Security firms warn of smarter viruses

Botnets fuel alarming growth in spyware

Iain Thomson, vnunet.com 30 Sep 2005

The first reports into September's security threats indicate that virus writers are getting smarter, using smaller malware that performs a specific task rather than trying to cause mass virus outbreaks.

According to the monthly virus chart from security firm Sophos the most common infection in September was Netsky P, a worm first identified 19 months ago.

Mytob variants accounted for over half of all virus infections, taking eight of the top 10 positions.

"Smaller, targeted attacks are on the increase with the emergence of a new breed of financially-motivated online criminal," said Carole Theriault, senior security consultant at Sophos.

"The concern is that if users continue to combine unsafe computing practices with outdated threat protection, they will be a soft target for this new form of attack."

Theriault added that the appearance of Netsky at the top of the chart raised some serious questions about PC users' levels of protection.

The prevalence of a worm of this age indicates a body of users who are taking no precautions at all and acting as a reservoir of infection for the rest of the online community.

This group may also be responsible for the large amounts of spyware in circulation last month, according to security vendor Fortinet. Infected PCs under slave control to a virus writer are becoming an increasing problem.

"Most malicious emails are spammed via infected hosts, so a rise in spyware activity is likely to reflect a trend in cyber-criminal activity," said Guillaume Lovet, threat response team leader at Fortinet.

"Now that large-scale nets of infected hosts (i.e. botnets) have been well established for a while, the commercial activities of their owners are flourishing.

"The two most lucrative are the relaying of spam and phishing attacks, and the aggressive seeding of spyware."

Fortinet's survey identified US users as the top target for spyware attacks, representing nearly 30 per cent of reported infections.

Korean users were the next most popular targets, possibly due to the high levels of broadband use in the country.

Sophos Top 10 viruses for September 2005:

1. W32/Netsky-P 18.6%
2. W32/Mytob-BE 7.6%
3. W32/Mytob-AS 6.8%
4. W32/Zafi-D 4.3%
5. W32/Netsky-D 3.3%
6. W32/Mytob-CX 2.8%
7. W32/Mytob-EP 2.7%
8. W32/Mytob-CJ 2.6%
9. W32/Mytob-C 2.5%
10. W32/Mytob-CN 2.0%