India's World No.1 in Spam Output

You can thank India for about one out of six spam messages cluttering your inbox.

SophosLabs's most recent "dirty dozen" report, which details the world's top spam-relaying countries, finds that India has topped the charts for the third quarter in a row.

That means that computers in India are passing along a whopping 16.1% of the spam spotted by Sophos experts.

The top 12 spam-relaying countries for July to September 2012:

1. India	16.1%
2. Italy	9.4%
3. USA	6.5%
4. Saudi Arabia	5.1%
5. Brazil	4.0%
6. Turkey	3.8%
7. France	3.7%
8. South Korea	3.6%
9. Vietnam	3.4%
10. China	3.1%
11. Germany	2.7%
12. United Kingdom	2.1%
Other	36.5%

Reportedly, India is home to 5.3% of the world's internet users, making it the third most connected country, after China and the US.

New technique for data theft can run across web

Researchers have detected a "new man-in-the-browser" (MITB) attack method that uses malware capable of stealing users bank or other sensitive information entered on websites.

As opposed to traditional MITB scams – where malware sitting on victims' computers is used to monitor a list of targeted websites and then pounces when users visit those sites – this technique allows criminals to draw victims' data from an unlimited pool of sites.

Trusteer discovered the threat in late August and posted a blog this week that details the scam.

George Tubin, senior security strategist at Trusteer, told SCMagazine.com on Wednesday that malware used in what the company dubbed "universal" MITB attacks pinpoints desired information, like credit card numbers, entered on any website -- and processes it immediately, rather than afterward, as in a traditional MITB scenario.

When using this new attack method, fraudsters don't have to parse through huge amounts of data or text collected over time, which leaves victims less opportunity to change their credit card details, passwords or other captured information.

“It doesn't matter what websites [victims] go to, it only matters if they use their credit card,” Tubin said. “The likelihood of success is significantly higher using this type of technique versus the traditional man-in-the-browser. When they get the card information, it's going to be fresher information.”