Spam drops but exploits kits are on the rise

Despite a drop in global spam levels, capabilities with malware and phishing are continuing to increase into 2011.

The security labs report from M86 Security for the second quarter of 2010 said that there were more complex Trojans and next-generation malware on the way, with Stuxnet a good indication of what to expect.

The report said that while there was a decline in phishing emails, probably as a result of users becoming more aware of fake emails claiming to be from banking institutions, there was a new threat of websites offering a 'multiple choice' from a selection of banks in phishing messages.

Ed Rowley, product manager of M86 Security, told SC Magazine that this 'third party phishing' was more refined, as cyber criminals were putting details on a website to give it some credibility and to have more than just one page was another way of fooling a user. “People are taken to a page and they choose a bank and it is in effect multiple choice phishing. They are a bit wiser and using multiple choice and bypass techniques,” he said.

The report said that British bank customers were affected by this technique. Some had received a falsified email purporting to be from the tax office with the same legitimate looking page, with options for all banks in that specific region.

The report also said that the popularity of exploit kits is on the rise, with the newest trend being that more kits are offering services to their customers and becoming more of a 'one-stop shop'. Two examples it pointed to are the scanning module in the Siberia Exploit kit and Neosploit's new Malware-as-a-Service offering.

“Malware is all built around functionality and making it easy to use, if you go back a few years it is not as easy to use," Rowley said.

"We sell to the service provider to use as an email service and people who made money are shovelling and the cyber criminals are letting them shovel as they get arrested and as they are just selling the service, they can make the money and give others the blame.”

Asked if there is any light at the end of the tunnel when it came to malware, Rowley said that it is a bleak outlook but it is better to be protected.

This article originally appeared at scmagazineuk.com