Security Advice for 2010: Trust No One
January 4, 2010 Alex Woodie
|
Not everything is at it appears. While this should be a no-brainer for anybody venturing onto the Web, this little piece of advice will pay higher dividends in the new year, according to security experts, who say cybercriminals are increasingly preying on people’s misplaced trust in each other and popular Web sites. This advice applies especially to hot technologies, such as social networking and smart phone users, but also anybody who uses search engines, clicks on Internet ads, or sits in front a Mac they thought was safe. Social networking Web sites such as Facebook, MySpace, Google Wave, and Twitter will become major focuses of cybercriminals looking to spread malware and steal sensitive data. That’s the prediction of many major Internet security firms, including McAfee Labs and Websense Security Labs. McAfee Labs, which published its 2010 Threat Predictions report in late December, suggests that users of Facebook and Twitter are especially vulnerable because they put too much trust into the systems, the underlying technology, and other users. For example, the use of abbreviated URLs on Twitter makes it easier for cybercriminals to mask and direct users to malicious Web sites, the security group notes. Similarly, on Facebook, McAfee fears that rogue software writers will take advantage of “friends trusting friends” to get users to click on links they might otherwise treat cautiously. The protective blanket of anonymity enjoyed by non-mainstream (i.e., non-Windows) platforms such as Mac OS and Linux will be a little thinner this year, thanks to a new generation of cross-platform malware enabled by technological advances, such as enhancements in HTML 5, McAfee Labs predicts. Google’s Chrome OS will also do much to further the democratization of cyber threats. And the folks on Microsoft‘s TechNet security team will be silently cheering if one McAfee prediction comes true: That software from Adobe will become the most targeted products by hackers looking to exploit software vulnerabilities. McAfee says Adobe Reader and Flash are poised to overtake Microsoft Office–long a goldmine for cybercriminals–as the leader in this dubious category. The size and shape of automated malware distribution networks, or botnets, will continue to shift in 2010, McAfee says. The security groups says cybercriminals will continue the transition from a centrally controlled botnet infrastructure to a more distributed peer-to-peer network, which will make it harder for law enforcement organizations to detect and dismantle the botnets. Hackers will continue to target banking Web sites (which are particularly attractive targets because, well, that’s where the money’s at). McAfee says increasingly sophisticated Trojans will enable thieves to hijack consumers’ transactions on banking Web sites, while remaining below the security radar by stealing less than the victim’s withdrawal or credit limit. Despite the challenges facing computer security in 2010, McAfee remained upbeat about the new year. “Over the past decade, we’ve seen a tremendous improvement in the ability to successfully monitor, uncover, and stop cybercrime,” said Jeff Green, senior vice president of McAfee Labs. “We’re now facing emerging threats from the explosive growth of social networking sites, the exploitation of popular applications and more advanced techniques used by cybercriminals. But we’re confident that 2010 will be a successful year for the cybersecurity community.” Meanwhile, the folks in the Websense Security Labs have come up with their own list of security predictions for 2010. The San Diego, California, firm sees continued evolution of the so-called “blended” attack, in which cybercriminals use multiple methods to deceive and steal from victims on the Web. The Websense lab also sees smartphones, Windows 7, and social networking Web sites as popular hacker targets for the new year. Basically, cybercriminals follow consumers in whatever products they adopt, much like a pack of wolves stalking a herd of bison as it migrates across the Great Plains. “As audiences are moving quickly into the social Web, so are the attacks,” says Dan Hubbard, chief technology officer for Web sense. “Additionally, as emerging operating systems and platforms like Macs and mobile devices become more popular, they are more targeted.” After several years of ignoring e-mail as a route for distributing malware, Websense sees cybercriminals turning to the old hacker standby. The security firm saw a “huge” uptake in malicious e-mails during 2009, and expects to see more e-mails containing data-stealing payloads and malicious URLs. Another lucrative avenue of cyber attacks in 2010 will involve search engines and advertisements, according to Websense. In 2009, cybercriminals found success using search engine optimization (SEO) techniques to load their malicious Web sites near the top of search engine results. “These ongoing campaigns are likely to gain steam in 2010 and may cause a trust issue in search results among consumers, unless the search providers change the way they document and present links,” Websense says. Related to SEO techniques are malicious ad servers, in which cybercriminals posing as legitimate companies buy banner ads that actually load malicious software on a victim’s computer when the click on the link. A successful exploit of the New York Times Web site last year, in which victim’s inadvertently exposed themselves to malware by clicking on an ad for antivirus software that appeared legitimate, provides the model that cybercriminals will follow in 2010, Websense says.
|
