Hello everyone,
  I was the new member of Chinese Internet Security Response Team(C.I.S.R.T.) .My username hzqedison in Chinese Security forums.My research interest focuses on malware originating from China.
  The World Wide Web (WWW) becomes more and more important each day within China. A large number of Chinese Internet users enjoy the convenience and flexibility the Web brought them, from searching for information, online entertainment to e-business, and e-finance. According to the latest Alexa Globaltop 500 websites list (32 Chinese websites are in the list), there are four different types of successful and well-known sites within the Chinese Web: the first type of websites are search engines, including Baidu, Google.cn, Yahoo! China, Tencent’s SoSo, and Sohu’s Sogou. Among them, Baidu and Google are the most popular ones. The second category contains portals and navigation sites. Among the seven sites belonging to this category, Tencent’s QQ, Sina, NetEase 163, Sohu, and TOM are listed in the top ten Chinese websites. The third type of sites is related to e-business: the Taobao C2C (customer-tocustomer) online business platform and the Alibaba B2B (business-to-business) platform – both operated by Alibaba group – are well-known within the Chinese Web. The last type of sites contains sites in the area of online entertainment and virtual personal space, including YouTube-like sites such as 56.com,tudou, ku6, several myspace-like sites such as Tencent's Qzone,kaixin001.com,Discuz!'s UChome,and others.There is also the other side of the coin: targeting the virtual assets owned by the normal Chinese Internet users, malicious attackers discover the Web as a new venue for making money by exploiting innocent users. A common theme is to inject malicious code into a bought or compromised website. The injected code exploits an unpatched client-side vulnerability: each time a user with a vulnerable version of a browser or related application visits this site, his machine is compromised and some kind of malware is automatically installed. This kind of attack is also called drive-by-download attack.The malware is quite often some kind of Trojan Horse that searches for valuable information on the victim’s machine and then sends the information back to the attacker, who in turn can sell this virtual good to other attackers or innocent users.
  I want to tell all of us what phenomenon on the Chinese web in more detail.Why so many inject malcode into websites(drive-by-download attack)?Everyday,I post some inject malcode into Chinese websites in CISRT simplified Chinese blog.My English is very poor,but I will try to write something about malware originating from China in English.thanks！
                                                                                             by hzqedison[AT]cisrt.org

Last modified by hzqedison onFebruary 27, 2009 09:46