Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

For Hackers, 2011 Looks Like A Prosperous New Year

If you're an attacker, the new year is a target-rich environment. Here are five areas where you should shore up your defenses

In life, it's said, there are a few things that are certain. April will bring the tax bill; July will bring the fireworks; September will bring the school bus. And if you're an editor at an IT security publication, there's one more: December will bring cyberthreat predictions for the new year.

Each year, we at Dark Reading are inundated by dozens of predictions from security vendors, researchers, and analysts, all of whom hope to be the first to warn enterprises about the attacks and exploits they should expect in the coming months. And each year, we're compelled to share some of those predictions with you, dear reader. We don't wanna do it. But it's the law.

And so, we present -- kicking and screaming -- five threat trends you should beware of in 2011. Read it carefully and nobody gets hurt.

1. Social networks will be a chief target for new exploits.
"With the growth of social networks, banks are getting on the bandwagon and using these networks to cater to their customers," says Internet Identity (IID), an Internet security firm, in its predictions blog. "But beware: there will be fakes that will utilize social networking sites like Twitter and Facebook to try to infect victims with malware and trick people into giving up their vital personal information like bank logins and social security numbers."

"As the use of social media web sites continues to grow, drive-by-downloads and rogue anti-virus will be used more aggressively on platforms such as Facebook and Twitter," says Dasient, a security service provider that specializes in malware defense. "This is evidenced by threats such as the Koobface botnet that continually targets Facebook, as well as the September XSS attack that targeted Twitter and redirected users to porn and malware sites."

2. When they aren't targeting social networks, the bad guys will be after your mobile device.
"While most hackers heavily focused on Nokia's mobile phones [in 2010], mobile malware will increasingly target non-Nokia devices including Apple, Blackberry, Android, and Microsoft," says a report from ICSA Labs, which does certification testing for security products. "Mobile malware -- which is currently very localized to Russia, where premium SMS is available -- will start becoming more prevalent in other regions as well. Additionally, malware will increasingly target mobile devices, such as smart phones, iPads, and other tablets with built-in Wi-Fi."

"The arrival of consumer devices in the corporate network environment is changing the way we think about security the corporate backbone," says Adam Powers, CTO of Lancope, whose technology identifies security problems by analyzing network behavior. "Perimeter-based defenses, such as firewalls and IPS, aren't enough anymore. Corporations must think about how they will deal withsmart phones, WiFi devices, and other consumer-oriented mobile devices."

3. Malware will become more complex, combining multiple exploits and attack techniques.
"One of the most threatening advances in malware during 2010 broadened the range of targets beyond PCs and servers when the Stuxnet Trojan attacked programmable logic controllers," says security vendor Symantec in its 2011 predictions blog. "This specialized malware written to exploit physical infrastructures will continue in 2011, driven by the huge sums of money available to criminal enterprises at low risk of prosecution. These attacks will range from the obvious targets like smartphones to any number of less obvious, yet critical systems like power grid controls or electronic voting systems. Any technology that can be exploited for financial gain."

"Stuxnet clones will be rampant in 2011, but the real threats will be far more dangerous and sophisticated," says Toney Jennings, president and CEO of CoreTrace, a maker of application whitelisting tools. "Stuxnet was too public, too easily discovered, and reverse-engineered. From my days in the trenches at the Air Force Information Warfare Center, I feel it in my bones that Stuxnet was a 'grenade,' and that there are digital bombs out there that are far more powerful and dangerous."

NEXT: Predictions 4 & 5 Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
Cyberattacks Are Tailored to Employees ... Why Isn't Security Training?
Tim Sadler, CEO and co-founder of Tessian,  6/17/2021
Edge-DRsplash-10-edge-articles
7 Powerful Cybersecurity Skills the Energy Sector Needs Most
Pam Baker, Contributing Writer,  6/22/2021
News
Microsoft Disrupts Large-Scale BEC Campaign Across Web Services
Kelly Sheridan, Staff Editor, Dark Reading,  6/15/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-32716
PUBLISHED: 2021-06-24
Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 the admin api has exposed some internal hidden fields when an association has been loaded with a to many reference. Users are recommend to update to version 6.4.1.1. You can get the update to 6.4.1.1 regularly via the Auto-U...
CVE-2021-32717
PUBLISHED: 2021-06-24
Shopware is an open source eCommerce platform. In versions prior to 6.4.1.1 private files publicly accessible with Cloud Storage providers when the hashed URL is known. Users are recommend to first change their configuration to set the correct visibility according to the documentation. The visibilit...
CVE-2021-32712
PUBLISHED: 2021-06-24
Shopware is an open source eCommerce platform. Versions prior to 5.6.10 are vulnerable to system information leakage in error handling. Users are recommend to update to version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview.
CVE-2021-32713
PUBLISHED: 2021-06-24
Shopware is an open source eCommerce platform. Versions prior to 5.6.10 suffer from an authenticated stored XSS in administration vulnerability. Users are recommend to update to the version 5.6.10. You can get the update to 5.6.10 regularly via the Auto-Updater or directly via the download overview.
CVE-2021-32710
PUBLISHED: 2021-06-24
Shopware is an open source eCommerce platform. Potential session hijacking of store customers in versions below 6.3.5.2. We recommend to update to the current version 6.3.5.2. You can get the update to 6.3.5.2 regularly via the Auto-Updater or directly via the download overview. For older versions o...