Safe Internet Alliance

Back in 2008, Microsoft released a report that found that malware attacks had risen by 300% in the second half of 2007 compared to the first half. These attacks were typically carried out by trojans, which infect a computer and then are able to record keystrokes and send back typed-in passwords to scam artists.

The report ended on a positive note, stating that "the number of computers around the world that were made safe after being infected with trojans rose from one million in the second half of 2006 to 19 million in the second half of 2007."

However, this week another report was released by Dasient that claims that malware is still rapidly on the rise. Dasient used a different methodology; unlike Microsoft, which measured the number of infected computers, Dasient measured the number of infected websites. However, because Google and other major search engines actively warn users when many of these sites contain malware, it's difficult to determine based on this report whether actual malware infections have increased.

Infections on newly compromised sites that have 10 pages or more spread to nearly one quarter of the pages on the site, on average. Nearly 40 percent of the infected sites were later reinfected.

Most of the malware infections are accomplished by JavaScript and iFrames being injected into legitimate sites, accounting for nearly 55 percent and 37 percent respectively, said Dasient co-founder Neil Daswani.

Regardless of whether actual infections are rising, businesses are finding themselves more vulnerable to these attacks. Washington Post's Security Fix reported on an FBI finding that cyber criminals have been able to use malware to steal upwards of $40 million from "small to mid-sized companies" in the US.

The attacks are two-part. First, the criminals use malware to obtain the bank log-ins for these businesses. Once these are secured, they then turn to "money mules" who actually go in to withdraw the money. Often times, these people are unaware that they're withdrawing money illegally; they've fallen for "work from home" online advertisements and think they're working for a legitimate business. Once they've withdrawn the money (in increments less than $10,000), they then wire the money to the criminals, first subtracting a small fee.

Steve Chabinsky, deputy assistant director of the FBI's Cyber Division, said criminals involved in these online account takeovers have attempted to steal at least $85 million from mostly small and medium-sized businesses, and have successfully made off with about $40 million of that money ...

... The FBI said the $40 million loss figure stems from some 205 cases that date back to 2004, though it declined to offer a year-by-year breakdown of those cases. Several bank fraud experts interviewed for this story said they were aware of very few reports of this type of cyber crime before the latter half of 2008.

The Security Fix contains a chart detailing several of the crimes that the journalist was able to track in his own reporting.

Unfortunately, many of these businesses are unaware of these attacks until well after they've been carried out. This is a problem that not only consumers and government officials have to address, but banks as well. By adding several layers of verification to their customer accounts, they can help ensure that criminals can't gain access to their clients' money with a simple password and log-in information.