What
a world. First worms and viruses, then phishing schemes. But now,
cautions Trend Micro Chief Technology Officer Raimund Genes, your
online life may get that much hairier.
Welcome to the brave new world of booby-trapped Web pages. If Trend Micro's predictions hold up, more cyberattacks will originate from the Web than they do from e-mail.
That shift is expected to take place sometime next year, according to
Genes. CNET News.com caught up with Genes to find out how he sees the
battle lines shifting.
Q: At the Gartner IT conference earlier this year, you talked about how Web threats are going to outdo or surpass e-mail threats. Can you flesh that out a bit? What do you mean by a Web threat?
Genes: Yes. A Web threat is something which uses the Internet to
execute malicious activity. So, for example, even something which
arrives via e-mail, if it can't survive without additional downloads
from the Internet, it still constitutes a Web threat. It might be an
e-mail containing a URL, but all the rest works via the Internet.
If an e-mail contains the URL, does it qualify as a Web threat or is it still an e-mail threat, according to your definition?
Genes: It's a Web threat because everything which needs the Internet to
execute a malicious activity is a Web threat. What we are also seeing
among enterprise users, with pretty tight security on e-mail, is that
the main infection vector is actually over the Web. They do a good job
in e-mail filtering, but a bad or no job at all when it comes to Web
filtering.
Is that the only reason that Web threats are becoming bigger?
Genes: No, it's also because it's more attractive for the bad guys. If
Webmasters are careless, then you have a perfect infection scene. You
have a silent killer and you don't have the e-mail evidence to trace it
back to the initial infection scene. It's perfect for espionage and all
kinds of stuff.
Are these Web threats targeted at a particular audience or are they pretty much trying to get whoever they can get?
Genes: Overall, they try to get anyone they can because it's mainly to
plant a bot or to hijack a computer. Let's face it: everybody is a
consumer somehow--especially the enterprise users who use a notebook at
home.
How do you defend yourself?
Genes: You
could outsource e-mail security. But with Web security, it's more
difficult. You're talking about massive investments from the hosting
sites to do this at an acceptable speed via an external proxy. I
haven't seen this model really working. There are some start-ups
offering this, but I wonder how much money they lose every month.
What can consumers do to guard or protect themselves?
Genes: They could do a lot. They regularly have to patch the operating
system and the browser. No. 2: They should use alternative browsers.
They shouldn't use widespread browsers like Internet Explorer. This
doesn't mean that Firefox does not have vulnerabilities, but most of
the Web threats we are seeing are connected to having Internet
Explorer. By moving to an alternative browser, you already do a kind of
risk mitigation.
You're not saying the solution is to install some kind of security software?
Genes: No. Of course installing security is, for me, baseline. It's
like patching an operating system. But look: We could come out and say
we will be able to protect all our users. But we never will be able to
offer 100 percent protection. Nobody can.
What happens with typical Web threats? What do these things do to your computer or what do they attempt to do?
Genes: They attempt to convert your computer into a bot. It could be a
spambot or it could be a distributed denial-of-service attack bot. It
could be a key logger, an information stealer. It tries to use your
computer power.
Most of the bots we see are really to create spam on the
infected machines. They also attempt to use them for distributed
denial-of-service attacks, to hold people ransom and to attack them
with a lot of computers. The third thing they try is, of course, to
function as an information stealer. It is trained to recognize the
format of your credit card while you type in the number or while you do
your online purchases. It will look for certain keywords and documents.
You talked about using a different browser or
using a virtual machine. Should corporations do the same things or are
there different things you recommend?
Genes: No. Based on user behavior this will just be
difficult to enforce. And of course, there's a loss of productivity.
Some companies are pretty radical about what they're using...and they
strictly define what is allowed within a corporate environment. For
instance, whether (instant messaging) is allowed or if peer-to-peer
networking is allowed.
In a corporate environment this could be
company-threatening. Maybe the malware hasn't been targeted to actually
attack the company. But guess what happens when the attacker sees a lot
of documents or a lot of stuff that's confidential? He will try to sell
it.
What's the breakdown between e-mail threats versus the Web threat definition?
Genes: There is an increase in Web threats compared with normal
worms...the number of worms has increased by 22 percent since
first-quarter 2005, while Web threats have increased by 540 percent.
Would you call this a new era of threats or is there no such big word needed to describe Web threats?
Genes: I wouldn't call it a new era, it's just logical. Nowadays, the
bad guys try to make money out of it. To make money they have to
control something as long as possible. And they have to update it
because the bot, after a certain amount of activity, gets outdated in
about a week.
