Trend Micro 2010 Future Threat Report

December 14, 2009 · Filed Under Internet Software, Security Software, Software News · Comment 

Virtualization, Cloud-Computing and a Shifting Internet Infrastructure Will Widen the Scope of Cybercrime

Using news headlines and the latest technological trends, cybercriminals are brilliantly agile at exploiting whatever is trendy for cash and profit. Now, the growing popularity of cloud computing and virtualization among companies is likely to catch the attention of criminals scheming for the next hot cyber-swindle.

According to the Trend Micro 2010 Future Threat Report, cloud computing and virtualization — while offering significant benefits and cost-savings — move servers outside the traditional security perimeter and expand the playing field for cybercriminals. The industry already witnessed Danger/Sidekick’s cloud-based server failure that caused major data outages in November 2009, highlighting cloud-computing risks that cybercriminals will likely abuse. Trend Micro believes cybercriminals will either be manipulating the connection to the cloud, or attacking the data center and cloud itself.

The Internet infrastructure is changing, opening more opportunities for cybercrime

The “next-generation” protocol designed by the Internet Engineering Task Force, Internet Protocol v. 6, is still in the experimentation stages of replacing the current IPv4, now 20 years old. As users start to explore IPv6, so will cybercriminals, and we can expect to see proof-of-concept elements in IPv6 start to materialize in the upcoming new year. Possible avenues for abuse include new covert channels or C&C. But don’t expect active targeting of IPv6 address space–at least not in the very immediate future.

Domain names are becoming more internationalized and the introduction of regional top-level domains (Russian, Chinese, and Arabic characters) will create new opportunities to launch age-old attacks through look-alike domains for phishing – using Cyrillic characters in place of similar looking Latin characters. Trend Micro predicts this will lead to reputation problems and abuse that will challenge security companies.

Social media and social networks will be used by cybercriminals to enter the users’ “circle of trust”

Social engineering will continue to play a big role in the propagation of threats. But given the increasing saturation of social media with content intended to be shared via online social interactions, cybercriminals will definitely try to penetrate and compromise popular communities more than ever in 2010.

Social networks are also ripe venues for stealing personally identifiable information (PII). The quality and quantity of data posted openly by most trusting users on their profile pages, combined with interaction clues, are more than enough for cybercriminals to stage identity thefts and targeted social engineering attacks. The situation will worsen in 2010, with high-profile personalities suffering from online impersonators or stolen bank accounts.

The extinction of global outbreaks, and the growth of localized, targeted attacks

The threat landscape has shifted and we are no longer seeing global outbreaks like Slammer or CodeRed. Even the much covered Conficker incident of 2008 and early 2009 was not a global outbreak by its true definition; rather it was a carefully orchestrated and architected attack. Moving forward, localized and targeted attacks are expected to grow in their number and sophistication.

More key forecasts for 2010 and beyond:
– It’s all about money, so cybercrime will not go away.
– Windows 7 will have an impact since it is less secure than Vista in the default configuration.
– Risk mitigation is not as viable an option anymore-even with alternative Browsers /alternative operating systems.
– Malware is changing its shape – every few hours.
– Drive-by infections are the norm – one Web visit is enough to get infected.
– New attack vectors will arise for virtualized/cloud environments.
– Bots can’t be stopped anymore, and will be around forever.
– Company/Social networks will continue to be shaken by data breaches.

Source: Trend Micro Incorporated

Tags: , , , , , , , , , , , , , , ,

CA report: Fake security software, search engines and social networks 2009′s Top Internet Threats

December 10, 2009 · Filed Under Software News · Comment 

CA “State of the Internet 2009″ Report Analyzes Top Internet Threats; Researchers Predict Online Threats for 2010

The latest State of the Internet 2009 report issued today by CA, Inc. states that the most notable 2009 online threats were rogue/fake security software, major search engines, social networks and Web 2.0 threats. The report, based on data compiled by CA’s Global Security Advisor researchers, compiles trends from the first half of 2009. CA security researchers also offer predictions for the top Internet threats for 2010, including an increase in “malvertising” and the potential for another big computer worm outbreak like Conficker.

“Cybercriminals have made a business out of conducting attacks on the most popular online destinations because they promise the highest payoff,” said Don DeBolt, director of threat research for CA’s Internet Security Business Unit. “Cybercriminals keep up with trends, major events, holidays, and the like, and focus on where they’ll get the biggest returns. Search engines, like Google and Yahoo, or social networking sites, like Twitter or Facebook, have the mass appeal to attract these criminals. In addition to Internet security software, the best weapon against today’s threats is education, so that consumers know what to look for when they are conducting activities online.”

