STUART DREDGE
DEC. 24, 2014
Will 2015 be a happy new year for internet users? Not if cybercriminals have their way.
Online security companies have been making their predictions for 2015, from the malware that will be trying to weasel its way onto our computers and smartphones to the prospect of cyberwar involving state-sponsored hackers.
Here’s a summary of what you should be watching out for online in 2015, based on the predictions of companies including BitDefender, KPMG, AdaptiveMobile, Trend Micro, BAE Systems, WebSense, InfoSec Institute, Symantec, Kaspersky, Proofpoint and Sophos. The links lead to their full predictions.
Targeted attacks and sophisticated spam
The more we do and share online, the more vulnerable we may be to “targeted” attacks to steal our passwords and data. “It is possible that our willingness to share and shop online will let criminals become more selective about who they target,” suggests Stephen Bonner of KPMG.
“They won’t need to maintain the current ‘hit and hope’ approach of spear phishing, instead only attacking specific users and computers based on the data these give away about their owners.”
Meanwhile, you may see more spam emails in your inbox in 2015, as the technology used to send them becomes more sophisticated.
“Cybercriminals upping their game are perfecting their campaign abilities previously associated only with advanced, targeted attacks. These advanced tactics designed to evade most modern email security solutions are quickly becoming the new norm as more sophisticated email threats increase,” suggests WebSense.
“As a result, although spam volumes are decreasing, most users will begin to witness an increase in the amount of spam they receive in their inbox, because most email security measures will be incapable of detecting them in the Cloud scrubbing prior to passing to a user’s inbox.”
Banking and healthcare companies at risk
A parallel trend cited by several of the companies is the prospect of attacks on bigger companies in the private and public sector, with cybercriminals having specific goals in mind.
“Cybercriminals will go after bigger targets rather than home users as this can generate more profits for them. We will see more data breach incidents with banks, financial institutions, and customer data holders remaining to be attractive targets,” suggests Trend Micro.
“Weak security practices like not using two-factor authentication and chip-and-pin technology continue to persist in the banking sector. These practices will cause financially motivated threats to grow in scale throughout the coming year.”
Healthcare is also expected to be a target. “Companies operating in the sector are a privileged target because of the wealth of personal data they manage, and that represents a precious commodity in the criminal underground,” notes InfoSec Institute.
“Healthcare data are valuable because medical records can be used to commit several types of fraudulent activities or identity theft. Their value in the hacking underground is greater than stolen credit card data.”
WebSense’s Carl Leonard agrees. “The healthcare industry is a prime target for cybercriminals. With millions of patient records now in digital form, healthcare’s biggest security challenge in 2015 will be keeping personally identifiable information from falling through security cracks and into the hands of hackers.”
Ransomware on the rise
One of the most common forms of malware in 2014 was “ransomware” – cybercriminals trying to extort money from victims either by locking their devices and demanding a fee to release them, or by accusing them of various unpleasant crimes.
“Users should remain sceptical of any message accusing them of various crimes such as zoophilic behaviour and distributing child pornography,” claims BitDefender. “These threats may be part of ransomware campaigns and could also hit social networks.”
Symantec notes the growth of one particular strain of ransomware, Cryptolocker, which it claims accounted for 55% of all ransomware in October this year, encrypting people’s files then demanding money to unencrypt them.
“Holding encrypted files for ransom is not entirely new, but getting the ransom paid has previously proven problematic for the crooks. However recently ransomware makers have started leveraging online and electronic payment systems such as Bitcoins, Webmoney, Ukash, greendot (MoneyPak) to get around this challenge,” it explains.
“Crooks like the relative anonymity and convenience of electronic payments and these are already readily available, putting businesses and consumers at greater risk from losing data, files or memories.”
Mobile payments could be hot... for criminals
APA customer makes a purchase with a MasterCard using Apple Pay on the iPhone 6.
One of the big announcements for Apple in 2014 was the launch of its mobile payments service, Apple Pay. However, several security companies expect cybercriminals to make a concerted effort to crack it and rival services in 2015.
