Overview. Malware Trends. Internet Threats Trend Report - February ,000 Android malware samples

Transcription

1 Internet Threats Trend Report February 2013

2 Overview The fourth quarter of 2012 showed exponentially increased levels of Android malware as well as Web threats (phishing) that truly threatened mobile users. -attached malware was also sent in large quantities in Q4 but completely tailed off in the new year. Spam levels remained constant and spammers generally stuck to tried and tested methods for tricking mail recipients into visiting online pharmacies. Malware Trends 178,000 Android malware samples The Android OS is now installed on hundreds of millions of devices. In Q alone, 122 million Android devices were sold, compared to 60 million for the same period in 2011 (Gartner November 2012). Cybercriminals have clearly taken notice of the huge number of devices, as evidenced by the explosive growth of Android malware over the last year. Although January s level was still astonishingly high (over 178,000 unique samples) it did represent a 16% drop from the over 214,000 samples collected in December Commtouch s AV Lab analysts have explained that the December levels may have been an anomaly. Levels of attached malware increased in the fourth quarter of 2012 as illustrated by several high peaks in the graph below. The attacks used s describing an attachment as being the scan from a Xerox Workcenter. This is not a new ploy and was last seen in February last year. Last year s version was an actual PDF file with an embedded malicious script. These s featured a zipped executable. Page 1

3 Attached Malware levels Oct 2012 to Feb 2013 The attacks continued with efaxcorporate, announcing the arrival of a (21 page) fax message. Once again the attachment was an executable file pretending to be a PDF. The file was detected as W32/Trojan2.NTLB by Commtouch s Antivirus. The malware scanned the infected system for FTP programs looking for FTP credentials that could be stolen to access and compromise Web servers (which can then be used to serve malware links). Since mid-december attached-malware levels have fallen to year-low levels. Page 2

4 Spam Trends In addition to the obvious-named-spam ( s with Viagra blatantly written in the subject line), spammers continued to use phony LinkedIn and Facebook-like notifications to trick recipients into visiting their sites. These were supplemented with support center and notification s. Samples are shown here: Spam samples Spam levels since October 2012 are shown below. Spam levels Oct 2012 to Feb 2013 Page 3

5 Spam levels remained fairly constant with the expected drop around the Christmas and New Year period. The average daily spam level was 90 billion messages per day a slight increase over Q The lowest level was 52 billion recorded on the last day of 2012 and the highest was an unusual spike of 134 billion at the start of December. Spam averaged between 71% and 80% of all s sent globally. Spam % of all s Oct 2012 Feb 2013 Spam Topics Commtouch s spam topics cloud tool samples thousands of spam messages at definable intervals and plots frequently occurring terms in proportionally larger text. Spam subjects that have been sent in massive quantities therefore become instantly distinguishable. The spam cloud for the entire fourth quarter is shown below. Traditional spam topics such as pharmaceuticals, replicas and enhancers are clearly visible. Spam topics cloud for Q Page 4

6 Web security Trends Harvard University s Department of online pharmacy The Education category regularly features top 10 for sites that have been compromised with malware or that are hiding phishing sites. For Q education was in fact the category most likely to unknowingly host malware. During Q4, Harvard University s Department of Government website was hacked and used to host a pharmacy page. Although this is not malware or phishing it illustrates the point that these sites are vulnerable. Spam pharmacy page in hacked Harvard University server. Source: anchous.info During the fourth quarter of 2012, Commtouch analyzed which categories of Web sites were most likely to be compromised with malware. The top 10 is summarized in the table below. Website categories infected with malware Rank Category Rank Category 1 Education 6 Health & Medicine 2 Travel 7 Restaurants & Dining 3 Sports 8 Streaming Media & Downloads 4 Business 9 Leisure & Recreation 5 Entertainment 10 Pornography/Sexually explicit Page 5

7 Similarly, the table below summarizes the categories of legitimate Web sites that were most likely to be hiding phishing pages. The Portals category represents free webpage services which are easily abused to host phishing pages. Website categories infected with phishing Rank Category Rank Category 1 Portals 6 Restaurants & Dining 2 Computers & Technology 7 Business 3 Shopping 8 Streaming Media 4 Education 9 Health & Medicine 5 Fashion & Beauty 10 Travel A PayPal phishing attack from November clearly illustrates the need for Web security on mobile devices. The attack starts with the traditional warning of a limited account. Clicking on the links reveals a well-constructed PayPal phishing page. On a mobile device the URL looks quite genuine. In actual fact the URL is unusually long - the full URL is: d5e8d25s.fdsf456e6d5sde8d56s4d.d545d4e84d5d.d89d98jhnd9ed.5455 d57s5656.friponne.fr/ PayPal phishing message (left) and phishing site (right) with seemingly genuine part of URL: displayed by browser Page 6

8 Zombie Hot Spots India dropped below 20% of the world s spam sending zombies, settling on just over 17%. Brazil dropped from second place with over 8% to 12 th place. Romania and Columbia dropped out of the top 15, replaced by the US and first time top-15 entrant Taiwan. Worldwide Zombie distribution in Q SillySpam And finally evidence of over-excitable spammers who may not have taken the time to proof-read their message: Page 7

9 About Commtouch Commtouch (NASDAQ: CTCH) is a leading provider of Internet security technology and cloudbased services for vendors and service providers, increasing the value and profitability of customers solutions by protecting billions of Internet transactions on a daily basis. With six global data centers and renowned technology, Commtouch s , Web, and antivirus capabilities easily integrate into customers products and solutions, keeping more than 350 million end users safe. To learn more, visit References and Notes Reported global spam levels are based on Internet traffic as measured from unfiltered data streams, not including internal corporate traffic. Therefore global spam levels will differ from the quantities reaching end user inboxes, due to several possible layers of filtering. Spam levels do not include s with attached malware. Visit us: and us: sales@commtouch.com Call us: Americas: , EMEA: APAC: Copyright 2013 Commtouch Software Ltd. Commtouch Software Ltd. Recurrent Pattern Detection, RPD, Zero-Hour and GlobalView are trademarks, and Commtouch, Authentium, Command Antivirus and Command Anti-malware are registered trademarks, of Commtouch.. Android is a trademark of Google Inc.