Journal of Emerging Technologies in Web Intelligence Contents

JOURNAL OF EMERGING TECHNOLOGIES IN WEB INTELLIGENCE, VOL. 2, NO. 2, MAY 2010 153infection could have caused millions of dollars of damageand caused irreparable harm to hundreds of thousands ofusers through identity and asset theft. [3]But Web threats don’t just steal confidentialinformation; they can also steal network resources.Variations of e-greeting card spam were sent throughout2007. These simple spam messages told recipients that afriend had sent them an e-greeting card and to follow thelink in the email to view the card. If recipients followedthe link, it took them to a Web site that downloadedmalicious code.This code hijacked the computer, turning it into a “bot”and allowing the hackers to use the machine for their ownpurposes—sending spam, hosting malicious Web sites,and much more. Consumer and corporate computers wereinfected by the millions. Hackers network these infectedcomputers to create botnets, stealing resources and furtherperpetuating their fraudulent activities.II. WEB THREATS DEFINEDWeb threats are any threat that uses the Web tofacilitate cyber crime. They are sophisticated in theirmethods, using multiple types of malware and fraud, all ofwhich utilize HTTP or HTTPS protocols, but can alsoemploy other protocols as components of the attack, suchas links in email or IM, or malware in attachments or onservers that access the Web. The creators of such threatsfrequently update Web site content, variants, and malwaretypes in order to evade detection and achieve greatersuccess.Web threats based on malware are hidden within Webpages and victims are infected when they visit the page.Fraudulent sites mimic legitimate business Web sites anduse social engineering to request visitors to discloseconfidential information. Individuals once characterizedas hackers, virus writers, spammers, and spy ware makersare now simply known as cyber criminals with financialprofit their primary aim.Over the last 15 years, information security threatshave evolved through a series of incarnations. In eachcase, malware writers and fraudsters sought out themedium that was most used and least protected (forexample email). Today, a new wave of threats is emergingthat uses the Web as a delivery vehicle. These Web threatsare gaining traction at a time when the Web has become amajor commerce engine as well as social networkingvehicle, with usage continuing to grow.At the same time, the Web is relatively unprotected,compared to messaging for example, as a medium todeliver malware and conduct fraud. According to IDC,“Up to 30% of companies with 500 or more staff havebeen infected as a result of Internet surfing, while only20%-25% of the same companies experienced viruses andworms from emails.” [4]III. WEB THREAT DELIVERY MECHANISMSWeb threats can be divided into two primarycategories, based on delivery method – push and pull.Push based threats use spam, phishing, or other fraudulentmeans to lure a user to a malicious (often spoofed) Website, which then collects information and/or injectsmalware. Push attacks use phishing, DNS poisoning (orpharming), and other means to appear to originate from atrusted source. Their creators have researched their targetwell enough to spoof corporate logos, official Web sitecopy, and other convincing evidence to increase theappearance of authenticity. Precisely-targeted push-basedthreats are often called “spear phishing” to reflect thefocus of their data gathering (“phishing”) attack.Spear phishing typically targets specific individualsand groups for financial gain. In November 2006, amedical center fell victim to a spear phishing attack.Employees of the medical center received an email tellingthem they had been laid off. The email also contained alink that claimed to take the recipient to a careercounseling site. Recipients that followed the link wereinfected by a keylogging Trojan. [5] In other push-basedthreats, malware authors use social engineering such asenticing email subject lines that reference holidays,popular personalities, sports, pornography, world events,and other popular topics to persuade recipients to open theemail and follow links to malicious sites or openattachments with malware that accesses the Web.Pull-based threats are often referred to as “drive-by”threats, since they can affect any visitor, regardless ofprecautions. Pull threat developers infect legitimate Websites, which unknowingly transmit malware to visitors oralter search results to take users to malicious sites. Uponloading the page, the user’s browser passively runs amalware downloader in a hidden HTML frame (IFRAME)without any user interaction. Both push- and pull-basedWeb threat variants target infection at a regional or locallevel (for example, via local language sites aimed atparticular demographics), rather than using the massinfection technique of many earlier malware approaches.These threats typically take advantage of Internet port 80,which is almost always open to permit access to theinformation, communication, and productivity that theWeb affords to employees.IV. TODAY’S INSIDER - THREAT IS STEALTH MALWARELaw enforcement, computer crime experts, and eventhe military are playing catch up to the threat posed toconsumers, businesses, and national security as cybercriminals cash in on stolen identity data, fraudulent onlinetransactions, and cyber espionage. It is no surprise that therise in cyber crime has coincided with the increased use ofthe Internet and especially “Web 2.0” technologies.Web sites and applications now support usercontributedcontent, syndicated content, iframes, thirdpartywidgets (or applets), and convoluted advertisingdistribution networks into which ‘stealth’ malware caneasily be injected somewhere along the line. In a 2007USENIX paper, Google researchers determined thatapproximately 9% of all suspicious web sites launched“drive-by” downloads of stealth malware binaries[12].Government studies[13] estimate that 65% of all exploits© 2010 ACADEMY PUBLISHER