Network World — Is the Nine Ball attack, which can redirect visitors from compromised Web sites to other malware-infested sites, really a huge threat?

Nine Ball Attack Strikes 40,000 Web Sites

Websense says it has discovered more than 40,000 Web sites compromised in the Nine Ball attack. But ScanSafe’s senior security researcher Mary Landesman says the Nine Ball threat has been blown out of proportion because the vast majority of compromised sites are ones that corporate Web visitors are very unlikely to ever see.

By analyzing traffic from thousands of corporations that use its Web and malware filtering, ScanSafe has counted 62 compromised sites, including diamond-limousin.com, that have been hit by Nine Ball.The odds of a user encountering most of the sites included in the 40,000 number from Websense are extremely low, Landesman says. She argues that the Web-crawling methodology Websense uses doesn’t put the Nine Ball threat in proportion. The end effect is “when security researchers rush out with alarming stories, we run the risk of the industry crying wolf,” Landesman says.

Websense, however, says it stands by its tracking methodology and its report of more than 40,000 compromised Web sites.