E-mail worms rarer in 2007

E-mail worms, not long ago the scourge of the Internet, have declined sharply in 2007, a security company has revealed.

According to UTM security vendor Fortinet, the incidence of mass-mailing worms has declined by 5 percent each month since the start of the year, putting the once-feared worm well below other types of attack in terms of volume.

The figures come from the company's The State of Malware report for June 2007. Viruses, spyware, and software exploits have remained roughly stable in volume throughout the same period, while Trojans have been climbing since February to represent the number one threat.

Much less common mobile, IM, Linux, and non-mailed Win32 worms have all shown marked declines, albeit from relatively low levels.

The company offers a variety of explanations for the marked decline. Users are now more aware of the need to mistrust e-mailed attachments, while corporates are employing better gateway security to strip e-mails of malicious code. Another possibility is that attackers might be moving from mass-mailing techniques to targeted attacks as a better avenue to profit.

This theory is backed up by separate figures from MessageLabs published earlier this week that uncovered evidence of attacks targeting named individuals in companies. Although rare by their nature, such attacks are reckoned to have a much higher chance of success than generic mass-mailing attacks.

The age of the mass-mailing worms is not about to end, however, and could simply have entered a period during which it will decline to low levels before spiking from time to time. The best recent example of this is the Storm worm of January, which presented a high point against which worm volumes were bound to decline as the year wore on.

The unique danger of worms is their ability to spread automatically in ways that can clog bandwidth before systems can react. Because worm detection systems are now so finely tuned, such malware has to do as much of its damage in possible within the first hour of spread, after which it will be filtered aggressively by security gateways. The worm's future could increasingly be as a form of malevolent political or terrorist protest rather than as a tool of criminal profit.