Localised malware takes root

Cyber-criminals are increasingly crafting attacks in multiple languages and are exploiting popular local applications to maximise their profits, according to a new McAfee report.

"This isn't malware for the masses anymore," says Chris van Niekerk, regional director: Africa at McAfee. "Cyber crooks have become extremely deft at learning the nuances of the local regions and creating malware specific to each country. They're not skilled just at computer programming - they're skilled at psychology and linguistics, too."

McAfee Avert Labs examined global malware trends in its third Sage report, titled One Internet, Many Worlds. The report is based on data compiled by McAfee's international security experts and it examines the globalisation of threats, as well as the unique threats in different countries and regions. In the report, McAfee details the following trends and conclusions:

* Sophisticated malware authors have increased country-, language-, company-, and software-specific attacks.
* Cyber attackers are increasingly attuned to cultural differences and tailor social engineering attacks accordingly.
* Cyber-crime rings recruit malware writers in countries with high unemployment and high levels of education such as Russia and China.
* Cyber-criminals take advantage of countries where law enforcement is lax.
* Around the world, malware authors are exploiting the viral nature of Web 2.0 and peer-to-peer networks.
* More exploits than ever before are targeted at locally popular software and applications.

"Malware has become more regional in nature during the past couple of years," says Van Niekerk. "This trend is further evidence that today's cyber attacks are targeted and driven by a financial motive, instead of the glory and notoriety of yesteryear's cyber graffiti and fast-spreading worms. We're in a constant chess game with malware authors, but we're prepared to counter them in any language they're learning to speak."

The United States: the great malware melting pot
Once the launching pad of all malware, today, malware in the US includes elements of malicious software seen around the world. Attackers use increasingly clever social engineering skills to trick victims and are also seeking to exploit the viral nature of Web 2.0. Although the United States has cyber-crime laws in place, the lack of international cyber-crime laws and the differences in extradition treaties make it difficult for enforcement agents to prosecute criminals across borders.

Europe: malware learns the language
With 23 languages in the European Union alone, language barriers used to be a hurdle for miscreants. Consumers in non-English speaking countries used to simply deleted English-language spam and phishing e-mail. Today, malware authors adapt the language to the Internet domain site where the scam message is being sent and malicious Web sites serve up malware in a language determined by the country in which the target is located. Cultural events such as the FIFA Soccer World Cup in the summer of 2006 prompted e-mail scams and phishing sites, which lured soccer lovers. With the increased sophistication of malware, computer users in the EU are under attack.

China: virtual entertainment
With more than 137 million computer users - a quarter of whom play online games - malware authors are cashing in on virtual goods, currency and online games. A majority of the malware found in China is in the form of password-stealing Trojans, designed to steal users' identities in online games and their credentials for virtual currency accounts. China has also become a breeding ground for malware writers, as a large number of skilled coders do not have legitimate work. The conditions have driven these hackers to cyber-crime in search of money.

Japan: losing to Winny -- malware spreads from peer to peer
Winny, a popular peer-to-peer application in Japan, is prone to malware infestations that can cause serious data leaks. When deployed in the corporate setting, malware on Winny can expose data, steal passwords and delete files. Unlike in most countries, malware authors in Japan are not motivated by money - instead authors seek to expose or delete sensitive data on machines. Another common target in Japan is Ichitaro, a popular word processor. There have been several attacks against Ichitaro users that exploited unpatched security vulnerabilities to install spyware on the target machines.

Russia: economics, not mafia, fuel Malware
The technical skills of Russians in a stumbling economy make for an active market of hackers. Some of the most notorious attack toolkits are produced in Russia and sold in underground markets. These grey-market malware tools, combined with lack of legislation against cyber crime, lead experts to believe that the Russian mafia will soon - if they haven't already - latch onto computer crime. Although the Russian economic situation, like that of China's, has driven many hackers to a life of cyber crime, Avert Labs predicts that with a strengthening economy and stronger law enforcement, Russian-made malware will gradually decrease.

Brazil: bilking the bank Miscreants have made an in ternational showcase out of Brazil when it comes to bilking online bank accounts. With the majority of Brazilians banking online, cyber crooks use sophisticated social engineering scams to trick Brazilians into giving up personal information. In 2005 alone, the Brazilian Banks Association estimated losses at R$300 million (about R1 269 588 583) due to virtual fraud. Malware creators rapidly adapt password-stealing Trojans to the changes banks make to their Web sites.

A global view of threats by the numbers:

* 371 002 - total threats identified by McAfee Avert Labs as of 1 February 2008
* 131 800 - threats identified by Avert Labs solely in 2007
* 53 567 - unique pieces of malware in 2006
* 246% - growth of malware from 2006 to 2007
* 527 - new malware identified daily by Avert Labs at the start of 2008
* 750 - expected number of new malware identified daily by Avert Labs at the end of 2008

"It's mind-boggling how sophisticated and savvy some of these attacks are," says Van Niekerk. "Cyber criminals are learning to exploit the cultural uniqueness of computer users around the world. But our global team of experts is prepared to fight against them and protect users."

The Sage report is available for download through the McAfee Threat Centre: http://www.mcafee.com/us/threat_center/default.asp