OSAC Item (Printer Friendly Version)

[an error occurred while processing this directive]

CurzTech News Network

OSAC Item (Printer Friendly Version)
from South China Morning Post (Hong Kong) on Tuesday, April 29, 2003

The number of serious cases has fallen steeply but experts urge firms to remain vigilant.

In the war against computer viruses, the tide of battle has apparently turned in favour of Internet security specialists and their customers.

From a high of nine severe computer outbreaks in 2001, led by the Nimda worm, there were only two serious cases reported last year.

Anti-virus software giant Symantec reported in February that the number of cyber attacks decreased 6 per cent in the second half of last year.

It found that companies suffered on average 30 attacks a week in the six-month period, down from an average of 32 attacks a week in the first half.

The figures come from the latest edition of "Internet Security Threat Report", an analysis of more than 30 terabytes of data - covering network-based attack activity, vulnerability discovery, and malicious code - regularly compiled by Symantec.

It found that 85 per cent of the attacks reported in the second half of last year were really "pre-attack reconnaissance", while the remaining 15 per cent were classified as various forms of exploitation attempts.

Those figures might give some comfort to budget-constrained companies looking to delay their security investments, but security industry experts urged that vigilance was essential to stave off threats.

They said network security should remain a serious, round-the-clock concern.

"There is no rest for the wicked," Symantec North Asia director David Sykes said, adding that 2,524 new security vulnerabilities were discovered last year, up 81.5 per cent from 2001.

The Symantec report said power and energy companies had experienced the highest rate of cyber attack activity and severe infection cases.

The financial services sector experienced a rise in overall attack volume and reports of severe network infection.

"As a country's Internet usage grows, the potential for compromise also grows," Mr Sykes said.

He cited the rise in security breaches in South Korea, which has the highest number of household broadband Internet connections worldwide and where Symantec found that incident reports grew 62 per cent in the second half of last year.

So-called "blended threats" were the most often reported cyber attacks, Symantec said.

These malicious programs combine multiple methods of infection, using known computer server software and Internet vulnerabilities to initiate, transmit and spread.

Mass-mailing worms such as Klez and Bugbear, which take advantage of automatic file-sending and receiving features found in computer communications applications such as Microsoft Office, search the Internet for other ways to attack and mutate.

Though e-mail continued to be the most common route for viruses, other techniques were also used last year.

For example, the Benjamin, Roron and Lolol worms spread through the Kazaa file exchange network.

These viruses try to distribute infected files to the global file-sharing network by using attractive file names and by exploiting the difficulty some network users have differentiating between between music, video and program files.

Finnish anti-virus software specialist F-Secure recently said that there were about 80,000 known viruses.

He predicted that this number would increase.

These included malicious codes that targeted operating systems other than Microsoft's Windows platform.

The Slapper worm, for example, was detected on September 14 and quickly infected thousands of server computers running the so-called open-source Apache server operating system.

Mikko Hypponen, anti-virus research manager at F-Secure, said the number of viruses that originated from Asia was also growing.

Most came from China, Taiwan and South Korea.

He said new viruses were being detected more or less at the same rate, but the number of outbreaks was smaller last year than the previous year.

"New, fast network worm technologies may lead into a situation where a worm spreads around the world in just a few minutes after it has been launched," he said.

These attacks could be done by hackers, industrial spies, terrorist groups, organised crime groups or so-called "hactivists", those who defaced Web sites to further a political cause.

"Society must be able to function in spite of this network warfare," Mr Hypponen said.

[an error occurred while processing this directive]