Increasingly the actual code, often JavaScript, used to attack PCs is hidden in Flash animations or scrambled so that anyone who examines the source of a page can’t easily identify it, said Jose Nazario, a senior software engineer at Arbor Networks, in a presentation at the CanSecWest security confab here.

“Their obfuscation tools are primitive but effective,” Nazario said. “They use obfuscation to avoid simple signatures,” he said, referring to security techniques based on signatures to detect malicious Web sites. Signatures are fingerprints of known attacks.

Web attacks have become commonplace. Tens of thousands of Web sites attempt to install malicious code, according to StopBadware.org. The sites, the bulk of which are compromised sites, often drop a Trojan horse or other pest onto a PC through a security hole in the Web browser.

View: Full Story @ News.com