Security threats to watch out for in 2013
According to computer security firm Kaspersky Lab, 2013 is going to play host to a whole range of cyber threats.
The most notable predictions for the next year include the continued rise of targeted attacks; cyber-espionage and nation-state cyber-attacks; the evolving role of hacktivism; the development of controversial “legal” surveillance tools; and the increase in cybercriminal attacks targeting cloud-based services.
The group has provided a forecast of the threats and trends that industry is likely to experience in 2013:
1. Targeted attacks and cyber-espionage
While the threat landscape is still dominated by random, speculative attacks designed to steal personal information from anyone unlucky enough to fall victim to them, targeted attacks have become an established feature in the last two years.
The huge volume of information shared online and the growing use of social media in business has helped to fuel such attacks – and staff with public-facing roles (for example, those with sales or marketing roles within a company) can be particularly vulnerable.
We can expect the growth of cyber-espionage to continue into 2013 and beyond. All organisations hold data that is of value to cybercriminals; and they may also be used as ‘stepping-stones’ to reach other companies.
2. The onward march of ‘hacktivism’
Stealing money – either by directly accessing bank accounts or by stealing confidential data – is not the only motive behind attacks. Sometimes the purpose of an attack is to make a political or social point.
Society’s increasing reliance on the Internet makes organisations of all kinds potentially vulnerable to attacks of this sort, so ‘hacktivism’ looks set to continue into 2013 and beyond.
3. Nation-state-sponsored cyber-attacks
We are now entering an era of cold ‘cyber-war’, where nations have the ability to fight each other unconstrained by the limitations of conventional real-world warfare.
Looking ahead we can expect more countries to develop cyber weapons – designed to steal information or sabotage systems – not least because the entry-level for developing such weapons is much lower than is the case with real-world weapons.
It’s also possible that we may see ‘copy-cat’ attacks by non-nation-states, with an increased risk of ‘collateral damage’ beyond the intended victim of the attack.
The targets for such cyber-attacks could include energy supply and transportation control facilities, financial and telecommunications systems and other ‘critical infrastructure’ facilities.
4. The use of legal surveillance tools
In recent years, cybercrime has become more and more sophisticated. This has not only created new challenges for anti-malware researchers, but also for law enforcement agencies around the world.
Their efforts to keep pace with the advanced technologies being used by cybercriminals are driving them in directions that have obvious implications for law enforcement itself.
Clearly, the use of legal surveillance tools has wider implications for privacy and civil liberties. And as law enforcement agencies, and governments, try to get one step ahead of the criminals, it’s likely that the use of such tools – and the debate surrounding their use – will continue.
5. Cloudy with a chance of malware
It’s clear that the use of cloud services will grow in the coming years. There are two key factors driving the development of these services. The first is cost. The second is flexibility.
Data can be accessed any time, any place, anywhere – and from any device, including laptops, tablets and smartphones. But as the use of the cloud grows, so too will the number of security threats that target it. First, the data centers of cloud providers form an attractive target for cybercriminals.
cybercriminals are likely to make more use of cloud services to host and spread their malware – typically through stolen accounts.
It should also be remembered that data stored in the cloud is accessed from a device in the ‘non-cloud’ world. So if a cybercriminal is able to compromise the device, they can gain access to the data – wherever it’s stored.
When devices are used for both personal and business tasks, the risk increases still further.
6. Dude, where’s my privacy?!
The erosion, or loss, of privacy has become a hotly-debated issue in IT security. The Internet pervades our lives and many people routinely bank, shop and socialize online.
Every time we sign up for an online account, we are required to disclose information about ourselves and companies around the world actively gather information about their customers.
The value of personal data – to cybercriminals and legitimate businesses – will only grow in the future, and with it the potential threat to our privacy increases.
7. Who do you trust?
We’re all predisposed to trust websites with a security certificate issued by a bona fide Certificate Authority (CA), or an application with a valid digital certificate.
Unfortunately, not only have cybercriminals been able to issue fake certificates for their malware – using so-called self-signed certificates – they have also been able to successfully breach the systems of various CAs and use stolen certificates to sign their code.
The use of fake, and stolen, certificates is set to continue in the future. A trusted insider – whether in the real world or the digital world – is always well placed to undermine security.
8. Cyber extortion
This year we have seen growing numbers of ransomware Trojans designed to extort money from their victims, either by encrypting data on the disk or by blocking access to the system. Until fairly recently this type of cybercrime was confined largely to Russia and other former Soviet countries.
Such attacks are easy to develop and, as with phishing attacks, there seem to be no shortage of potential victims. As a result, we’re likely to see their continued growth in the future.
9. Mac OS malware
Despite well-entrenched perceptions, Macs are not immune to malware. Of course, when compared with the torrent of malware targeting Windows, the volume of Mac-based malware is small.
However, it has been growing steadily over the last two years; and it would be naïve of anyone using a Mac to imagine that they could not become the victim of cybercrime.
The threat to Macs is real and is likely keep growing.
10. Mobile malware
Mobile malware has exploded in the last 18 months. The lion’s share of it targets Android-based devices – more than 90% is aimed at this operating system.
Android OS ‘ticks all the boxes’ for cybercriminals: it’s widely used, it’s easy to develop for, and those using the system are able to download programs (including malicious programs) from wherever they choose.
For this reason, there is unlikely to be any slow-down in the development of malicious apps for Android. To date, most malware has been designed to get access to the device. In the future, we are likely to see the use of vulnerabilities that target the operating system and, based on this, the development of ‘drive-by downloads’.
There is also a high probability that the first mass worm for Android will appear, capable of spreading itself via text messages and sending out links to itself at some online app store. We’re also likely to see more mobile botnets, of the sort created using the RootSmart backdoor in Q1 2012.
11. Vulnerabilities and exploits
One of the key methods used by cybercriminals to install malware on victims’ computers is to exploit un-patched vulnerabilities in applications. This relies on the existence of vulnerabilities and the failure of individuals or businesses to patch their applications.
Java vulnerabilities currently account for more than 50% of attacks, while Adobe Reader accounts for a further 25%. Java is not only installed on many computers (1.1 billion, according to Oracle), but updates are installed on demand, not automatically.
For this reason, cybercriminals will continue to exploit Java in the year ahead. It’s likely that Adobe Reader will also continue to be used by cybercriminals, but probably less so because the latest versions provide an automatic update mechanism.
Related articles
Top IT predictions for 2013 and beyond
Kaspersky Lab’s sales growth slowed in 2011
Viruses pegged as US creations
Loading ...
