Researcher: Cleaning Chinese malware sites harder than in US

Over half of all sites spreading malware are based in China, says Stopbadware.org

More than half the sites spreading malicious code are hosted on Chinese networks, an anti-malware group said Wednesday.

Of the over 213,000 malware-hosting sites analyzed last month by Stopbadware.org -- a joint effort of researchers at Harvard, Oxford and several corporations, including Google and Sun Microsystems -- 52 per cent were hosted by servers running Chinese IP addresses. Of the top 10 networks serving malicious code, six are Chinese.

The US hosts 21 per cent of the malware sites, giving it the dubious honor of second place.

Stopbadware.org, which uses data collected by Google's crawlers, wouldn't speculate on what proportion of the sites, Chinese or otherwise, were deliberately hosting malicious code and what fraction were actually legitimate sites that have been hacked. But the dramatic year-to-year growth in the number of sites serving up malware is likely due to a boom in site hacking.

"It's hard to tell how much of the increase is due to Google expanding its efforts [in scanning for malicious sites] but by other reports and researchers, it's reasonable to say that the growing number is in large part due to the growth in [SQL injection] attacks," said Maxim Weinstein, the manager of Stopbadware.org.

With Google fingering only 45,000 to 50,000 sites last year, May's number is up more than 300 per cent. "There's just a much larger number of infected sites out there," said Weinstein.

The number of hacked sites, most compromised through SQL injection attacks, has soared in 2008, with some estimates of the total number of hijacked legitimate pages reaching as high as three million. The problem has become so acute, said Microsoft yesterday, that it and Hewlett-Packard joined forces to launch free tools that site developers and administrators can use to search for vulnerable code and block incoming attacks.

And while Stopbadware.org had some success last year in getting some US-based networks to clean out malware-hosting sites, Weinstein didn't sound as confident that the group could make the same progress with Chinese operators.

"It's a bigger challenge, to be sure," he acknowledged. "We don't understand the landscape nearly as well. We have attempted to contact all the Chinese networks, but we haven't always been successful. It's tougher when you start crossing national and cultural lines."

But Stopbadware.org's is still trying to contact network owners and convince them to shut down deliberate hosts and help legitimate sites eradicate malware that's made it onto their servers, Weinstein said. "We want to get these conversations going," he said. "We've shown that when the parties are willing to talk, the approach works. We hope to see the same sort of approach working in China."

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Gregg Keizer

Computerworld
Show Comments

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Kurt Hegetschweiler

Brother PocketJet PJ-773 A4 Portable Thermal Printer

It’s perfect for mobile workers. Just take it out — it’s small enough to sit anywhere — turn it on, load a sheet of paper, and start printing.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?