The list is a comprehensive set of bogeymen to keep IT personnel up at night. However, a core portion of what 2013 holds is oriented around cyber-espionage and cyber-offensives, demonstrating that a connected world is leading to the cyber-landscape becoming a very serious playing field for governments, activists and corporations alike.
Topping the list of 2013 threats is the rise of targeting. The scattershot approach of unleashing a malware threat and seeing where the chips may fall as it goes viral is still the main way that cybercriminals deploy their schemes, but Kaspersky noted that targeted attacks have become an established feature in the last two years. These, which include cyber-espionage efforts – are meant to gather specific information from a specific organization (or nation-state, as the case may be). All organizations hold data that is of value to cybercriminals, Kaspersky warns, and they may also be used as ‘stepping-stones’ to reach other companies.
While such attacks are often highly sophisticated, many attacks “start by ‘hacking the human’, i.e. by tricking employees into disclosing information that can be used to gain access to corporate resources,” Kaspersky points out. “The huge volume of information shared online and the growing use of social media in business has helped to fuel such attacks – and staff with public-facing roles (for example, those with sales or marketing roles within a company) can be particularly vulnerable.”
Also on the list is a related phenomenon: state-sponsored cyber-attacks. Stuxnet pioneered the use of highly sophisticated malware for targeted attacks on key production facilities, in that case on Iran’s nuclear centrifuges. However, Stuxnet wasn’t an isolated incident.
“We are now entering an era of cold ‘cyber-war’, where nations have the ability to fight each other unconstrained by the limitations of conventional real-world warfare,” noted Kaspersky. “Looking ahead we can expect more countries to develop cyber weapons – designed to steal information or sabotage systems – not least because the entry-level for developing such weapons is much lower than is the case with real-world weapons.”
On a related note, expect to see continuing hacktivism next year as groups like Anonymous and LulzSec continue to attack websites in order to make a political or social point.
“Stealing money – either by directly accessing bank accounts or by stealing confidential data – is not the only motive behind attacks,” noted researchers. “Society’s increasing reliance on the Internet makes organizations of all kinds potentially vulnerable to attacks of this sort, so ‘hacktivism’ looks set to continue into 2013 and beyond.”
Meanwhile, as governments get on board with cyber-tools and cyber-weapons, law enforcement is getting connected as well. “In recent years, cybercrime has become more and more sophisticated. This has not only created new challenges for anti-malware researchers, but also for law enforcement agencies around the world,” Kaspersky noted. “Their efforts to keep pace with the advanced technologies being used by cybercriminals are driving them in directions that have obvious implications for law enforcement itself.”
That includes using technology to monitor the activities of those suspected of criminal activities. Using legal surveillance tools can be a boon to police and others, but also sparks debate about the scope of their use.
“Clearly, the use of legal surveillance tools has wider implications for privacy and civil liberties,” said Kaspersky. “And as law enforcement agencies, and governments, try to get one step ahead of the criminals, it’s likely that the use of such tools – and the debate surrounding their use – will continue.”