CA researchers tracked the following trends in 2009:
– Rogue or Fake Security Software: Software that poses as legitimate Internet security software but is actually malware has experienced a significant surge in popularity. In the first half of 2009, CA added detection for 1,186 new variants of Rogue security software, which is a 40% increase compared to the last half of 2008.
– Search Index Poisoning: Google is a frequent target of online threats. Attackers employ sophisticated search engine optimizations to manipulate search engine rankings and poison users’ search results, which direct them to compromised Web sites that can cause malware infections.
– Social Networks/Web 2.0: Popular online communities, blogs and social media sites, such as YouTube, MySpace, Facebook and Twitter, are highly targeted. Financially motivated organized groups are among the aggressive attackers, creating hundreds of bogus profiles to perform various tasks, including distributing malware, spamming and stealing users’ online identities to perpetrate further cybercrime. Win32/Koobface is an example of a worm propagating through social networking sites. It uses the affected user’s login credentials to send messages to the user’s list of connected friends and family. In 2009, CA ISBU discovered more than 100 components and mutated strains belonging to the Win32/Koobface family.
– Identity Theft: Attacks targeting online credentials allowed attackers to distribute further cybercriminal activities, such as email address harvesting for Spam bots, sweeping FTP accounts for web infection and attributing to social network worm propagation, like Win32/Koobface. Stealing Trojans accounted for 23% of the most prevalent malware infections in 2009.
– Cybersquatting and typosquatting: Malicious Web sites that masquerade as legitimate, reputable sites deceive users into undertaking transactions or activities in which they divulge sensitive data.
– Mac OS X Threats: Security threats have come to the Mac. In 2009, CA ISBU has added 15 intelligent signatures detecting Mac OS X threats. The most prevalent being OSX/Jahlav.

“Malware doubled in 2009 and the ability to purchase bots and other malicious programs online is becoming more prevalent,” DeBolt continued. “It is a cat and mouse game. Cybercriminals are evolving along with the malware community and are constantly looking for new vulnerabilities to exploit, from online banking to search index poisoning.”

While spam and phishing scams are still on the rise, the breakdown for how malware was distributed in 2009 was dominated by the Internet at 78 percent, followed by email (via attachments or phishing) at 17 percent, and finally removable media (such as USB drives, digital photo frames, etc.) with 5 percent.

CA forward looking online security predictions for 2010:

1. Search engine optimization exploits and malicious advertising (Malvertising) will increase as a means to distribute Malware.
2. Another big computer worm like Conficker is likely. The increasing popularity of web-based applications and discovery of critical zero-day vulnerabilities, especially for new operating systems such as Windows 7 and Google Chrome, present good opportunities for a new worm outbreak.
3. Threats to Web 2.0 technologies such as social networks will continue to grow.
4. Denial-of-Service attacks will increase in popularity as a means to make a political statement. Popular websites like Twitter and Facebook are likely to fall victim once again.
5. Banking Trojans: These Trojans manifest as banking-related threats orchestrated to steal users’ identities for financial gain.
6. Malware actors will focus on the 64 bit and Apple platform.

The CA 2009 State of Internet Security report is intended to inform consumers and businesses of the newest and most dangerous Internet threats, forecast trends and provide practical advice for protection. The analysis provided is based on incident information from the CA Global Security Advisor team, submitted by CA customers and consumers from January to June 2009, as well as publicly available information. For the full CA 2009 State of Internet Security report, please visit www.ca.com/securityadvisor.

The CA Global Security Advisor Team delivers the around-the-clock, dependable security expertise, offering trusted security advice to the world for more than 16 years. Providing a complete threat management resource, CA’s Security Advisor Team is staffed by industry-leading researchers and skilled support professionals. CA Global Security Advisor is available at www.ca.com/securityadvisor. It offers free security alerts, RSS feeds, PC scans and a regular blog updated by the worldwide team of researchers. CA’s entire portfolio of threat-related products for home, small and medium businesses, and enterprises are updated and protected by the CA Global Security Advisor team.

Source: CA

Tags: , , , , , , , , , , , , , , , ,

U.S. ranks 9th in Global PC Infection Report, according to PandaLabs

September 29, 2009 · Filed Under Security Software, Software News · Comment 

Average number of worldwide infections grew 15 percent over last month – Global infection ratio hits all time high this year at nearly 60 percent

PandaLabs, Panda Security’s malware analysis and detection laboratory, announced that it has detected a 15 percent increase in the total number of malware-infected computers in September in comparison to the previous month of August. According to data gathered from users that scanned and disinfected their computers with the free Panda ActiveScan online antivirus, the average infection ratio rose to 59 percent, the highest rate this year.

In comparison to the infection rates of 29 countries, the U.S. ranks ninth with an infection ratio of 58.25 percent, just below the worldwide average. Taiwan has the most infected PCs, with a 69.10 percent corruption, followed by Russia and China at 67.99 percent and 61.97 percent, respectively. The country with the least infections is Norway at 39.60 percent. To view a table that outlines the percentage of infected computers by country, please visit: http://www.flickr.com/photos/panda_security/3963144168/.

