The Web is a dirty, hostile place not fit for use by most decent people, a place where even many seemingly legitimate sites are infested with malware, password-stealing Trojans and all manner of other nasty applications. And it’s getting worse by the minute, according to a new threat report from Websense.
There was a huge explosion in the number of malicious sites during the first half of 2009, an increase of 233 percent, the company’s State of Internet Security report shows. But what’s more concerning is the finding that 77 percent of those sites found to be hosting malware during the period are legitimate sites. This isn’t necessarily a surprising statistic, given the slew of large-scale SQL injection attacks that have appeared recently, including Gumblar, Nine Ball and others.
Websense said that the percentage of compromised legitimate sites has remained steady since the second half of last year, but the host of legitimate sites serving malware is a troubling trend, nonetheless.
The other side of this coin, obviously, is the number of unpatched vulnerabilities in the Web applications these sites are running that are enabling the attackers to succeed. Determining the number of vulnerable sites is a massive, if not impossible task, and so accurate data on whether sites are fixing the flaws is hard to come by, as well. Anecdotal evidence suggests that the attackers have such a large base of vulnerable sites to choose from that if one site closes a hole, they just move on to the next one.
