How bad is the problem of malware on the web? It's worse than you think. Here's what the new breed of malware looks like.

Malware is an ever-growing problem when it comes to the internet. In 2009, more than 25 million different unique malware programs were identified, more than all the malware programs ever created in all previous years (see the annual report from Panda Labs).

That's a pretty incredible statistic. Malicious programs now outnumber legitimate ones by many orders of magnitude.

The world's largest cloud computing user? Not Microsoft, not Google, not Amazon. The ringleaders of the Conficker botnet, with more than 4.6 million infected computers under their control, win by a mile. Some security software vendors report that 48 percent of the computers they scan are infected with some sort of malware. Trojan horse programs make up 66 percent of all threats.

No-one need wonder what malware is trying to do. It's trying to steal money, whether it's through data theft, bank transfers, stolen passwords, or swiped identities. Each day, tens of millions of pounds are stolen from innocent internet victims. And yet many computer defenders can't tell you what the biggest threat is to their environment. If you don't know the biggest threats, how can you defend against them properly?

Today's malware differs dramatically from the threats we faced just 10 years ago, when most malicious programs were written by young men looking to earn cyber bragging rights. Most malware made the user aware of its existence through a displayed message, music (as in the Yankee Doodle Dandy virus family), or some other sort of harmless mischief. Those were the days.

Thoroughly modern malware

Today's malware is written by professional criminals. In most cases, users are unwittingly tricked into executing a malicious program in the form of a Trojan horse. Users think they are installing needed software, often 'recommended' by a site they trust. In fact those sites are recommending nothing of the kind. Malware producers routinely break into legitimate websites using found vulnerabilities and modify existing web pages to include malicious JavaScript redirects. Or the malicious code is hidden inside a banner ad on a website, supplied by legitimate ad services.

Either way, when the user surfs to the legitimate website, the malicious JavaScript is loaded, and it either prompts the user to install a program or redirects the unknowing user to another website where they are told to install a program.

NEXT PAGE: Trojans lead the pack

  1. The problem of malware is a lot worse than you think
  2. Trojans lead the pack
  3. DIY kits: Tools of the trade