The growth of user-created web content on sites like YouTube is going to become the hot spot for online security in 2007, security company Sophos PLC predicted Monday.

This year "is likely to see a significant shift away from the use of e-mail security threats, with cyber-criminals instead looking to exploit the continued global growth in web use, as well as user-defined web content," the company said.

Hackers are turning to new avenues to launch their attacks because users are increasingly protecting their e-mails. To back its point, the company said it finds an average of 5,000 new URLs hosting malware (malicious software) every day.

"Cyber-criminals are seeking new ways to distribute malware, and the web seems to be the logical environment as mounting applications and social sites keep end users active on the internet," Ron O'Brien, senior security analyst, said in a release. 

E-mail security is getting better, the company said, as the proportion of infected messages fell to 0.3 per cent (one in 337) last year from 2.2 per cent (one in 44) in 2005.

But e-mail will continue to be an important means of infecting users' computers with programs designed to turn them into unwitting disseminators of spam or steal their personal information to commit frauds.

In fact, more than 90 per cent of all spam in 2006 was relayed from zombie computers, those controlled by hackers without the owners' knowledge, the company said.  

Spyware down, Trojans up

But Sophos said there was a drop in the use of traditional spyware — software that steals personal information from people's computers — last year in favour of Trojan downloaders.

Trojan viruses dupe users into giving up crucial information by luring them to click "yes" to an apparently innocent request, such as a licence agreement for a piece of software they have just downloaded.

The company's statistics suggest that between January and  December last year, the proportions of spyware and Trojans had reversed.

At the beginning of the year, e-mails infected with spyware accounted for about half of all infected e-mail, and mail linked to sites with Trojan downloaders was about 40 per cent.

By December 2006, Trojans accounted for 51 per cent of evil e-mail, and spyware about 42 per cent.

China, U.S. malware centres

The company also said that almost a third of all malware is now written in China, most of it Trojans, and a large proportion "designed for the specific purpose of stealing passwords from online gamers."

Malware writers based in Brazil are responsible for 14 per cent of the traffic, most of which is designed to steal information from online bankers.

Sophos concluded that the U.S. and China together accounted for about two-thirds of all malware in 2006, with just over 30 per cent each. No other country was even close.

"The U.S. market is undeniably a target for online criminal activity. More and more, organizations with U.S.-based websites are falling victim to targeted attacks," O'Brien said.

The U.S. and China also led the spam spreaders, with the U.S. at 22 per cent and China at nearly 16 per cent.

Ten other countries came in between 7.4 per cent and nearly two per cent, but a quarter of all spam was spread from countries that didn't make the Top 12 list.