Mobile malware, hacking-as-a-service, and large-scale cyber-attacks will dominate the IT threat environment in 2013, according to a new set of predictions from IT security company McAfee. “Cybercriminals and hacktivists will strengthen and evolve the techniques and tools they use to assault our privacy, bank accounts, mobile devices, businesses, organizations and homes,” Vincent Weafer, senior vice president of McAfee Labs, wrote in a statement accompanying the predictions. McAfee believes that cyber-criminals will increasingly rely on “ransomware” that locks a smartphone or tablet until a ransom is paid; in the same mobile arena, it also views the Android/Marketpay.A Trojan horse program, which purchases apps without a user’s permission, as a particular threat. “In 2013 cyber-crooks will take this malware’s app-buying payload and add it to a mobile worm so attackers won’t need victims to install a piece of malware,” the company added in its note. “In addition, mobile phones with NFC-enabled “digital wallets” are an easy target for cyber-thieves.” Other threats include Citadel, a Trojan that can “dynamically retrieve configuration files,” enabling the attacker to send targeted payloads. McAfee also predicts an increase in hacking-as-a-service, or attackers renting out their services to the highest bidders. It expects that attacks by “hacktivist” collective Anonymous will slow down somewhat over the next year, although “big scale” attacks will likely increase. Faced by rising threats in the mobile arena, developers could do well to cross their ‘t’s and dot their ‘i’s when it comes to built-in app security. Developers should follow best practices for authentication (including making sure that tokens expire within an hour or less, for apps that require logins), follow secure programming practices (such as making sure network data is sanitized before displaying it to the user), and make sure their SDK supports solid data-transfer security. For organizations with a need to keep massive amounts of data secure, data-analytics tools can assist in scanning IT infrastructure for threats. That means deploying tools capable of capturing time-sensitive information on the infrastructure’s overall state, including log data, and instituting policies that govern how data is protected when stored and in use. Meanwhile, IT vendors large and small offer a variety of security tools. In the end, though, true protection comes down to vigilance on the end-user’s part. Image: Jirsak/Shutterstock.com Mobile Malware, Big Attacks Top Security Concerns in 2013
Mobile malware, hacking-as-a-service, and large-scale cyber-attacks will dominate the IT threat environment in 2013, according to a new set of predictions from IT security company McAfee. “Cybercriminals and hacktivists will strengthen and evolve the techniques and tools they use to assault our privacy, bank accounts, mobile devices, businesses, organizations and homes,” Vincent Weafer, senior vice president of McAfee Labs, wrote in a statement accompanying the predictions. McAfee believes that cyber-criminals will increasingly rely on “ransomware” that locks a smartphone or tablet until a ransom is paid; in the same mobile arena, it also views the Android/Marketpay.A Trojan horse program, which purchases apps without a user’s permission, as a particular threat. “In 2013 cyber-crooks will take this malware’s app-buying payload and add it to a mobile worm so attackers won’t need victims to install a piece of malware,” the company added in its note. “In addition, mobile phones with NFC-enabled “digital wallets” are an easy target for cyber-thieves.” Other threats include Citadel, a Trojan that can “dynamically retrieve configuration files,” enabling the attacker to send targeted payloads. McAfee also predicts an increase in hacking-as-a-service, or attackers renting out their services to the highest bidders. It expects that attacks by “hacktivist” collective Anonymous will slow down somewhat over the next year, although “big scale” attacks will likely increase. Faced by rising threats in the mobile arena, developers could do well to cross their ‘t’s and dot their ‘i’s when it comes to built-in app security. Developers should follow best practices for authentication (including making sure that tokens expire within an hour or less, for apps that require logins), follow secure programming practices (such as making sure network data is sanitized before displaying it to the user), and make sure their SDK supports solid data-transfer security. For organizations with a need to keep massive amounts of data secure, data-analytics tools can assist in scanning IT infrastructure for threats. That means deploying tools capable of capturing time-sensitive information on the infrastructure’s overall state, including log data, and instituting policies that govern how data is protected when stored and in use. Meanwhile, IT vendors large and small offer a variety of security tools. In the end, though, true protection comes down to vigilance on the end-user’s part. Image: Jirsak/Shutterstock.com 
