Compromised Websites are replacing email for mass distribution of malware

Conventional wisdom says email systems are the pipeline of choice for malware distribution. But times have changed, and so too have Internet attack patterns.

In many cases, mass-mailing malware is now inefficient due to the noise it generates as it traverses the Internet. Similar to a sonic boom, the noisy email attacks send echoes across the Web, giving administrators ample time to alert users, lock down networks and mitigate new threats.

Sure, targeted email attacks will continue. But compromised web pages are now rapidly emerging as the replacement vehicle of choice for mass malware distribution. Multiple layers of exploit code targeting Web systems have found a blind spot in safeguards such as traditional Anti-Virus and Intrusion Detection Systems (IDS).