According to Luis Corrons, Technical Director of PandaLabs, “There is a false sense of security, as users perceive there to be no real danger at the moment. When their computers get infected, they rarely notice any symptoms.”

Panda’s study revealed that U.S. computers are infected by the most dangerous malware strains: Trojans, followed by adware, worms and viruses. To see the number and types of malware on infected computers in the U.S., please visit: http://www.flickr.com/photos/lithium-/3963437003/sizes/o/.

“This is a clear sign that hackers are becoming more and more sophisticated,” explains Corrons. “Cybercriminals have found news ways to spread their creations, frequently exploiting the latest news stories to launch attacks through social networks, videos, and email. The huge amount of Trojans in circulation is due to the spectacular increase in the number of banker Trojans aimed at stealing user data.”

Tags: , , , , , , , , , , , , , , , , , , , , , , , ,

SIIA Anti-Piracy Division Reports 2008 Successes Following Aggressive Enforcement & Educational Outreach

March 10, 2009 · Filed Under Software News · Comment 

National Leader in Software and Content Anti-Piracy Efforts Announces Success Stories in Settlements, Suits, Rewards and Punishments for the Past Year – Including Imprisonment of Online Pirate Jeremiah Mondello

The Software & Information Industry Association (SIIA), the principal trade association for the software and digital content industries, released its 2008 Anti-Piracy Year in Review. The report chronicles SIIA’s anti-piracy efforts, educational programs, success stories, and also profiles some interesting “criminal behavior” highlights from 2008.

According to Keith Kupferschmid, Senior Vice President for SIIA Intellectual Property Policy and Enforcement, “2008 was one of the most successful years to date for our organization’s anti-piracy litigation and education efforts. Our dual approach enabled us to crack down on the illegal sale of pirated software and digital content while helping consumers to distinguish between legitimate and illegal software and content.”

Notable achievements during this past year include:

Internet Anti-Piracy Enforcement Efforts Strengthened: In 2008, SIIA brought a record number of lawsuits against fraudulent sellers of member company software on auction sites such as eBay, Amazon.com and iOffer. In addition to these suits, SIIA shut down auction and classified ad sites offering products worth a combined total of approximately $25 million dollars. Most significantly, the SIIA Anti-Piracy program reached a new milestone with the sentencing of Jeremiah Mondello, an eBay seller who used stolen bank account information to create more than 40 fictitious eBay and PayPal identities to sell pirated software. SIIA was responsible for providing the Department of Justice (DOJ) with information that led to Mondello’s guilty plea and imprisonment.

Anti-Piracy Efforts Go Global: SIIA increased the reach of its Anti-Piracy enforcement efforts by hiring additional in-house investigators who are fluent in French, Chinese, Russian, German and several other languages and monitoring for infringements on a global scale as it expanded its enforcement to eBay international sites, Amazon.co.uk, Amazon.de, as well as hood.de, allegro.pl, marktplaats.nl, and kapaza.be.

Corporate Software Anti-Piracy Program: SIIA’s Corporate Software Anti-Piracy Program expressly combats software piracy in the workplace through key education and legal initiatives. In 2008, SIIA received 251 reports of alleged piracy — nearly one per business day, and approximately the same number as the 247 reports received in 2007. Of the 251 reports, 56 (or 22%) were judged sufficiently reliable to pursue, illustrating SIIA’s conservative approach to ensuring cases are definitive and legitimate. During the past year, 56 companies settled copyright infringement claims with SIIA, including: Doan Pyramid, an electrical contractor and developer in Cleveland, Ohio, which settled for $250,000; Tric Tool, a firm that designs and builds automation systems, which settled their claims for $76,000; and numerous other unnamed companies that also settled claims for six figures-plus, including a well-known women’s clothing firm that settled its claim for $425,000.

New Educational Videos Released: As part of its new Ask Before You Act campaign, SIIA created a new educational website called www.askbeforeyouact.com and released new educational videos and a toolkit to assist corporate software and content compliance managers in helping their employees understand the importance of copyright issues.

Compliance Matters Blog Initiated: The SIIA Anti-Piracy staff started a blog on the new Ask Before You Act website covering new and often complex copyright, licensing and compliance issues relating to the use of software and content. Guest bloggers include Tamera Bennett from Bennett Law Office, P.C., and Robert Clarida from Cowan, Liebowitz & Latman, P.C.

Copyright Legislation Enacted: President Bush signed into law S. 3325, “the Prioritizing Resources and Organization for Intellectual Property (PRO IP) Act of 2008,” a bill strongly supported by SIIA that provides law enforcement agencies and prosecutors with increased funding and resources to pursue cases of criminal copyright infringement.

Source: Software & Information Industry Association

Tags: , , , ,