Cybercrime 2.0: When the Cloud Turns Dark

ABSTRACT

Web-based malware attacks are more insidious than ever. What can be done to stem the tide?

REFERENCES

• 1: Barth, A., Jackson, C., Reis, C. 2008. The security architecture of the Chromium browser; http:// crypto.stanford.edu/websec/chromium/ chromium-security-architecture.pdf.
• 2: Brumley, D., Hartwig, C., Kang, M., Liang, Z., Newsome, J., Song, D., Yin, H. 2007. BitScope: Automatically dissecting malicious binaries. Technical Report CMU-CS-07-133. School of Computer Science, Carnegie Mellon University (March).
• 3: Federal Trade Commission. 2008. Court halts bogus computer scans (December); www.ftc.gov/ opa/2008/12/winsoftware.shtm.
• 4: Chris Grier , Shuo Tang , Samuel T. King, Secure Web Browsing with the OP Web Browser, Proceedings of the 2008 IEEE Symposium on Security and Privacy, p.402-416, May 18-21, 2008 [doi>10.1109/SP.2008.19]
• 5: Krebs, B. 2007. Internet Explorer unsafe for 284 days in 2006. Washington Post Online blog (January).
• 6: Krebs, B. 2009. Blogfight: IE vs. Firefox security. Washington Post Online blog (January).
• 7: Microsoft Security Advisory (935423). 2007. Vulnerability in Windows animated cursor handling; http://www.microsoft.com/TechNet/security/ advisory/935423.mspx.
• 8: Microsoft Security Bulletin MS06-014. 2006. Vulnerability in the Microsoft Data Access Components (MDAC) function could allow code execution; http:// www.microsoft.com/technet/security/Bulletin/ ms06-014.mspx.
• 9: Andreas Moser , Christopher Kruegel , Engin Kirda, Exploring Multiple Execution Paths for Malware Analysis, Proceedings of the 2007 IEEE Symposium on Security and Privacy, p.231-245, May 20-23, 2007 [doi>10.1109/SP.2007.17]
• 10: Michalis Polychronakis , Panayiotis Mavrommatis , Niels Provos, Ghost turns zombie: exploring the life cycle of web-based malware, Proceedings of the 1st Usenix Workshop on Large-Scale Exploits and Emergent Threats, p.1-8, April 15-15, 2008, San Francisco, California
• 11: Provos, N. 2008. Using htaccess to distribute malware (December); www.provos.org/index.php?/archives/ 55-Using-htaccess-To-Distribute-Malware.html.
• 12: Niels Provos , Panayiotis Mavrommatis , Moheeb Abu Rajab , Fabian Monrose, All your iFRAMEs point to Us, Proceedings of the 17th conference on Security symposium, p.1-15, July 28-August 01, 2008, San Jose, CA
• 13: Raz, R. 2008. Asprox silent defacement. Chapters in Web Security (December); http:// chaptersinWebsecurity.blogspot.com/ 2008/07/asprox-silent-defacement.html.
• 14: Sam Small , Joshua Mason , Fabian Monrose , Niels Provos , Adam Stubblefield, To catch a predator: a natural language approach for eliciting malicious payloads, Proceedings of the 17th conference on Security symposium, p.171-183, July 28-August 01, 2008, San Jose, CA
• 15: Stewart, J. 2008. Danmec/Asprox SQL injection attack tool analysis. Secure Works Online (May); www. secureworks.com/research/threats/danmecasprox.

INDEX TERMS

Primary Classification:
  K. Computing Milieux
  K.4 COMPUTERS AND SOCIETY
      K.4.1 Public Policy Issues
          Subjects: Abuse and crime involving computers

Additional Classification:
  H. Information Systems
  H.3 INFORMATION STORAGE AND RETRIEVAL
      H.3.4 Systems and Software

          Nouns: World Wide Web (WWW)

General Terms:
Design, Documentation, Security