Attackers target Internet user behavior pattern

Mumbai

January 29th, 2008

The Q4 email threat trends of 2007 by Cyberoam revealed a steep rise in
attacks using social networking techniques targeting user psychology and
behavior patterns. Spammers launched attacks by predicting user behavior
patterns, such as looking for easy cash and discounted gifts during the holiday
season, or preying on consumer trust to generate interest in cheap
pharmaceutical products and stocks.

Existing security solutions were unable to block the new spam formats and
techniques, resulting in an alarming rise in spam levels reaching 96 percent by
the end of 2007. Spammers used the Storm Worm, an aggressive and self-preserving
botnet, to generate, host and distribute large amounts of spam and malware in
2007. Consequently, the Storm Worm's massive outbreak accounted for 7-10 percent
of all global spam traffic at its peak.

Experts agree, however, that the worm has yet to reach its damaging
potential. The Address Validation Spam sending seemingly harmless, incoherent or
empty email messages from an unfamiliar address was used to validate the email
addresses in the botnet owners' list. The 'clean' list was then rented out at a
higher value to spammers and other cyber villains.

Spam attacks in short, intense waves by the Stration malware maximized damage
in the first few hours of the attack before anti-virus signature updates could
be released.

Spammers gained financially by using traditional image spam techniques,
promoting pharmaceutical products and pump-and-dump stocks with images that
included non-clickable URLs and stock ticker symbols. Recipients interested in
the products and stocks opened a web browser and manually typed in the URLs,
driving up the sales of cheap pharmaceutical products and stock prices.

Spam emails using holiday subject lines easily slipped past anti-spam filters
and users' suspicions. These emails took users to malicious websites and
attempted to download Trojan software. Most anti-spam solutions were
ineffective, as blocking emails leveraging holiday-themed keywords often
resulted in false positives.

The Q4 2007 Email Threat Trend Report, prepared in collaboration with
Commtouch, revealed that botnets are becoming more sophisticated and difficult
to control. Traditional IP blocking technologies are unable to maintain pace
with the dynamic IP activation and deactivation of innumerable botnets.

"Spammers will be increasingly using such social networking tactics
around topical events to fool users and anti-spam solutions in 2008," said
Digvijaysinh Chudasama, VP Sales-India, Cyberoam. "Real-time protection
against emerging spam attacks is important to protect the network. Security
solutions must transcend the blanket and IP-based policy approach and enable
organizations to track user activity and set user identity-based rules.
Cyberoam's identity-enabled anti-spam solution using Commtouch's Recurrent
Pattern Detection (RPD) technology is an answer for proactive defense against
such spam outbreaks in 2008."

Cyberoam uses the Commtouch RPD technology to analyze large volumes of
internet traffic in real-time. Cyberoam incorporates this technology within its
UTM appliances, which deploy identity-based functionality across all of its
features.