SWITCH Security-Blog

SWITCH-CERT IT-Security Blog

Drive-by code and Phishing on Swiss websites in 2014

In 2014, about 1,800 Swiss websites were cleaned from drive-by code, compared with 2,700 in 2013, a decline of 33%. At the same time, the number of phishing cases affecting .ch and .li top-level domains rose from only a handful in 2013 to more than 300.

Drive-by code on Swiss websites in 2014

Last year, 35,796 suspicious drive-by URLs in the .ch and .li top-level domains were reported to SWITCH. Security experts from SWITCH-CERT automatically sent requests to these servers and analysed the responses, looking for malicious code injected into the HTML source code. When an expert identified malicious code, the registrar or domain name holder and the web hoster were notified and asked to remove it within one working day. This was done for 1,839 domain names in 2014. In 1,493 (81%) cases, the code was removed by the web hoster or domain holder within one day. For the other 346 domains, the deadline was not met, and the domain name was temporarily suspended to prevent further damage to website visitors. Some 264 (14%) of the infected websites were cleaned of malicious code, with the remaining 82 domain names having to be reactivated after five days, the maximum suspension time by law. A request for identification was sent to the holders of all 82 domains, resulting in an additional 59 (3.2%) of websites being cleaned. A total of 23 (1.3% of all notified) domain names were deleted after 30 days because the domain holder failed to respond to the identification request.


Compromised .ch and .li websites used for drive-by infections by quarter

Continue reading

CSIRTs – Sharing to Win

Einbrüche in Datenbanken, gestohlene persönliche Daten, manipulierte Transaktionen im E-Banking, Eingriffe von staatlichen Akteuren in die Kommunikation im Internet und Angriffe auf die Verfügbarkeit von Diensten: Fast täglich wird mittlerweile über diese Sicherheitsvorfälle in den Medien berichtet.

Computer Security Incident Response Teams (CSIRTs) sind mit die Ersten, die auf solche Vorfälle reagieren und versuchen, Gegenmassnahmen zu treffen. Im Forum of Incident Response and Security Teams (FIRST) sind weltweit rund 240 dieser Teams aus der Industrie, von Regierungen und Akademischen Institutionen zusammengeschlossen, das SWITCH-CERT ist eines davon.

Continue reading

Cherries from the Belgian Internet Security Conference

Last week I was invited to the first Belgian Internet Security Conference in Brussels to talk about our Malware Domain program. The conference was hosted by Belnet, our Belgian sister NREN. Belnet also runs the government CERT.be which invited to this event. Attendants were people rom organisations operating critical infrastructure. The event was very well attended and the mix of talks covered a broad spectrum. You find the slides on the conference website. Find below my thoughts on the different talks:

Continue reading


IT-Security-Links #5