Most malware now comes from legitimate sites

Internet users need to be wary of what sites they click on and visit in the future. The number of legitimate websites compromised by attackers has surpassed those purposefully created by attackers, according to a new report by security research firm Websense.

The report also reveals an increase in attacks designed for financial gain using Web 2.0-based attacks and blended threats.

The report states that Internet users need to be wary of even their favourite, trusted sites. These sites pose a significant business risk because traditional security measures are not designed to handle the attacks, and the attackers are using sophisticated techniques such as spoofing search engine results to drive traffic to infected sites.

Attackers know that compromising sites with generally good reputations "" sites that have a built-in group of visitors "" can increase the success rate of attacks.

"More and more attackers are compromising legitimate websites to infect visitors with information-stealing code or to add users' machines to botnets. With this in mind, organisations need to ensure their Web, messaging and data security solutions can protect the avenues hackers seek to exploit for financial gain," said Dan Hubbard, vice-president of security research, Websense.

The report clearly indicates that event-based and Web 2.0 attacks were on the rise in the second half of 2007. Blended threats with multiple attack vectors evaded traditional signature-based security technologies, such as anti-virus.

In the second half of 2007, Websense, leveraging its unparalleled visibility of the Web and e-mail, successfully identified and mitigated several new high-profile exploits and widespread Web attacks.