The Hidden Menace of Embedded Links

Abstract

White Paper: Security. As the arms race between malware writers and the IT security community continues to escalate, spammers and blackhats are using ever more sophisticated methods to attempt to bypass detection systems and achieve their objectives. Many companies now filter out email attachment types thought to be harmful, and this has driven malware authors to find ways to bypass this strategy. As a result, a substantial amount of malware is spread simply by sending a link to the malware, together with some social engineering to try and induce the recipient into clicking on the link. Symantec.cloud has observed this trend since 2000 and recent months this trend has increased dramatically. This trend has presented traditional anti-virus and anti-spam engines with a problem. Since the malware itself is not present in the email, conventional scanners are unable to detect even simple and well known threats. The inability to identify potential email threats has also exposed a weakness in corporate email security strategies. Quite simply, by switching the focus of malware detection from email scanning to HTTP, malware authors know they are attacking the weakest link in corporate security. Symantec.cloud takes the view that both SMTP and HTTP scanning at the Internet level is now essential in order to ensure reliable security to internal networks. Indeed the two approaches are rapidly converging to create a comprehensive defense to protect customers’ networks from viruses, malware and other unwanted content.