The annual report from Georgia Tech Information Security Center identifies five evolving cyber security threats, and the news is not good.
GTISC interviewed a range of industry security experts to explore the threats and the available countermeasures. The five are malware, botnets, cyber warfare, threats to VoIP and mobile devices, and the "evolving cyber crime economy."
In all five areas, attackers are becoming increasingly sophisticated, increasingly subtle, and increasingly adept at exploiting new Web developments, such as the rise of social network sites. Industry and government need to become equally concerted and sophisticated to contain these threats if the Internet is to be a trusted communications medium.
The just-released report, "Emerging Cyber Threats Report for 2009: Mobility and Questions of Responsibility will Drive Cyber Threats in 2009 and Beyond," is online.
Malware development expertise is rapidly maturing, skills that are perfectly suited to exploit the continued weaknesses of poorly configured Web sites, especially social networking sites. The report cited Ryan Naraine, security evangelist for Kaspersky, as predicting a 10-fold increase in malware objects detected in 2008.
"As cyber criminals move beyond mass-distribution style phishing scams, they are learning how to localize and personalize their attacks for better penetration," according to the GTISC report. "Social networking sites like MySpace, Facebook and others will likely be used as delivery mechanisms to get unsuspecting users to a malicious Web site link in order to deliver malware."
As an example, the report described an exploit that sends a Facebook message from one friend to another, about a YouTube video, including a link to the clip. The recipient clicks on the link, sees a prompt to download an updated version of Flash player to run the clip. When he clicks on the update, it actually installs malware on his computer.
Another weakness that malware continues to exploit is the delay in patching and updating software on enterprise computers. Kaspersky's Naraine says the average corporation takes three to five months to apply a Windows patch everywhere, giving that much more time for malware programs and the botnets that they call into being to take advantage of known weaknesses.