Forest Global Training Partners

Cyber Risks · Krebs on Security

Fake Anti-virus Peddlers Outmaneuvering Legitimate AV

Summary: Google's malware detection infrastructure found roughly 11,000 malicious or hacked web pages pushing fake anti-virus between January 2009 and the end of January 2010, and from June 2009 the number of unique fake anti-virus installers rose from an average of 300 to 1,462 per day, dropping detection rates below 20 percent. Google attributed the evasion to domain rotation, with the median lifetime of redirecting sites falling below 100 hours around April 2009, below 10 hours around September 2009, and below one hour since January 2010; Microsoft separately reported cleaning fake anti-virus malware from 7.8 million computers in the second half of 2009, up 46.5 percent from 5.3 million in the first half.

Why it matters: Google found that signatures out of date by just a couple of days drastically reduce detection, and with malicious domains now living under an hour, a signature-based defense is chasing infrastructure that no longer exists by the time the update ships.

Read the original at Krebs on Security ↗

Topics
Data Breaches
Related