The 2013 Threat Report from the Websense® Security Labs™ is now available.

The report details mobile, social, email and web-based threats, and while it is full of ominous data points, it is a very interesting read. The report is designed to help security professionals keep current with threat trends and improve the effectiveness of existing security solutions. It can also be used to identify and prioritize security gaps that may require new approaches and more innovative strategies.

Creating the report began with the Websense ThreatSeeker® Network, composed of big data clusters used by the WSL to collect and manage up to 5 billion inputs each day from 900 million global endpoints. Malware samples, mobile applications, email content, web links and other information were then passed through deep analysis processes including Websense ACE (Advanced Classification Engine), which applied over 10,000 different analytics.

Here is a sampling of key findings from this year's report:

1. Web Security. The web became significantly more malicious in 2012, both as an attack vector and as the primary support element of attacks originating through social media, mobile devices, and email. Researchers measured an alarming 600 percent increase in the use of malicious web links through all vectors.
2. The Social Web. Malicious content was hidden within social media behind shortened web links 32 percent of the time. Social media attacks took advantage of the confusion of new features, changing services and unsophisticated users.
3. Mobile Security. A study of last year's malicious apps revealed how they often abuse permissions; especially in the use of SMS communications, something very few legitimate apps do. Risks also increased as mobile devices were used for social media and web surfing more often than actually making a phone call.
4. Email Security. Only 1 in 5 emails sent were legitimate, as spam increased to 76 percent of email traffic, and 92% of spam included links to potentially malicious content. Phishing threats delivered via email also grew.
5. Malware Behavior. Forensic analysis identified that registry modification behavior in malware has declined to 7.7%. Once a key indicator of malicious behavior, malware has now become increasingly Internet-connected. Half of all malware that used the Internet for communications and downloaded additional malicious executables to extend their attack capabilities in the first 60 seconds.
6. Data Theft. Key changes in data theft targets and methods took place last year. Reports of intellectual property (IP) theft increased, and theft of credit card numbers and other Personally Identifiable Information (PII) continued to grow. Hacking, malware and other cyber-threats continued to be common methods of attack. However, some of the largest thefts involved physical penetration of security as well, often by willful employees.

Because today's attacks occur in multiple stages through numerous vectors, the report includes an appendix on The Seven Stages of Advanced Threats. This methodology for analyzing and classifying cyber-attacks provides a useful framework for organizations to assess their current defenses against their security profile, identify weaknesses and develop a more comprehensive strategy for withstanding next-generation attacks. A summary of the Websense 2013 Security Predictions report is also included for planning purposes.

Click for a video introduction or download a copy of the 2013 Threat Report.

A few days ago, Websense® SecurityLabs™ detected a large-scale malware campaign mainly targeting WordPress pages. We have received many questions about who and which websites are in danger and how to protect against this attack. While many forum posts and comments speculate that outdated WordPress versions are at fault, unfortunately, we found that this is not true. We dug a bit into this subject and analyzed 30,000 domains to see what types and versions of CMS (Content Management System) have been compromised so far.

We checked several aspects of each of these compromised websites and concluded that most of them are served by Apache webserver and PHP environment. As you can see in the pie chart below, PHP dominates the server side:

Digging a little deepter, we were also able to examine which CMS were victims of the attack. Initially, when we discovered the attack, we found only WordPress sites, and after a week or so, the picture did not change that much. WordPress still serves the majority of the compromised websites; however, we did see a small amount of other CMS as well. We also noticed that an increasing number of Joomla sites are also affected, with all other content managers making up a tinier slice.

The big question still remains: Is my Website protected if I use the latest WordPress version? Checking all WordPress sites, we conclude that most of the compromised sites were in fact using the most recent version, which indicates that having the latest version of WordPress does not make you immune to this threat. 

So how can you protect yourself? Here are some of the dominant attack vectors that websites using the latest WordPress version are likely to be exploited through:

• Weak passwords / stolen credentials
• Vulnerable third-party modules used in WordPress
• Security holes in the underlying server infrastructure, such as in the database server or the server side scripting engine (PHP in this case)

Websense Security Labs strongly recommends that website owners perform security audits and fix all problems to keep attackers away from their sites. Websense customers are protected from injected websites with our Advanced Classification Engine, or ACE, which detects compromised websites in real time. 

A few weeks ago, we published a blog about typosquatting. This time, we're going to give an actual example of typosquat hosts found in the wild and show how typosquatting scams work. We'll take you through a typosquatting campaign that abuses tenth of known brands and includes thousands of registered typosquat hosts (a typosquat hive). After that, we'll offer a list that includes hundreds of typosquatting hosts from that hive, all of which can be found in the wild. The list is free to download for any of you who are into IT security -- so this Xmas can be a bit safer.

Increases in prescription prices and lower insurance benefits have prompted many to look for bargain drugs on the Internet. There are legitimate pharmacies online, but as the highly qualified nurse below suggests, there are obvious dangers. And many dangers that are not so obvious.

Websites that offer illegal drugs, anabolic steroids and prescription drugs “with no prescription needed!” are clearly dodgy, and are classified by Websense under the category “Abused Drugs”.

Products from these sites may be ineffective at best or dangerous at worst. For example, counterfeit tablets of the weight-loss drug, Alli, seized by the U.S. Food and Drug Administration were found to contain twice the recommended dose of another substance that has been associated with heart problems.

Some sites offer a veritable supermarket of illegal drugs, assuring buyers anonymity through the use of Bitcoin, a supposedly untraceable online currency, and other “guarantees.” These protections may not be as effective as users think they are. 

Besides the danger of ingesting unknown substances and falling foul of the law, buyers of online drugs risk other dangers as well. Nicolas Christin, a computer scientist at Carnegie Mellon University, found that 32% of searches for prescription drugs led to URLs that were infected with malicious code. Legitimate university sites and even trusted .gov sites are often hijacked and redirect to illegal online pharmacies.  Malicious links can be uploaded as comments to message boards and forums of legitimate sites, often by spam bots posting to thousands of sites.

In addition, new synthetic drugs such as "bath salts" and "spice" have been flying under the radar of law enforcement. The effects of these drugs are finally bringing them to headlines—and emergency rooms.  Both drugs exist in a legal limbo which has been exploited by Internet sales.

Synthetic canniboids, known as “spice” or “incense,” are touted as a legal alternative to marijuana, but seem to have much more dangerous side effects, possibly due to adulteration with unknown ingredients. The composition of so-called "bath salts" has not yet been conclusively determined, but these synthetic stimulants have nothing to do with floral scents or relaxing bathtub soaks. Sold as "bath salts," "plant food," etc., to skirt drug laws, they are produced by illegal street chemists - with all of the risks that implies.  Reported effects include paranoia, hallucinations, high blood pressure, and violent behavior towards oneself and others.