Google Reports How Web Attackers Evade Malware Detection

Data gathered from Googles Safe Browsing API service reveals drive-by infections most common, with IP cloaking on the rise.

Attackers increasingly are engaging in IP cloaking to infect Web visitors, where they bypass malware detection systems by serving them clean pages while they drop malware on visitors to the site, according to a new report by Googles security team.
Over the years, we have seen more malicious sites engaging in IP cloaking. To bypass the cloaking defense, we run our scanners in different ways to mimic regular user traffic, said Lucas Ballard and Niels Provos of the Google Security Team, in a blog post yesterday.
Googles research is based on more than four years of data gathered from its Safe Browsing API service. Googles Safe Browsing API is an online database that contains known malware-rigged Web pages and phishing sites. Chrome, as well as Mozillas Firefox and Apples Safari browsers, use the database, as well.
The search engine giants analysis of the malware-evasion methods used by the bad guys is based on 160 million Web pages hosted on some 8 million sites.
As of summer 2010, 160,000 or so websites were employing cloaking domains, according to Googles report, which covers five years of data. This technique peaked two years ago, when there were some 200,000 websites with IP cloaking, up from more than 50,000 earlier that year. That peak coincides with a large-scale attack, where thousands of sites were infected to redirect to gumblar.cn, which actively cloaked our scanners, Google says in its report. Although the increase in the graph is partly due to improved detection of cloaking domains in our system, we believe that it is representative of the general state of cloaking.
Attackers are also using social engineering and drive-by downloads, according to Google. Socially engineered Web attacks try to lure a user into following a link or downloading software.
Read the rest of this article on
Dark Reading
.
At a full-day virtual event, InformationWeek and Dark Reading editors will talk with security experts about the causes and mistakes that lead to security breaches, both from the technology perspective and from the people perspective. It happens Aug. 25.
Register now
.

Last News
▸ Car Sector Speeds Up In Security. ◂ Discovered: 23/12/2024 Category: security	▸ Making use of a homemade Android army ◂ Discovered: 23/12/2024 Category: security	▸ CryptoWall is more widespread but less lucrative than CryptoLocker. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Google Reports How Web Attackers Evade Malware Detection