quickly removed, before innocent users get hit."

  The top twelve spam-relaying countries during 2006 were:

• United States 22.0%
• China (including Hong Kong) 15.9%
• South Korea 7.4%
• France 5.4%
• Spain 5.1%
• Poland 4.5%
• Brazil 3.5%
• Italy 3.2%
• Germany 3.0%
• United Kingdom 1.9%
• Russia 1.8%
• Taiwan 1.8%
• Others 24.4%

  Email threats decline while malicious web content grows

  Sophos found that the most prolific email threats during 2006 were the Mytob, Netsky, Sober and Zafi families of worms, which together accounted for more than 75% of all infected email. However, Sophos predicts that 2007 is likely to see a significant shift away from the use of email security threats, with cyber criminals instead looking to exploit the continued global growth in web use, as well as user-defined web content.

  Email will continue to be an important vector for malware authors, though the increasing adoption of email gateway security is making hackers turn to other routes for infection. The number of websites being infected with malware is on the rise SophosLabs is currently uncovering an average of 5,000 new URLs hosting malicious code each day.

  "The internet now represents the easiest way for cyber criminals to gain entry to corporate networks, as more users are accessing unregulated sites, downloading applications and streaming audio/video, potentially jeopardising security in the process," continued Theriault. "A great many businesses aren't geared up to gain insight into users' online behaviour, let alone control it, and it's vital that they now begin to examine ways to incorporate web security into their overall IT security strategy."

  Trojans taking over from spyware

  During 2006 Sophos saw a decrease in the use of traditional spyware, in favour of multiple Trojan downloaders. The hacker sends a 'special offer' (or similar) email in an attempt to dupe recipients into visiting a website containing a malicious downloader. The executable file will attempt to download additional Trojans, a process that may be repeated multiple times to try and disable all security defences, before it downloads a spyware component - which will then have a better chance of success.

  Statistics reveal that in January 2006 spyware accounted for 50.43% of all infected email, while 40.32% were emails linking to websites containing Trojan downloaders. By December 2006 the figures had been reversed, with the latter now accounting for 51.24%, and spyware-infected emails reduced to 41.87%. This trends looks set to continue into 2007 and beyond.

  Malware types differ according to location   Sophos notes that 30% of all malware is now written in China, most of it taking the form of Trojans used for gaining a backdoor into users' computers. Surprisingly, 17% of malware written in China is designed for the specific purpose of stealing passwords from online gamers. In contrast, malware authors based in Brazil are responsible for 14.2% of all malware, the majority of which is designed to steal information from online bankers.

  "It's interesting to see how malware varies depending on location, often exploiting current country-specific online trends. Identifying the source of the malware helps security experts and authorities strengthen criminal profiles and bring the perpetrators to justice," added Theriault.

  Sophos detected 41,536 new pieces of malware in 2006, bringing the total protected against to 207,684. Of these threats, Trojans now outnumber Windows viruses and worms by 4:1. The proportion of infected emails was down from 1 in 44 during 2005 to just 1 in 337 during 2006.