The Internet is a place without geographic borders. During the summer’s sport season and big international events like Wimbledon, Euro 2012 (football), and recent Olympics, Sourcefire got a chance to look at where all the cyber threats were coming from around the globe and will share the top Phishing, Botnet and Malware sites in the world.
The Phishing Game
Today, the United States currently sits at the top of the table by hosting nearly fifty percent of all phishing sites globally. Phishing poses a risk to all Internet users as the goal is to lure identity and private information away from unsuspecting users. Phishing generally takes place as a multi-stage attack, with the first step involving a lure to visit the fake phishing site.
That lure is commonly delivered via either an email, or perhaps search engine poisoning (SEP) in relation to a predictable event. The SEP attack avenue is particularly interesting during a global event such as the 2012 Olympic game.
The phishing content may be hosted in one country, the actual attacker could be anywhere in the world. From Table 1, the USA tops the most likely phishing site in the world.
However, it is hard to attribute this geographic trend down to a single reason as it is likely a blend of many, but one important thing that we have to keep in mind is the potential value associated with geographic placement of an asset, as if a person would like to plan a phishing “attack” against people who live in an affluent country, we would see there is an advantage of hosting the actual phishing site in the same place as what it is pretending to be.
Race on Botnets
A botnet is a collection of internet-connected computers whose security defenses have been breached and control ceded to an unknown party. Each such compromised device, known as a “bot”, is created when a computer is penetrated by software from a malware distribution.
Unlike the phishing results, the geographic distribution of the quantity of compromised devices belonging to botnets has shown that India takes top place with USA and Russia coming in second and third. There are two sides to most Botnets, one element is the system’s networks that are reporting in to and are under the control of the person (or persons) managing the botnet, known as the botmaster. The other element is the command and control servers that are used to issue commands to the bots. Botnets grow in value and usefulness as their scope and size increase, and in many cases the geographic location of the bots themselves can positively impact their value.
However, when we look at the other side of the botnet, the command and control (C&C) servers, the geographic distribution of the systems is vastly different. India, where above as see a large quantity of bots, doesn’t even make the top ten! If the goal of the botnet is to launch wide-scale attacks like DDOS, it’s largely irrelevant where any single bot is actually located, but the overall geographic diversity of the attack can make it harder to track down and stop at the source. Malware Hosting Where Malware is concerned, the United States is out in front, with Romania coming in second. Malware comes in many forms, and is delivered in a wide variety of methods from good old direct email, search engine poisoning (SEP), and also the ever popular drive-by-download. The malware delivery to the victim in a drive-by, or via SEP needs to be hosted somewhere on the internet, and this normally works out to be on a web server.
Based on Table 4, the distribution of malware hosting locations is much diverse than what we’ve seen with phishing hosts, bots, and C&C servers, with only approximately 5% separating the top two countries – The USA and Romania. Conclusion Geolocation data is great for tracking threats from targeted sides. However, the impact of the geo-diversity of threats can only be seen at an extremely high level. For sure, it does somehow highlight some serious points and possible misconceptions associated with geography. Blocking “all connections” from one specific country to improve the risk posture has no doubt in some cases decreased the risk of attack. But in most cases, it makes proportional sense of the size of the address range we are blocking. Attackers can bypass geo-location trivially, and proxies, bouncers and Tor have been the tools of choice for many years to perform this task. Hence, we can’t rely on geo-location alone as a method of decreasing attack risk as the attacker will simply appear to come from somewhere trusted.
