January 27, 2009, 12:07 PM — Web sites rigged with malicious code are becoming more numerous by the day, but the time those sites are online is declining, according to new research from security vendor AVG Technologies.
AVG is seeing between 200,000 to 300,000 new Web sites per day hosting code that can in some cases result in a PC being infected with malware just by visiting the site, said Roger Thompson, AVG's chief research officer.
Up to 70 percent of those Web sites are regular ones that have been hacked in order to host malicious code, a statistic that shows how poor Web site security is across the Internet. The remainder are custom-built sites, he said.
Of those custom-built sites, however, there is some positive news. One common social-engineering trick is to put up a Web site offering codecs, or bits of software used to encode and decode video files. While purporting to be a codec, the file is often malicious software designed to steal data.
AVG found that up to 94 percent of the fake codec Web sites are taken offline within 10 days, with 62 percent taken down in a day or less. In the past, the sites may have stayed online as long as two weeks, showing that ISPs (Internet service providers) appear to be acting faster to remove them and current mechanisms for reporting bad Web sites are having an impact.
Still, the sheer number of sites infected may mean that the time online is less important as long as the hackers are attracting traffic.
Thompson said many hackers seek out less-professional Web sites with unpatched versions of "htaccess," a configuration file used to manage access to certain pages on a Web site.
Htaccess is a powerful file, since it can be manipulated to redirect users to other Web sites depending on how they came to the Web site, Thompson said. For example, it can be configured to direct users who found the Web site through Yahoo or Google to a different, hostile Web site which looks to see if the PC is potentially hackable.
But if the hostile Web site is being visited by a bot and not coming from a search engine, the site will refuse to serve up any exploits, making it difficult for security analysts to automatically scan the Web for bad sites, Thompson said.
However, hackers are getting lazy. They often reuse the same JavaScript and HTML (Hypertext Markup Language) code used to launch attacks, which makes those attacks easy to identify. That's good, since the underlying binary attack code can often also be tricky for security software to identify.
"That's a pretty good bottleneck," Thompson said. "It's like having a letter bomb with the outside of the envelope saying 'I'm a bomb'."
Thompson developed a product called LinkScanner that scans Web sites to see if it hosts malware. He sold his company, Exploit Prevention Labs, to AVG -- then Grisoft -- in December 2007. AVG has since incorporated LinkScanner into its free product, AVG 8.0 Free Edition.
