U.S.-based servers host majority of malicious code, study finds
One reason: Free Web hosting servers are readily available
Computerworld - Forget China, Russia or eastern European countries. When it comes to malicious code, U.S.-based servers host an overwhelming majority of it, according to security vendor Finjan Inc.
That conclusion is based on an analysis of more than 10 million URLs collected from live end-user traffic in the U.K using Finjan's content inspection engines, said Yuval Ben-Itzhak, chief technology officer Finjan. Unlike some other studies, which look at domain names to make assumptions on where a server is based, Finjan's research tracked each IP address to its exact geographical location, Ben-Itzhak said.
"Most people think of Russia and China when you talk about malicious code," he said. "However, it appears this fact is no longer valid. What we found was that about 80% of the malicious code comes from servers hosted in the U.S."
The other top countries hosting malicious code are the U.K., with 10%, and Canada, Germany and Italy, Ben-Itzhak said. "The results of this study shatter the myth that malicious code is primarily being hosted in countries where e-crime laws are less developed," he said.
One of the reasons for the trend could simply be that free Web hosting servers are more readily available in North America and Europe than in some other regions, according to Finjan. That makes it more cost-effective for cybercriminals to host malicious code on servers in those countries. In many cases, malicious code also appears to have been hosted on servers offering legitimate content that were compromised by hackers, the report said.
The Finjan report also notes a continued trend toward the appearance of malicious code on legitimate sites frequented by business users and consumers. Unlike in the past, when most malicious code was found on questionable sites such as those hosting porn, users are now just as likely to get infected when visiting finance and travel sites, for instance.
Advertisements containing malicious code continue to be a growing problem, Ben-Itzhak said. The fact that numerous parties -- ad agencies, affiliate networks and adware makers -- are involved in the delivery chain from advertiser to consumer, makes it an ideal channel to hide spyware and other malware, Ben-Itzhak said.
One recent example was an advertisement for a security program called WinFixer that started appearing on Microsoft Corp.'s Windows Live Messenger in February without the company's consent or knowledge. Similarly, last June, malware contained in a banner advertisement on MySpace.com managed to infect about 1 million PCs, the Finjan report noted.
Cybercriminals are also increasingly planting their code in search engine results from Google, Yahoo and MSN, the report warned.
In most cases, the malicious code that is being distributed are botnets and Trojan programs, the Finjan report said.
Read more about Security in Computerworld's Security Topic Center.
- Silicon Valley's 19 Coolest Places to Work
- Is Windows 8 Development Worth the Trouble?
- 8 Books Every IT Leader Should Read This Year
- 10 Hot Hadoop Startups to Watch
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- Logicalis eBook: SAP HANA: The Need for Speed Without timely business insights, organizations today can suffer logistical, manufacturing, and even financial disaster in a matter of minutes
- Neustar 2014 DDoS Attacks and Impact Report For the third consecutive year, Neustar surveyed hundreds of companies on distributed denial of service (DDoS) attacks. The survey reveals evidence that the...
- Acxiom Case Study This case study, which focuses on Acxiom, explores how the company was able to secure employee data, reduce migration costs and boost productivity...
- Windows® XP Migration: Protect and Secure Critical Data With the end of the Microsoft Windows XP operating system's lifecycle on April 8, 2014, businesses are faced with the decision to migrate...
- Top 4 Digital Signage Fails Join RMG Networks for a look at four of the most common reasons digital signage fails in corporate businesses. Learn about strategies to...
- Building Tomorrow's Infrastructure Listen to this podcast to discover how Crider Foods worked with PC Connection to update their IT infrastructure, while maintaining compliance and control. All Hardware White Papers | Webcasts
Our new weekly Consumerization of IT newsletter covers a wide range of trends including BYOD, smartphones, tablets, MDM, cloud, social and what it all means for IT. Subscribe now and stay up to date!