Finjan, a provider of web security solutions for businesses and organizations, recently announced its findings on the latest web security trends as uncovered by its Malicious Code Research Center (MCRC).

In its Web Security Trends Report Finjan focuses on dynamic code obfuscation as a method to hide malicious code, a trend discovered by Finjan researchers that is growing in popularity among hackers as a means of bypassing traditional signature-based solutions in order to propagate malware.

Dynamic code obfuscation undermines the ability of security vendors to detect and counter encrypted malicious code. These strategies entail providing each visitor to a malicious site with a different instance of obfuscated malicious code, based on random functions, parameter name changes, etc.

To counter this threat, a conventional signature-based security solution theoretically would need millions of signatures to detect the existence of this particular piece of malicious code and to block it.

"Dynamic code obfuscation techniques are the latest salvo from hackers in the ongoing battle of wits between security vendors and their hacker opponents," said Yuval Ben-Itzhak, Finjan's CTO. "Over the years, each time a new type of attack appears in the wild, security companies scramble to create a solution. Then, as soon as the hackers become familiar with the newest defense, they devise a new method to circumvent it."

Currently, hackers have begun to take advantage of new web technologies to create complex and blended attacks. With their creation of dynamic obfuscation utilities, which enable virtually anyone to obfuscate code in an automated manner, they have dramatically escalated the threat to web security.

The report also describes recent specific incidents of sophisticated hacker attacks that take advantage of Web 2.0 technologies to embed malicious code in high-traffic web sites. An example of this kind of proliferation is when hackers used the popular Wikipedia encyclopedia and MySpace social networking site to infect innocent users.

2006 saw the arrival of a diverse range of web-based infection techniques – including rogue anti-spyware, ransomware, and rootkits -- that elude traditional security solutions geared to protect against e-mail viruses and spam. Looking forward to 2007, the Web Security Trends Report predicts that as Windows Vista and Internet Explorer 7.0 begin to achieve critical mass, this development will likely trigger a new wave of exploits from professional hackers who have had time to prepare in advance for this scenario.