I have Anti Virus installed – Why do I keep getting infected?

By | January 13, 2010

According to Sophos for the first 6 months of the 2009 an average of 23,500 new web pages were infected every day, one every 3.6 seconds.

Here is why legitimate websites are becoming more dangerous

1. Polluted ads

Many legitimate sites rely on paid advertisements to pay the bills. Recent infection statistics show that they are often hiding malware, without the knowledge of the website owner or the user.

A lot of sites supported by advertisers, rather than contracting directly with the advertiser, work through ad agencies and network affiliates, some of these affiliates are less than diligent in reviewing content for flaws and infections

Ads that incorporate Flash animation and other rich media are often rife with security holes attackers can exploit. When the user clicks on the ad, the browser can be (and often is) redirected to sites that download malware in the background while the user is reading the legitimate site.

Someone in the ad-providing supply chain can be the culprit, though tracing a compromise back to them can be exceedingly difficult.

Whatever the case may be, a downloaded Trojan is then free to gather up usernames, passwords and other sensitive banking data

2. SQL injection attacks

SQL injection attacks are among the most popular of tactics and have been used in several high-profile incidents in the last couple of years.

SQL injection is a technique that exploits a flaw in the coding of a web application or page that uses input forms.

A hacker might, for example, input SQL code into a field that is intended to collect email addresses. If the application doesn’t include a security requirement to validate that the input is of the correct form, the server may execute the SQL command, allowing the hacker to gain control of the server.

The hacker essentially takes advantage of flaws related to shoddy site development.

3. User-provided content

It doesn’t take a genius to write a comment to a blog posting or something they see on a social networking site like Facebook or Twitter. The bad guys know this and are therefore taking the opportunity to pollute discussion threads and other sources of user-supplied content with spam-laden links.

You can get comment spam, completely irrelevant comments including links to sites trying to sell you stuff. They can also try posting full links to malicious sites or work in a little scripting, depending on the filter they are trying to work around.

4. Stolen site credentials

Using the types of malware and social networking tactics described above, as well as other means, attackers can steal the content provider’s log-in credentials. From there it’s no sweat logging into the site and making changes. It typically is a change so subtle and small that it escapes notice. The tiny bits of code added in can then steal the site visitor’s credit card or other data.

5. Compromised hosting service

This one is similar to number 4, where the credentials of the content provider are stolen and hackers log in to make sinister changes. Through this vector, the bad guys could potentially poison thousands of sites the provider is hosting in one strike.