Submission + - Google's Research on Malware Distribution (blogspot.com)
GSGKT writes: Google's Anti-Malware Team has made available some of their research data on malware distribution mechanism while the research paper is under peer review.
The lead author, Niels Provos, wrote,
"It has been over a year and a half since we started to identify web pages that infect vulnerable hosts via drive-by downloads, i.e. web pages that attempt to exploit their visitors by installing and running malware automatically. During that time (Jan 07 to Oct. 07) we have investigated billions of URLs and found more than three million unique URLs on over 180,000 web sites automatically installing malware. During the course of our research, we have investigated not only the prevalence of drive-by downloads but also how users are being exposed to malware and how it is being distributed." The technical report [PDF] is available.
Salient points in this report are:
(1) 4% of chance a URL might direct you to one of the 180 thousand malicious sites, with an average about 1.3% actually getting hit with a malicious result.
(2) The distribution sites are concentrated to a few nations: China (67.0%), US (15.0%), Russia (4.0%) and Malaysia and (South) Korea (~2%).
(3) The likelihood of a web page harboring malwares has no strong correlation to its contents. Visiting adult web pages is no more dangerous than visiting website about games, finance, online communities, etc.
(4) Malware delivery is like by mis-directing ads on web pages during ads synchronization to malware distribution sites.
