Viruses overwhelmed traditional anti-virus (AV) solutions in 2006, according to the e-mail-borne Malware Review released by Commtouch and Proofpoint.
New server-side polymorphic viruses that emerged during 2006 launched rapid burst attacks comprising vast numbers of variants in order to circumvent common AV defences.
"In 2006, a new distribution method for e-mail-borne malware, using massive numbers of short-lived and low-volume variants - as in the Stration/Warezov and 'Happy New Year!' virus attacks - turned every hour of an outbreak into a zero-hour," says Haggai Carmon, Commtouch VP of products.
"Throughout 2006, we began seeing outbreaks with thousands of distinct variants being sent in successive, overlapping waves of attacks lasting for weeks or even months. The barrage of wave after wave of such attacks made it nearly impossible for traditional AV solutions to create and propagate new signatures or heuristics in time to protect end-users from the risk of infection. We expect these types of attacks to continue and worsen through 2007."
He adds that, in the past, copies of the same malicious code were mass distributed in large quantities, with one or just a handful of overlapping variants, per malware. But, as AV solutions developed faster signature publishing mechanisms, malware writers changed their tactics to better exploit the "zero hour" vulnerability inherent in traditional anti-virus approaches.
In the latest attacks, malware distributors develop huge numbers of distinct malware variants and unleash them simultaneously, or in successive waves, says Carmon. With the arrival of these so-called "server-side polymorphic malwares", by the time a signature is released for one variant, that variant has stopped circulating, and several new ones have been unleashed.
"Without real-time protection, enterprises leave themselves exposed to an unacceptable level of risk, because the cost of remediating malware infections can run as high as $500 per infected desktop," said Rami Habal, director of product marketing for Proofpoint.
"When an organisation is getting hammered with thousands of variants of each new virus, it's crucial to block each new variant immediately to prevent serious losses."
Share
