internet security tHreAt rePOrt GOVernMent 2013

p. 80
Symantec Corporation
Internet Security Threat Report 2013 :: Volume 18
ThREAT ACTIVITy TRENDS
Commentary
• Approximately 63 percent of websites used to distribute
malware were identified as legitimate, compromised
websites that could be classified, an increase of two
percentage points compared with 2011. This figure excludes
URLs that contained just an IP address and did not include
general domain parking and pay-per-click websites.
• 7.7 percent of malicious website activity was classified in
the Blogging category.
• Websites classified as pornography were found to host the
greatest number of threats per site than other categories,
with an average of 4.4 threats per website, the majority of
which related to Trojans (82 percent).
• Analysis of websites that were used to deliver drive-by fake
antivirus attacks revealed that 4 percent of threats found
on compromised religion sites were related to fake antivirus
software. 43 percent of fake antivirus attacks were found on
compromised religion sites. 28 percent of attacks found on
compromised business sites were fake antivirus.
• Analysis of websites that were used to deliver attacks using
browser exploits revealed that 8 percent of threats found
on compromised anonymizer sites were related to browser
exploits. 32 percent of browser exploit attacks were found
on compromised anonymizer sites. 59 percent of browser
exploits were found on compromised blogging sites.
• 43 percent of attacks used on social networking websites
were related to malware hosted on compromised blogging
sites. This is where a URL hyperlink for a compromised
website is shared on a social network. Websites dedicated to
the discussion of hacking accounted for 14 percent of social
networking attacks.
• The Hacking category is used to classify websites
that promote or provide the means to practice illegal
or unauthorized acts of computer crime or related
programming skills.
• The Dynamic category is used to classify websites that have
been found to contain both appropriate and inappropriate
user-generated content, such as social networking or
blogging websites. Also, websites in which the page content
changes based how the user is interacting with it
(for example, an Internet search).
• The Known Malware Domain category are sites that have
no specific broad classification, but where the domain
was found to either contain malware or take advantage of
other exploits to deliver adware, spyware or malware. For
example, underground websites that may be used to openly
discuss and share malcode and related research.
• The Placeholder category refers to any domain name that is
registered, but may be for sale or has recently expired and
is redirected to a domain parking page.