Up to 80% of Web sites flagged as malicious by antivirus and search engine indexes are legitimate businesses, according to security experts.

Experts said while the security industry is on top of conventional spam and phishing attacks, more effort needs to be put into preventing and eliminating so-called drive-by-downloads.

The attacks allow hackers to redirect massive amounts of traffic by inserting malicious IFRAMES into legitimate Web sites. The hacks are usually invisible to Web site visitors and do not often draw attention from security personnel because they only require a single line of code to be manipulated.

Sophos CTO Paul Ducklin said affected organizations risk losing business because they are flagged as malicious by search engines such as Google, and antiphishing software.

"You could imagine the business lost if one of only three or four local sign writers were tagged in a search as malicious," Ducklin said.

"It can be very expensive to fix iframe attacks because they can originate externally or internally, and they have a very small footprint."

Compromised Web sites can turn into virtual breeding grounds for further attacks, according to Ducklin, because they are easy targets for hackers wanting to inject additional malicious IFRAMES.

A 2007 Sophos survey found that more than 80% of Web sites listed as malicious were legitimate organizations that had been compromised by various attacks including iframe injections.

Ducklin said Sophos "tries to be fair" and revisits Web sites to see if they are still carrying the exploits, but could not specify exactly how long businesses remain blacklisted by security vendors or search engines.

While a Google spokesperson contacted by Computerworld refused to comment on how often the company re-checks flagged Web sites, Google employee Phil Harton said in a blog that the process can take up to two weeks.

"We've begun sending e-mail notifications to some of the Web masters of sites that we flag for badware. We don't have a perfect process for determining a Web master's e-mail address, so for now we're sending the notifications to likely Web master aliases for the domain in question," Harton said.

"We're planning to allow Web masters to provide a preferred e-mail address for notifications through Web master tools."

For more enterprise computing news, visit Computerworld. Story copyright Computerworld, Inc.

Whitepapers

• Gene Kim's Practical Steps to Mitigate Virtualization Security Risks
• Selecting Effective Virtual Directories
• A Modern Approach to On-Demand Email and Data Security
• Best Practices for HP Servers and HP Enterprise Virtual Array in a Microsoft Exchange
• Compliance, Protection, Recovery: A Layered Approach to Laptop Security
• Endpoint Security: Data Protection for IT, Freedom for Laptop Users

View more SECURITY whitepapers

Webcasts

• Key Considerations for a Successful 802.11n Deployment
• Solutions to the Toughest IT Challenges in Remote Offices
• Lowering the Cost of Email Archives
• High Availability for SQL Server 2005 Using Array-Based Replication and Host-Based Mirroring Technologies
• Technical Overview of Exchange Server 2007 with HP Servers and Storage
• Bringing Order and Security to your Mobile Workforce: Corporate Mobility Policy and Device Management On-Demand

View more SECURITY webcasts

Special Reports

• The Evolution of Network Security
• Taking Virtualization Up a Notch
• Learn how to Keep your Mobile Workforce Connected
• The self-managed network

View more SECURITY special reports