ENISA issues warning about Web 2.0 and malware 2.0

A new report by the European Network and Information Security Agency (ENISA), explains the risks of Web 2.0 – photo sharing, wikis, social bookmarking and social networking – and “malware 2.0”, a new breed of web-borne infections you can catch just by visiting a web page and gives advice to tackle them.
“Web 2.0 applications are pushing existing web technologies to their limits – as a result, even the best developers have had to resort to ‘hacks’ and loopholes in the system to make their applications work.” said Giles Hogben, an ENISA expert. “It’s no surprise that criminals are attacking these applications, and are using them as vehicles to distribute malicious code to users.”
The black-market in malware installations is now so well-organised and lucrative that criminals are offering package deals with standard prices per “installation”, Hogben added.
The success of Web 2.0 is fundamentally about enabling users to contribute content and communicate. But, at the same time, that success creates new challenges. For example it is more difficult to know whether to trust information when you don’t know who the original author was or where it came from.
The ENISA survey analysed what tactics people use to decide if a web page is fake, concluding that most people will trust a source as long as it appears more than once on the web. The tendency of blogs and wikis to replicate rumours means this is no longer a rational strategy.
For example, some stories originating in the blogosphere about US vice-presidential candidate Sarah Palin have since been proven false. Another example is web based pump and dump stock rumours where share prices are artificially inflated.
“We need better ways to establish trust in information in the Web 2.0 world”, says Mr. Andrea Pirotti, Executive Director of ENISA.
ENISA compiled the report using input from a group of international web security experts. It recommends a set of initiatives in web standards and architecture, as well as policy actions. These include incentives for more secure programming and measures to protect personal data exchanged among private individuals.
The full report is available at http://www.enisa.europa.eu .