20 million more malware apps during 2008

happygeek 0 310 Views

Rather surprisingly, Kaspersky Lab has forecast that the security threat landscape will increase by more than 20 million programs by the end of 2008 when compared to the 2007 year-end figures, a ten-fold increase no less. That is worth repeating: the number of new malicious applications in circulation by the end of 2008 will increase by 20 million according to Kaspersky.

OK, I am used to getting emails and press releases which are, shall we say, a little on the alarmist side in the run up to the annual InfoSecurity Europe show. And, true to form that show is starting in about 10 days time. However. The Kaspersky Lab malware forecast for 2008 is truly what we call in these parts a 'gob-smacker.'

According to Kaspersky Lab analysts, in 2007 the number of new malicious programs recorded on the Internet, including viruses, worms and Trojans, amounted to 2,227,415, which represents a four-fold increase on the results for 2006 (535,131). The overall volume of detected malware reached 354 GB in 2007. The number of new signatures added to the Kaspersky Lab antivirus databases in 2007 amounted to 250,000. According to its forecast, one million new signatures will be added to the databases in 2008.

David Emm, Senior Technology Consultant at Kaspersky Lab comments on the trend, "In addition to the quantity, the quality of malicious programs is also improving. New and more complex samples, such as the notorious Zhelatin (aka the Storm Worm), are emerging that demonstrate a wide range of hostile behaviour and distribution methods."

Dani AI

Generated

As reported in the April 2008 thread, Kaspersky published a forecast that yearwarning the industry about a sudden jump in both the volume and sophistication of malicious programs — a shift that made 2008 a watershed moment for defenders. (kaspersky.com)

What changed technically: attackers moved from one-off viruses to commoditized toolkits and automated variant generation, they shifted distribution toward web-driven vectors and social-engineering lures, and they built more resilient command-and-control (Storm/Zhelatin is a clear example of those trends). Those factors made infections faster, harder to analyze, and more evasive. (securelist.com)

Short, practical checklist for systems and network operators (start here, then harden further):

  • Keep OS and third‑party software patched and enforce timely patch rollout.
  • Enforce least privilege and remove local admin rights for users.
  • Use application whitelisting (AppLocker or equivalent) rather than relying on signatures only.
  • Block/scan attachments and URLs at the mail/web gateway and enable sandbox detonation for suspicious files.
  • Disable autorun/autoplay and restrict execution from removable media.
  • Deploy EDR/behavioral monitoring, central logging and network segmentation to contain infections.
  • Maintain offline backups and a tested incident response playbook.
    These are aligned with long‑standing control frameworks and 2008–2009 threat reports showing the rise of web-based attacks and toolkits. (readkong.com)

Quick detection starter (tune and test in lab): a simple YARA-like heuristic that looks for embedded URLs plus long base64 blobs (common in droppers). Use it as a starting point and expect tuning for false positives.

rule suspicious_downloader_generic {
  meta:
    author = "DaniWeb expert"
    date = "2008-04-11"
  strings:
    $http = "http://" ascii nocase
    $exe = ".exe" ascii
    $b64 = /[A-Za-z0-9+\/]{40,}={0,2}/
  condition:
    $http and $exe and $b64
}

Notes: these recommendations are deliberately evergreen — the specific counts from 2008 are part of the historical record, but the defensive steps above remain the practical starting point for protecting networks against high-volume, fast-evolving malware.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Edit Preview