“Apple Pay is not alone in the market – other payment systems have or will be introduced by other companies and trade associations. Not all of these payment systems have been thoroughly tested to withstand real-world threats, and we may see attacks targeting mobile commerce in 2015,” claims Trend Micro.
“Apple Pay certainly addresses some of the weaknesses that have facilitated recent attacks on Point-of-Sale (PoS) systems. However, this should not be cause for complacency, since attackers will usually look for other weaknesses once an avenue of attack has been closed off,” adds Symantec.
For now, those weaknesses may come in other forms of payment, according to Sophos. “Cybercriminals will be looking for flaws in these systems, but the present designs have several positive security features. Expect cybercriminals to continue abusing traditional credit and debit cards for a significant period of time as they are the easier target for now,” it suggests.
How popular Apple Pay and rivals are will also be a factor. “Criminal hackers tend to attack popular platforms where the yield is likely high. If no one adopts Apple Pay, then no one will target it. However, if Apple Pay is as popular as Apple’s other traditional and mobile offerings, then we may be writing about Apple Pay hacks sooner rather than later,” claims Kaspersky.
Mobile malware aims at Apple, not just Android
It’s now traditional for Apple’s senior executives to take pops at Android on-stage over malware, hammering home their claims that the biggest rival to iOS has more security problems. Will they be able to continue that line of attack in 2015? Some security firms think Apple will be under more scrutiny too.
“The Masque bug in iOS and the corresponding WireLurker malware targeting iOS devices via Apple and Windows port-machines, had a lot of experts saying that the age of Apple malware is finally upon us,” says Kaspersky, although it also points out that this is still most likely to affect people who’ve jailbroken their devices.
“Apple’s closed-by-default ecosystem makes it harder for malware to successfully take hold of the platform, though some users — particularly those that like to use pirated software — will disable these features.”
Others suggest that Android will remain the principal target for cybercriminals, as well as predicting a more general increase in mobile scams and attacks. “We will see more vulnerabilities found in mobile devices, apps, and platforms in the coming year. Cybercriminals will target data stored in these mobile devices,” claims Trend Micro.
“A new exploit kit specifically developed to compromise mobile platforms will be available in the wild,” adds InfoSec Institute. “The attacks will benefit from a significant increase of phishing attacks on mobile devices, as malicious links and applications downloaded from third-party stores redirect users to websites hosting the malicious exploit kit. Once visited by victims, their mobile will become infected.”
Open source code still a target
Some of the most high-profile vulnerabilities in 2014 – Shellshock and Heartbleed – provoked discussion about the security of open source code. Several security companies expect this debate to continue in 2015.
“These vulnerabilities were undetected for years and were only brought into light recently. Due to the massive impact of these vulnerabilities, cybercriminals and attackers may decide to investigate the existing code and see if other dormant vulnerabilities are present,” suggests Trend Micro.
“From Heartbleed to Shellshock, it became evident that there are significant pieces of insecure code used in a large number of our computer systems today,” adds Sophos. “The events of 2014 have boosted the cybercriminals’ interest in typically less-considered software and systems – so businesses should be preparing a response strategy.”
WebSense agrees. “Old source code is the new Trojan horse waiting to be exploited, and open-source code is only the beginning. With so much code written and in use, it’s impossible to catch every dormant exposure point until they’ve been executed,” says Leonard.
“Because of this, any time source code is altered or integrated as part of an application or service upgrade, these unknown systemic vulnerabilities have the potential to expose networks to attack.”
Criminals hiding on the darknet
Technology like Tor is used for a variety of reasons, including activists anonymising their online activities when under pressure from authoritarian governments. However, this kind of technology will also be used by more cybercriminals in 2015.
“We’ve seen cybercriminals leveraging Deep Web and other darknet services as well as untraceable peer-to-peer networks (e.g. Tor, I2P, Freenet) for selling and exchanging tools and services,” claims Trend Micro. “Takedowns and collaborative efforts beween researchers and law enforcement agencies have disrupted cybercrime gangs, giving them more reasons to go further underground.”
BAE’s cyber security boss Scott McVicar also thinks criminals will “go to greater lengths” to hide their identity, which will have an impact on efforts to identify them and nullify their efforts. “Researchers will need to adopt practices from the professional intelligence community and tread more carefully when drawing conclusions about who is ultimately behind cyber attacks,” he says.
