Active Internet Content Dangerous

Like a type of invisible software microbe that secretly infiltrates computer systems and then takes up the role as ruthless digital spies acting for outside agents. Also known as "active Internet content," these types of interactive programs are now said to pose a greater threat to enterprises than viruses.

A recent security report on "Active Internet Content" suggests a great many business networks, almost all personal computers and the majority of Internet Service Providers (ISPs) are now infected with active Internet content

What exactly, is "active Internet content"?

Active content is a fairly new term with various definitions. For clarity's sake, the definition used here refers to any information transmitted to your computer over an Internet connection that, by itself, modifies the behavior of your computer. Common examples include Java applets, ActiveX controls, and plug-ins, these are the types of programs that cause Web pages and E-mail with say, animation, to download and run on your computer.

What does harmful Internet contend do?

This type of Internet content is known to include malicious software programs that can secretly capture sensitive e-mail identification, passwords, as well as keystrokes entered by the user. At a system level they can silently enable hidden network services and open secure communication ports. By gaining access from computers on a network they have been known to pass through security firewalls; and even redirect outbound data to unintended sites by pretending to be legitimate Internet addresses. Unfortunately this is but a few of the undesirable attributes of harmful Internet content.

What are the indicators of having harmful Internet content on your system?

Indicators of being infected with active harmful Internet content may include such things unsolicited and unauthorised Instant Messaging (IM) or seeing an incoming e-mail with the user's e-mail address visible. Certainly decreased Internet performance or abnormally high Hard Drive activity should be a source for concern. Be very suspicious if you suffer a Web site defacement or unintended but automated redirection of network IP addresses. Of course identification of Trojan horses or unauthorised outward connections to external routers should be cause for alarm.

How is harmful content different to normal viruses?

Unlike the traditional virus, virus-scanning software does generally not detect harmful Internet content. Anti virus scanning detection methods have tended to use pattern matching techniques based on a signature file that tries to match a virus signature (pattern) with that in a signature file (template) provided by the anti virus software company. Also security technologies find it difficult to keep up with the content's rapid rate of change.

How is Active Internet Content delivered?

Most of this type of content has been delivered by a wide variety of methods. They include e-mail, spam bombs, on Web sites and even in simple text-based e-mail.

Why is Active Internet Content infection used?

Active Internet content is generally used for electronic reconnaissance of some type. They include, but are not limited to, spamming, and electronic probing. Electronic theft of sensitive or valuable information, and electronic identity theft are common cyber crimes causing financial loss of some degree by this content. Of course cyber terrorism is also a very topical potential for active Internet content infection.

How do we combat this problem?

It is suggested that IT managers should alter their plans and shift their focus to protect not only against harmful Internet content but leaks and other types of assaults their systems as well. People responsible for securing computer systems hooked into the Internet should be more closely examining business risk occurring from the misuse and abuse of e-mail and Web servers.

Automation of security processes is a step in the right direction. Active electronic infrastructure management (Active eIRM) security, as it is known promises a more accurate measurement and management of risk when considering Internet enabled IT systems.

The age of harmful active Internet content means that we must dynamically create a moving electronic line of preemptive defense rather than that of a reactive approach.

Arthur Hissey
Computer Research & Technology
www.crt.net.au