Google Research Finds 10 Percent of Web Pages Hold Malware

According to research from Google, 10 percent of web pages contain malicious code. Google closely analyzed 4.5 million web pages over the course of a year and found that approximately ten percent, or 450,000, had the capability of installing malware without users' knowledge. An additional 700,000 pages are believed to be infected with code that could harm users' computers. The company says it has "started an effort to identify all web pages in the Internet that could be malicious."
Most entice users to visit the dangerous pages through tempting offers, and exploit holes in Microsoft Internet Explorer (IE) to install themselves on users' computers. Google also examined the vectors used by attackers to infect these web pages; most malicious code was located in elements beyond the control of website owners, such as banner advertisements and widgets.

References:
Google Searches Web's Dark Side
The Ghost in the Browser: Analysis of Web-based Malware
[SANS.org Editor's Note (Skoudis): This is a very good piece of research, and contributes significantly to our understanding the malware threat better. I recommend that you read it. Also, it shows that today's Internet is a cesspool of malware. Using mainstream browsers with patches that often follow weeks after exploits are in the wild is an increasingly dangerous proposition.]
Source: SANS NewsBites Vol. 9 Num. 39


CORRECTION: 05.21.07
From SANS.org -- Regarding the story we ran in the last edition of NewsBites about Google's Web-Based Malware study: The researchers identified 450,000 URLs launching drive-by downloads from a set of 4.5 million, which in turn had been culled from a larger set of 7 billion URLs, giving a much lower rate of malware incidence than we indicated. We regret any confusion this may have caused.

Phishers Switch Brand Bait to Coke and McDonald's

Article by Marketing VOX

According to antiphishing.org, phishing hoaxes are spreading to nonfinancial consumer brands as phishers use well-known and trusted logos - such as those of Coke and McDonalds - as bait, and also using promotions, giveaways and sweepstakes as lures.
Coming at a time when marketers are relying more on interactive marketing to build one-on-one relationships with consumers, that shift not only threatens to erode trust, but also raises serious questions for marketers about liability and what action they should take - or not take - to thwart internet criminals who hijack their brands, writes AdAge.
"That red Coke logo is a shiny lure to get you to go through the load-in on your inbox, open up and then click through," said John Roberts, VP-product, OpenDNS, a year-old domain-name-system service platform. "Anything which can take decades of brand promise and put it to use for criminal activity is going to be tried." Beyond possible legal repercussions, phishing scams can dent consumer trust in a marketer and damage brand reputation. "If [consumers] start getting emails and you don't do anything about it, they think your website has been hacked and that their personal information has been compromised," said Jevans, adding that consumers don't realize that phishers send information from websites around the world. "If it doesn't stop happening…your online marketing effectiveness plummets."

EDITORIAL: Be VERY weary about opening ANY email promising a deep discount or something FREE. Most of those offers are really hackers trying to steal your personal information and/or infect your computer with malware.