AVG notes rise in number of malicious Web sites

Web sites rigged with malicious code are becoming more numerous by the day, according to new research from security vendor AVG Technologies.

Web sites rigged with malicious code are becoming more numerous by the day, but the time those sites are online is declining, according to new research from security vendor AVG Technologies.

AVG is seeing between 200,000 to 300,000 new Web sites per day hosting code that can in some cases result in a PC being infected with malware just by visiting the site, said Roger Thompson, AVG's chief research officer.

Up to 70 percent of those Web sites are regular ones that have been hacked in order to host malicious code, a statistic that shows how poor Web site security is across the Internet. The remainder are custom-built sites, he said.

Of those custom-built sites, however, there is some positive news. One common social-engineering trick is to put up a Web site offering codecs, or bits of software used to encode and decode video files. While purporting to be a codec, the file is often malicious software designed to steal data.

AVG found that up to 94 percent of the fake codec Web sites are taken offline within 10 days, with 62 percent taken down in a day or less. In the past, the sites may have stayed online as long as two weeks, showing that ISPs (Internet service providers) appear to be acting faster to remove them and current mechanisms for reporting bad Web sites are having an impact.

Still, the sheer number of sites infected may mean that the time online is less important as long as the hackers are attracting traffic.

Thompson said many hackers seek out less-professional Web sites with unpatched versions of "htaccess," a configuration file used to manage access to certain pages on a Web site.

Htaccess is a powerful file, since it can be manipulated to redirect users to other Web sites depending on how they came to the Web site, Thompson said. For example, it can be configured to direct users who found the Web site through Yahoo or Google to a different, hostile Web site which looks to see if the PC is potentially hackable.

But if the hostile Web site is being visited by a bot and not coming from a search engine, the site will refuse to serve up any exploits, making it difficult for security analysts to automatically scan the Web for bad sites, Thompson said.

However, hackers are getting lazy. They often reuse the same JavaScript and HTML (Hypertext Markup Language) code used to launch attacks, which makes those attacks easy to identify. That's good, since the underlying binary attack code can often also be tricky for security software to identify.

"That's a pretty good bottleneck," Thompson said. "It's like having a letter bomb with the outside of the envelope saying 'I'm a bomb'."

Thompson developed a product called LinkScanner that scans Web sites to see if it hosts malware. He sold his company, Exploit Prevention Labs, to AVG -- then Grisoft -- in December 2007. AVG has since incorporated LinkScanner into its free product, AVG 8.0 Free Edition.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags exploits and vulnerabilitiesAVGsecurity

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Most Popular Reviews

Latest News Articles

Resources

PCW Evaluation Team

Azadeh Williams

HP OfficeJet Pro 8730

A smarter way to print for busy small business owners, combining speedy printing with scanning and copying, making it easier to produce high quality documents and images at a touch of a button.

Andrew Grant

HP OfficeJet Pro 8730

I've had a multifunction printer in the office going on 10 years now. It was a neat bit of kit back in the day -- print, copy, scan, fax -- when printing over WiFi felt a bit like magic. It’s seen better days though and an upgrade’s well overdue. This HP OfficeJet Pro 8730 looks like it ticks all the same boxes: print, copy, scan, and fax. (Really? Does anyone fax anything any more? I guess it's good to know the facility’s there, just in case.) Printing over WiFi is more-or- less standard these days.

Ed Dawson

HP OfficeJet Pro 8730

As a freelance writer who is always on the go, I like my technology to be both efficient and effective so I can do my job well. The HP OfficeJet Pro 8730 Inkjet Printer ticks all the boxes in terms of form factor, performance and user interface.

Michael Hargreaves

Windows 10 for Business / Dell XPS 13

I’d happily recommend this touchscreen laptop and Windows 10 as a great way to get serious work done at a desk or on the road.

Aysha Strobbe

Windows 10 / HP Spectre x360

Ultimately, I think the Windows 10 environment is excellent for me as it caters for so many different uses. The inclusion of the Xbox app is also great for when you need some downtime too!

Mark Escubio

Windows 10 / Lenovo Yoga 910

For me, the Xbox Play Anywhere is a great new feature as it allows you to play your current Xbox games with higher resolutions and better graphics without forking out extra cash for another copy. Although available titles are still scarce, but I’m sure it will grow in time.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?