Full article from the Register: Mass web infections spike to 6 million pages
An estimated 5.8 million pages belonging to 640,000 websites were infected with code designed to launch malware attacks on visitors, according to a report released Tuesday.
...
An estimated 54.8 percent of the attacks observed by Dasient involved malicious javascript that was injected into compromised sites. iFrames that silently redirected users to malicious sites came in second at 37.1. Dasient has cataloged more than 72,000 unique malware infections involving websites.
Also:
Full article from PCWorld: Most Attacks Come from Legit but Hijacked Sites
The number of legitimate Websites being hacked to host malware has hit startling highs in recent days, new figures from MessageLabs have revealed.
Data taken from the days between May 4 and 8 showed that 84.6 percent of Websites blocked by the company for hosting malicious content were 'well-established' domains that have been around for a year or more.
Iframe attacks, being a largescale threat is relatively new. In the past, we used to tell people to surf the internet safely by not to searching or browsing suspicious websites, porn, cracks, free music/lyrics/movies, gambling, etc.. Then came along safe search add-ons such as mywot and siteadvisor which would greatly help people avoid questionable and unsafe sites. However, the threat webscape today has changed as the bad guys are moving into different tactics. With the appearance of iframe attacks, the borderline that distinguishes black and white sites might no longer be useful. The problem is that the sites that we completely trust can be vector of getting our computers infected. Browser security software such web access protection (used by antiviruses and firewalls) and reputation rating in these cases will no longer work here. It will protect user from being infected from black sites, but not from the white sites. Also, there is no way to tell if a legitimate site contains an iframe unless we look at its page source, since iframes may oftenly not change the sites appearance or functionality.
In my opinion the only way to be protected from a trusted site that happens to have a malicious iframe is disabling iframes altogether.
For details on how to disable iframes on Internet Explorer, please see:
http://antivirus.about.com/od/securitytips/ht/ieiframe.htm
Posts
