G Data’s newest Malware Report shows a new and unexpected development in malware: the extreme growth of new malicious programs seems to be slowing down.
Granted, the antivirus industry still needed to develop 1,381,967 new virus signatures to detect and block all new malware in the first quarter of this year, which is an all time high, but the number is not as high as was to be expected: the figure is only marginally bigger (3.9%) than the 1,330,146 new malware types that were found in the quarter before that.
However, according to Lutz Blaeser, MD of Intact Software Distribution, this does not give anyone any reason to be relieved. The new malware that appeared this year has been the smartest code yet, suggesting an evolution not dissimilar to Darwin’s evolution theory.
Over the past ten years, security experts have become used to seeing extreme growth in new malware types. “Clearly more and more time was spent worldwide on writing malicious code to infect computers all over the world. Writing malware seemed to have become an easy trade to make some good money. But, at the same time, potential victims all over the world smartened up and weren’t as easily fooled anymore. This seems to have its effect on the malware writing profession now. Only the smarter malware writers, who manage to change their way of working along with the changing circumstances seem to be surviving economically,” says Blaeser. “Adapting quickly to survive the changing circumstances is pretty much the definition of Darwin’s theory of evolution.”
A good example of smarter malware is a modern banking Trojan. Blaeser explains the evolution: “Most past attack schemes were relatively simple. For example, when a victim logged into online banking, he was prompted to enter a large number of TANs, which were then forwarded to the attacker. Newer methods are more sophisticated. In the so-called Automatic Transfer System (ATS) scheme, the entire theft takes place without customer interaction. Account balances and lists of transactions are also manipulated in such a way that the victim does not notice the theft.”
Another example can be found with malware for Android. “In 2011, most of the malware for mobile devices that was circulated still focused on the quick buck and could mainly be found on websites or on third-party markets. 2012 marked the appearance of completely reprogrammed or even new original apps that provided the full scope of functions advertised but also contained hidden malicious functions. This had the effect that even the official Google Play Store could distribute malware for several days or even weeks before it was discovered.”
The best example of why quality is more important than quantity for malware writers is the Flashback-virus for Apple. In the first half of 2012, there were only a few viruses for Mac OS. In fact, there were fewer new threats for Apple this quarter than there were in the two previous quarters. But one high quality virus, Flashback, did the trick. It infected more Apple machines (well over 600 0000) than have ever been infected before.
“The analysts at G Data Security Labs think the growth number of malicious programs will stabilize completely, but the quality of the malware will rise even further. They suspect we will be looking at 2.5 to 3 million new threats every year from now on, and quality will triumph over quantity in the underground economy,” says Blaeser. “It has to, because people are understanding the online dangers better and are getting more cautious every day. In order to be successful as a malware writer, more time and thought needs to be put into creating even more deceitful and conniving schemes. And we, as part of the AV industry, have our work cut out for us.”