Will Malware 2.0 replace Web 2.0 in 2009?

gallery

The next generation web has created a new wave of infection which you can catch simply by visiting a web page, according to an EU report.

EU agency ENISA explained that the risks of Web 2.0 - with its use of photo sharing, wikis, social bookmarking and social networking - was creating a new breed of web-borne infection.

Web 2.0 application vulnerabilities such as cross-site scripting had been an important contributor for the rise of so-called “Malware 2.0”.

Infection with malware was also being increasingly via drive-by vectors, where machines could be infected by visiting a web page, without the user doing anything else.

One of the big problems was that web applications had to become increasingly sophisticated to keep up with demand for services, but this was creating big security holes.

“Web 2.0 applications are pushing existing web technologies to their limits - as a result, even the best developers have had to resort to ‘hacks’ and loopholes in the system to make their applications work,” said ENISA expert Giles Hogben.

“It’s no surprise that criminals are attacking these applications, and are using them as vehicles to distribute malicious code to users.”

It was added that there was now flourishing black market in malware installations, where it was becoming organised and lucrative enough to offer package deals with standard prices per ‘installation’.

It was a form of ‘malware as a service’, which IT PRO has seen on the rise in 2008, together with how easy it's become to be an online criminal.

Another major problem was that it was becoming more difficult for users to recognise whether information could be trusted without knowing where it originally came from.

A related survey using a YouGov panel revealed that most people would trust a source as long as it appeared more than once on the web, but the tendency of blogs and wikis to replicate rumours makes this a bad strategy.

The full report is available here, with survey results here.

Click here for more on ENISA's work protecting Europe from cyber attack.

Email to a friend

Print this page