Security Spotlight: July Virus Attacks

Posted by Amanda Kleha, Google Apps Security & Compliance Team

In July, our Postini datacenters saw the biggest volume of email virus attacks so far in 2008, with a peak of nearly 10 million messages on July 24. One of the more prominent attacks in the month involved a spoofed UPS package-tracking link that was intended to lure recipients into clicking on it and downloading malware. Our zero-hour virus protection technology first started catching these emails on July 20.



Many of the viruses we see follow a similar format, in which an email with an embedded website link in the message is changed from what the link displays. Another recent example was a spoofed CNN newsletter sent out by spammers. In this case, the content included current news stories with numerous links in the message. The majority of the links were valid, but there were some that were replaced with malicious links. As soon as our technology started detecting these messages, we implemented a filter to stop these elusive viruses and voila! -- all of our 14 million business users were protected. This network effect and rapid protection against these new tactics is why businesses are increasingly moving their email security into the cloud.

Viruses tend to increase during the summer months, and August is already showing some new types of viruses. On August 5, we saw a large inflow of messages with an encrypted .RAR attachment. The overall 2008 trend has been a decrease in the use of attachments, so this new virus is confirmation that spam doesn't follow trends for long.

These examples are also a good reminder about the importance of educating our colleagues, friends, and family on how to safely interact with email -- namely, that we should all be careful about clicking on links in emails, even if those messages appear to be from people or organizations we know.

Join Google security experts for an upcoming webinar for IT professionals that will explore the topic "How spam is changing your business email, and what to do about it" on Friday, August 15, at 10:00 am PDT.

For more information on how Google can help your business secure its email and web traffic, visit us at www.google.com/a/security.