The emerging threats from 2011 are on track to become the major
players for cyber activity in 2012, according to McAfee. McAfee
Labs also predicts that attacks involving political motivation or
notoriety will also make headlines, including high-profile
industrial attacks, cyberwarfare demonstrations and hacktivist
attacks targeting public figures.
“Many of the threats that will become prominent in 2012,
have already been looming under the radar in 2011,” said
Vincent Weafer, Senior Vice President of McAfee Labs. “Over
the past year, the general public has become more aware of some of
these risks, such as threats to critical infrastructure or the
impact of hacktivism as they gain international media
attention. In the meantime we continue to see cybercriminals
improving their toolkits and malware and are ready to make a
significant impact in 2012.”
Here are McAfee Labs’ Threat Predictions for 2012:
Industrial attacks
Water, electricity, oil and gas are essential to people’s
everyday lives, yet many industrial systems are not prepared for
cyber attacks. Many of the environments where SCADA (supervisory
control and data acquisition) systems are deployed don’t have
stringent security practices. As with recent incidents directed at
water utilities in the United States, attackers will continue to
leverage this lack of preparedness with greater frequency and
success in 2010, if only for blackmail or extortion in 2012.
Advertisers will “legalize”
spam
McAfee Labs has seen a drop in global spam volumes in the past
two years. However, legitimate advertisers are picking up where the
spammers left off using the same spamming techniques, such as
purchasing e-mail lists of users who have “consented”
to receive advertising or purchasing customer databases from
companies going out of business. McAfee Labs expects to see this
“legal” spam and the technique known as “snowshoe
spamming” to continue to grow at a faster rate than illegal
phishing and confidence scams.
Mobile threats
2011 has seen the largest levels in mobile malware history. In
2012, McAfee Labs expects for mobile attackers to improve on their
skill set and move toward mobile banking attacks. Techniques
previously dedicated for online banking, such as stealing from
victims while they are still logged on while making it appear that
transactions are coming from the legitimate user, will now target
mobile banking users. McAfee Labs expects attackers will bypass PCs
and go straight after mobile banking apps, as more and more users
handle their finances on mobile devices.
Embedded hardware: The promised land for sophisticated
hackers
Embedded systems are designed for a specific control function
within a larger system, and are commonly used in automotive,
medical devices, GPS devices, routers, digital cameras and
printers. McAfee Labs expects to see proofs-of-concept codes
exploiting embedded systems to become more effective in 2012 and
beyond. This will require malware that attacks at the hardware
layer, and will enable attacks to gain greater control and maintain
long-term access to the system and its data. Sophisticated hackers
will then have complete control over hardware.
Hacktivism
McAfee Labs predicts that in 2012, either the “true”
anonymous group will reinvent itself, or die out. Additionally,
those leading the digital disruptions will join forces with
physical demonstrators, and will target public figures such as
politicians, industry leaders, judges and law-enforcement
officials, more than ever before.
Virtual currency: A cybercriminal payment
plan
Virtual currency, sometimes called cybercurrency, has become a
popular way for people to exchange money online. These online
“wallets” are not encrypted and the transactions are
public, making them an attractive target for cybercriminals. McAfee
Labs expects to see this threat evolve into spam, data theft,
tools, support networks and other associated services dedicated to
solely exploiting virtual currencies, in order to steal money from
unsuspecting victims or to spread malware.
Cyberwar
Countries are vulnerable due to massive dependence on computer
systems and a cyberdefense that primarily defends only government
and military networks. Many countries realize the crippling
potential of cyber attacks against critical infrastructure, such as
water, gas and power, and how difficult it is to defend against
them. McAfee Labs expects to see countries demonstrate their cyber
war capabilities in 2012, in order to send a message.
Rogue Certificates
Organizations and individuals tend to trust digitally signed
certificates, however, recent threats such as Stuxnet and Duqu used
rogue certificates to evade detection. McAfee Labs expects to see
the production and circulation of fake rogue certificates increase
in 2012. Wide-scale targeting of certificate authorities and the
broader use of fraudulent digital certificates will affect key
infrastructure, secure browsing and transactions as well as
host-based technologies such as whitelisting and application
control.
Tomorrow’s Internet looks more like
yesterday’s Internet
DNSSEC (Domain Name System Security Extensions) are meant to
protect a client computer from inadvertently communicating with a
host as a result of a “man-in-the-middle” attack. Such
an attack redirects the traffic from the intended server (web page,
e-mail, etc.) to another server. Governing bodies around the
globe are taking greater interest in establishing “rules of
the road” for Internet traffic, and McAfee Labs expects to
see more and more instances in which future solutions are hampered
by legislative issues.
Advances in operating systems moves hackers “down
and out”
New security features baked into the core of the operating system
will cause hackers to find alternate entryways: down into the
hardware and out of the operating system. Attacking hardware and
firmware is not easy, but success allows attackers to create
persistent malware in network cards, hard drives and even system
BIOS (Basic Input Output System). McAfee Labs expects to see more
effort put into hardware and firmware exploits and their related
real-world attacks through 2012.
"Disclaimer Note: "InformationWeek India and UBM India do not endorse, and have not verified the views and claims expressed in this vendor Press Release."