Stopping Evolving Threats
Just like everyone else, hackers take advantage of the Internet to collaborate. Authors now commonly post their original malicious software code to a public Internet site, where other writers customize the code to include additional functions, such as more advanced seeding and propagation methods. Each author posts improvements in turn, so that the software becomes steadily more and more dangerous. As a result, even inexperienced hackers can launch highly sophisticated attacks with little preparation.
As Joe Hartmann, Director of the Anti-Virus Research Group at Trend Micro, explains, "In the Spring we saw six different [threats] from four different malware families, which all utilized the same exploit code. They all had the same core functionality but added new code functionality, such as a mass mailer. This helped lead to broader global proliferation for some of the variants."
Because both Microsoft and security companies like Trend Micro do quickly adapt their software to block these many variants, hackers have to act quickly. They may have only a 30 to 90-day window of opportunity after the announcement of a vulnerability before the majority of the world's computers acquire the necessary defenses and become invulnerable to the threat. For that reason, the greatest risk to your computer comes immediately after the public announcement of a vulnerability. Hackers will try to take advantage of the opening quickly, to maximize the effectiveness of the attack.
Some hackers even compete against one another to infect as many computers as possible, with the intent to harnessing their victims into secret networks used in denial of service Internet attacks. Many companies will pay protection money to prevent these "bot nets" (robot networks) from flooding their Web sites with junk data.
According to Bruce Hughes, senior research engineer with Trend Micro, most hackers continuously exploit the same vulnerabilities. Only by using modular code did WORM_SASSER and WORM_BLASTER succeed so quickly, he points out. Like the more recent ZOTOB infections, these variations all took advantage of specific vulnerabilities announced to the public, but all evolved quickly to dodge initial efforts to stop them.
To safeguard your computer, security experts at Trend Micro offer the following advice:
- Always install the latest security patches and updates from Microsoft as soon as they become available.
- Download the latest updates for your security software. To make this task easier, most security software includes an automatic update feature.
- Strengthen the security settings of your Web browser. The stronger the settings, the less a potential attacker can accomplish, and maybe nothing at all.
- Limit your user rights when online. When exploiting operating system vulnerabilities, an attacker typically enjoys no more privileges than the person who legitimately logged onto the computer. If you log onto your computer with Administrator privileges, an attacker could gain complete control of your computer.
- Set up your email program with the following restrictions: disable automatic downloads when previewing a message, and block pictures and other Internet content (including HTML files) from automatically displaying.
- Never click links in email messages, even if the message seemingly comes from a trusted source.
- Abstain from launching unexpected message attachments, regardless of who sent them. When in doubt, delete!
- Try Trend Micro's free HouseCall service, available at www.trendsecure.com.