Social media malware and malvertising
The huge number of people using social networks like Facebook is proving an appetising target for malware developers: BitDefender has already published its roundup of popular Facebook scams in 2014, for example.
“Malicious links hidden in atrocious Facebook videos will be on the rise in 2015,” warns the company. “Malicious ‘beheading and murder’ videos are expected to multiply in the following year. Behaviour analysts and psychologists say teenagers are the most susceptible to clicking on shocking videos, as their empathy for victims of violence is lower.”
Proofpoint has stats on the growth of this kind of threat. “Already in 2014, Proofpoint found a 650% increase in social media spam compared to 2013, and 99% of malicious URLs in inappropriate content led to malware installation or credential phishing sites,” explains the company.
“In 2015, Proofpoint expects inappropriate or malicious social media content to grow 400percent as attackers target enterprise social media accounts to perpetrate confidence schemes, distribute malware, and steal customer data.”
The company also suggests that “malvertising” – malware distributed through online ads – will also continue to be a threat in 2015. “In 2015, attackers will become more refined in their ability to infect sites, target users and deliver payloads while evading detection by most common scanning and gateway tools,” it claims.
Internet of Things a rising concern
As more of our devices talk to one another – the “Internet of Things” – there may be a range of new cybersecurity headaches to think about. Although it might not be us doing the thinking.
“While at present subscribers play an active role in spam prevention by reporting incidents to their operators, with IoT the challenge will be spotting the threats that can infect IoT devices,” claims AdaptiveMobile. “‘Things’ are going to be less security and spam-aware than consumers and so the responsibility will fall on the operator to secure IoT services and devices at the network-level.”
WebSense thinks that in 2015, attacks on the Internet of Things will focus more on businesses than individuals with gadgets. “While many hacks of refrigerators, home thermostats and cars have found their way to the headlines, the likelihood of a major attack campaign via connected household items in the age of the Internet of Things is minimal,” it claims.
“While you may have to worry about cybercriminals successfully melting your butter or spoiling the milk in your refrigerator, there is little reward in attacks against your connected domestic devices. The criminal element has set its sights elsewhere.”
Symantec disagrees. “Attacks on the Internet of Things (IoT) will focus on smart home automation: With smart home automation gaining popularity amongst consumers across Asia Pacific and Japan, Symantec anticipates that commoditised “plug and play” consumer devices such as CCTV cameras and remote access controls for alarms, lighting and climate control will be exploited by cybercriminals,” predicts the company.
“We won’t see any large-scale attacks leveraging IoT, but instead one-off attacks against connected devices such as home routers, Smart TVs and connected car apps, for example, for sensitive and private information.”
Cyberwar as criminal/state boundaries blur
As 2014 ended with the now-infamous hack of Sony Pictures – with intense debate about whether North Korea was involved – security firms see 2015 bringing a greater prospect of cyberattacks on behalf of nation states, even if they don’t run them themselves.
“Cyber warfare is very attractive to small nations. The development of a government-built malware is cheaper than any other conventional weapon and far more accessible to any nation-state. Cyber warfare represents for every government an efficient alternative to conventional weapons,” notes InfoSec Institute.
“North Korea, Syria, and Iran are among the countries that have developed great capabilities that pose a serious threat to major Western states. The risk of a serious attack on the critical infrastructure of a Western government is high, and its attribution will be even more difficult.”
The boundaries between cybercriminal gangs and governments may also blur. “Criminal groups will increasingly adopt nation-state tactics,” predicts Kaspersky.
“State-sponsored, advanced persistent threat hacking groups, like we’ve seen in cases such as DarkHotel, Regin and Crouching Yeti/Energetic Bear, will begin to merge with hacking campaigns perpetrated by criminals, like those targeting JP Morgan Chase, Target and others.”
“State groups could also contract their espionage activities out to criminal groups, that will use criminal tools and expertise to perform spying activities, steal intellectual property or gather intelligence about vulnerabilities in critical infrastructure systems at the behest of government groups.”
This article originally appeared on guardian.co.uk
No comments:
Post a Comment