Top Security Threats for 2007

AUCKLAND -- The days of big virus outbreaks like MyDoom, Melissa and SQL Slammer are gone, says Joe Telafici, director of operations for McAfee's Avert Labs.

Today's cyber criminals don't want to draw attention to themselves, as the main motivation for cybercrime now is money, not fame, he said, speaking at the recent Association of Antivirus Asia Researchers conference here.

They are "clearly getting more devious," he said, but law enforcement cooperation across borders is also getting more efficient.

Telafici's team of around 100 security experts in 16 countries builds McAfee's security content. But they also educate and cooperate with law enforcement.

Predictions: Video Worms, ID Theft

McAfee Avert Labs has made ten security threat predictions for 2007. They are:

• The use of bots, computer programs that perform automated tasks, will increase. Botnetworks will also increase, but there will be a move away from internet relay chat (IRC) towards less obtrusive instant messaging and peer-to-peer communication, said Telafici.
• The number of rootkits on 32-bit platforms will increase, but protection and remediation capabilities will increase too. Telafici said that rootkits are becoming a de facto standard in malicious programs and that they will increase over the next couple of years.
• Vulnerabilities will continue to cause concern, fuelled by the underground market for them. McAfee Avert Labs expects the number of vulnerabilities will grow because of the increased use of fuzzers--automated tools and technologies that allow for large-scale testing of applications--and "bounty programs" that reward researchers for finding vulnerabilities. McAfee is not involved in any such initiatives, said Telafici.
• This year, Microsoft has already announced 140 vulnerabilities, compared with 62 in 2004 and 2005 combined, said McAfee. Also, zero-day attacks are being released soon after "Patch Tuesday" to get the most out of the vulnerability's window of opportunity, said the company.
• Identity theft and data loss will continue to be issues. Computer theft, loss of backups and compromised information systems are at the result of these crimes. According to the U.S. Federal Trade Commission, 10 million Americans are victims of identity fraud each year, said Telafici.
• The number of password-stealing websites will increase, using fake sign-in pages for popular online services such as eBay.
• The volume of spam, particularly bandwidth-eating image spam, will continue to increase.
• The popularity of video-sharing on the Web makes it inevitable that hackers will target MPEG files as a way of distributing malicious code.
• Mobile phone attacks will become more prevalent as mobile devices become "smarter" and more connected.
• Adware will go mainstream, following the increase in commercial Potentially Unwanted Programs.
• Parasitic malware that modifies existing files on a disk will make a comeback.