Prediction: Handful of Malicious Networks Will Spawn Most Attacks In 2012

Via Threatpost -

A shadowy web of malicious networks, or "malnets" will be the source of two thirds of online attacks in 2012, according to a report from the security firm Blue Coat.

Despite the continued industry focus on specific families and samples of malicious software, Blue Coat researchers say that identifying the common components of a handful of underlying infection infrastructures, which they are referring to as 'malnets,' is a more promising approach to stopping further infections.

The company's 2011 State of the Threat Landscape report identifies five principle malnets: Shnakule, Glomyn, Cavka, Naargo, and Cinbric.

Blue Coat describes Malnets as distributed network infrastructures designed to sweep up victims while they browse trusted Web sites and route them through the malnets: forwarding them along from a legitimate (but compromised) Web site through relay servers and on to exploit and payload servers. Blue Coat believes that nearly to-thirds of all attacks in 2012 will originate from these and other known malnets. The company's researchers hope to exploit these networks by identifying common components within them and then using that information to mitigate threats before they become active.

[...]

Malnets make tools like blacklists and signature based threat detection less effective, Larsen said. However, they do give vendors the opportunity to more thoroughly detect threats at an earlier stage - in some cases even before attacks have been launched.

Blue Coat said it is looking at ways to block attacks by determining variables that are reasonably constant across the malnet such as domain name similarities.

Larsen said that his company's data shows that organized crime groups and malicious hackers are sticking with what works when launching online attacks. Despite an overall decline in e-mail use, attacks via e-mail increased by nearly five per cent from the first half of the year and continue to be a large problem. Attacks launched from search-engine optimized Web sites were the most common entry point for malicious code. Search engine poisoning accounts for some 40 per cent of infection, Blue Coat found. At the same time, Social networking is moving up as a malware entry point. Now accounting for almost 6.5 per cent of infections, the report said.

Larson believes that the continued prevalence and success of search engine poisoning as a method of infection is evidence that we are doing a poor job of communicating the dangers of search. Too often, he said, users will trust a link just because it popped up as a top search result. Instead, users need to inspect URLs and make sure they are safe before following links.

-------------------------------------------------

Blue Coat Systems 2012 Web Security Report
Exposing Malnet Strategies and Best Practices for Threat Protection
http://www.bluecoat.com/2012-web-security-report