Microsoft's Internet Explorer Isn't Dead in the Enterprise

Old Botnets Never Die
Regardless of the browser in place, the Zscalar report also showed that an unpleasant constant has been the botnet threat. "Long-standing threats such as Monkif, Zeus, Koobface, and Torpig continued to dominate the botnet landscape throughout the quarter. The Eleonore exploit kit was also the source of 5 percent of all browser exploits that we encountered," according to the Zscalar report.

But malware masquerading as antivirus software led the threat landscape in the first quarter of the year, accounting for 14 percent of the threats blocked by Zscalar. So-called fake antivirus has been aggressively distributed by redirecting users from a large variety of seemingly benign links to "scareware" sites that claim to detected a system infection and then provide a download for an antivirus scanner (which is malware itself). Two fake antivirus sites in particular made up the bulk of the fake antivirus transactions that Zscaler witnessed: winifixer.com and xorg.pl.

"A large portion of fake AV redirections occur from poisoned Google search results for popular search terms. Just as businesses leverage search engine optimization (SEO) techniques to ensure that Web pages float to the top within popular search engines, such as Google, Yahoo, and Bing, so too do attackers. Attackers, however, have one significant advantage: They don't have to follow the rules," says the report.

Here, according to Zscalar, are the three key tactics used to turn SEO from a marketing tool to a malware attack:

• Keyword stuffing: Adding keywords to a page that are generally hidden using formatting techniques that don't change the look of the page but include content that influences the SEO analysis of the page content.

• Link bombing: Injecting or adding links to third-party sites to promote a specific Web page, such as through comments and forum posts. Because attackers generally have access to thousands of malicious or infected domains, they can quickly alter search rankings with this technique.

• Doorway pages: Setting up gateways that return different results depending on where the request is originating from. If a search engine bot is making the request, an SEO-optimized page is returned. When the request comes from a potentially vulnerable Web browser, a malicious page is delivered, whereas a benign page is returned if the browser is deemed to have been patched.

I welcome your comments, tips, and suggestions. Post them here so all our readers can share them, or reach me at bill.snyder@sbcglobal.net.

This article, "Reports of IE's death are extremely premature," was originally published by InfoWorld.com. Read more of Bill Snyder's Tech's Bottom Line blog and follow the latest technology business developments at InfoWorld.com.