Half (52 per cent) of new malware strains only stick around for 24 hours or less.
The prevalence of short lived variants reflects a tactic by miscreants aimed at overloading security firms so that more damaging strains of malware remain undetected for longer, according to a study by Panda Security.
javascript:ARMRedirLib.reportA4EBan...direct;vt.1;ai.75316811;ct.1", 1250168537199)
The security firm, based in Bilbao, Spain, detects an average of 37,000 new viruses, worms, Trojans and other security threats per day. Around an average of 19,240 spread and try to infect users for just 24 hours, after which they become inactive as they are replaced by other, new variants.
Virus writers - increasingly motivated by profit - try to ensure their creations go unnoticed by users and stay under the radar of firms. It's now become common practice for VXers to review detection rates and modify viral code after 24 hours. The practice goes towards explaining the growing malware production rate.
The amount of catalogued malware by Panda was 18 million in the 20 years from the firm's foundation until the end of 2008. This figure increased 60 per cent in just seven months to reach 30 million by 31 July 2009.
Luis Corrons, technical director of PandaLabs, explained: "This is a never-ending race which, unfortunately, the hackers are still winning."
"We have to wait until we get hold of the malware they have created to be able to analyse, classify and combat it. In this race, vendors that work with traditional, manual analysis techniques are too slow to vaccinate clients, as the distribution and infection span is very short."
Corrons added that Panda's cloud-based Collective Intelligence approach made its technology more agile, thereby reducing the risk window. Other security vendors, including Trend and McAfee, are also adopting cloud-based architectures to deal with the same problem of growing malware production rates.
http://www.theregister.co.uk/2009/08/13/malware_arms_race/
The prevalence of short lived variants reflects a tactic by miscreants aimed at overloading security firms so that more damaging strains of malware remain undetected for longer, according to a study by Panda Security.
javascript:ARMRedirLib.reportA4EBan...direct;vt.1;ai.75316811;ct.1", 1250168537199)
The security firm, based in Bilbao, Spain, detects an average of 37,000 new viruses, worms, Trojans and other security threats per day. Around an average of 19,240 spread and try to infect users for just 24 hours, after which they become inactive as they are replaced by other, new variants.
Virus writers - increasingly motivated by profit - try to ensure their creations go unnoticed by users and stay under the radar of firms. It's now become common practice for VXers to review detection rates and modify viral code after 24 hours. The practice goes towards explaining the growing malware production rate.
The amount of catalogued malware by Panda was 18 million in the 20 years from the firm's foundation until the end of 2008. This figure increased 60 per cent in just seven months to reach 30 million by 31 July 2009.
Luis Corrons, technical director of PandaLabs, explained: "This is a never-ending race which, unfortunately, the hackers are still winning."
"We have to wait until we get hold of the malware they have created to be able to analyse, classify and combat it. In this race, vendors that work with traditional, manual analysis techniques are too slow to vaccinate clients, as the distribution and infection span is very short."
Corrons added that Panda's cloud-based Collective Intelligence approach made its technology more agile, thereby reducing the risk window. Other security vendors, including Trend and McAfee, are also adopting cloud-based architectures to deal with the same problem of growing malware production rates.
http://www.theregister.co.uk/2009/08/13/malware_arms_race/
