Get ready for invited break-ins, malware-ridden apps and spoof attacks
by Dominique Karg - Chief Hacking Officer at AlienVault - Tuesday, 18 December 2012.
Itís that time of year again when, it seems, every technology vendor suddenly becomes clairvoyant with an insatiable urge to predict the battles we need to arm ourselves against. The cynic in me would suggest that the primary function for imparting these pearls of wisdom is to sow a seed that grows into sales for a particular technology. With that in mind, here are my top predictions for the coming months.

First on my list of predictions: The aforementioned self-promoting vendors will be compelled to compare me to a pot fixated on certain coal-colored kettles, if you catch my drift. I will retaliate by stating that my predictions are based on Ďrealí trends that I see in the security arena and not just meant to allow me to sell more of my boxes. $10 says we donít even get into the New Year before this particular prediction bears fruit!

Ok, enough frivolity already - security is a serious subject, so time for some proper insights!

Rise in invited break-ins

Itís been alluded to for years but our devices are under attack. I predict that 2013 will see a surge in compromised computers. There are a number of ways that this will happen:

a) The patient criminal

Social media has proved hugely popular and many of us now follow our friends and colleaguesí antics through a montage of tweets, status updates and profile changes. And itís not just the average Joe on the street who has switched on to Social Media; criminals are also using these networking sites to practice their craft Ė for example, Dorkbot hit Skype in October and combined ransomware with social media targeting by delivering clickable messages to users on behalf of their connections. Take this a step further and I believe the threat could come from a wolf in sheepís clothing Ė the criminal in disguise.

Imagine a Twitter feed purporting to be from a respected, but relatively new, guru on the block. His LinkedIn profile looks legitimate with a number of credible positions under his belt. After a few months the account has risen from X00s to X0,000s of followers all hanging on his every word. On the face of it this person is not just trusted but obviously has his finger on the pulse. One day he issues a warning that there is a serious security flaw in a popular operating system. Suggesting a patch will be too late, many trust the link he publishes and clamour to download the code that will mitigate the threat. But what if itís all part of an elaborate deception and, instead of a protective blanket, youíre cut to shreds in razor wire?

b) The deadly app

To date, many app vendors (Google, Microsoft, Apple etc.) have managed to retain control of their own stores. I think that, with everyone and his son now writing apps, some stores may struggle to vet every single program offered and remain timely. For that reason, itís inevitable that a virulently malevolent code will infiltrate these marketplaces. With some programs, once theyíve been installed on a userís PC, they are able to automatically install on all of the users linked devices. And it doesnít mean that the user will be instantly aware that malware has been installed, as it could lie dormant waiting to be exploited when the time is right. Of course, it will depend on the program, but the right code could take advantage of a userís apathy and abuse any stored credentials and automatic fills for various online accounts. What about a smartphone that is then used to dial premium rate numbers!


Harnessing artificial intelligence to build an army of virtual analysts

PatternEx, a startup that gathered a team of AI researcher from MIT CSAIL as well as security and distributed systems experts, is poised to shake up things in the user and entity behavior analytics market.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Tue, Feb 9th