A new study by Google that examined 4.5 million Web sites for malicious software found that about one in ten sites were infected.
The study called “Ghost in the Browser” revealed that out of the 4.5 million Web sites analyzed 450,000 had caused Google’s test computer to make a “drive-by download”.
The study found that the average user does not have a way to protect themselves from the threat.
The report said, “Unfortunately average computer users have no means to protect themselves from this threat. Their browser can be compromised just by visiting a page and become the vehicle for installing multitudes of malware on their systems.”
The report also found that users personal information is at risk of being compromised. “The installed malware often enables an adversary to gain control over the compromised system and can be used to steal sensitive information such as banking passwords, to send out spam or to install more malicious executables over time.”
The spread of malware is different than the traditional way of sending an email attachment as no user interaction is required, only a visit to a Web site that is infected. Many Web site owners were not aware their sites had been compromised.
“We expect that the majority of malware is now spreading via web-based infection, because the computer of an average user provides a rich environment for adversaries to mine,” Niels Provos, lead author of the study, wrote.
The study noted security risks originate from four areas, insecure web servers, user-generated content, advertising and third party software.
As for the malware on the Web, the Google study said much of it is advanced and can bypass some antivirus software.
