At the beginning of each year I like to talk about what did or didn’t happen during the past year, and what to expect in the coming year. Unlike past years, I’ll try not to get too emotionally ramped up on all the failures.
First, the good news
Overall, compliance laws (and years of bad press) finally forced most organizations to encrypt more data and laptops by default. Chances are these days that if a thief steals a laptop it will be password protected and its data encrypted. More developers are utilizing SDL (secure design lifecycle) in their programming, taking into account from the beginning the malicious risks posed to and by their applications. Overall, exploits aren’t down significantly, but they are in the software where SDL is used. In addition, more organizations are using stronger password policies and two-factor authentication. The number of identity thefts has leveled out or even begun to drop. All of these trends are good.
Now, the bad news
Sadly, the overall computer security picture hasn’t changed much. The Internet is still a very dangerous place to compute. Malware, adware, and spam still make up a very large portion of Internet traffic. Professional criminals control millions of computers turning our futuristic superhighway into the wild, wild, west. Personally, nearly every PC I investigate is filled with worms, spyware, and adware. Antivirus software continues to be embarrassingly inaccurate against the newly created malware churned out each day. Distributed Denial of Service attacks still go on unabated and are very hard to defend against.
We still aren’t catching many criminals. Sure, there are headlines about a few people here and there getting arrested, but apparently those being caught aren’t making a dent in the real problem. It’s like the war on drugs in the United States: We’ve spent billions of dollars over three decades and drugs are still just as plentiful as when we began the war. In both cases we don’t seem to change course even though the current strategy isn’t working.
There were no promising wide-scope, technological advances in the computer security arena to give me hope that next year will be any better. There are no leaders or groups with significant power stepping up to lead us into a more secure future. The malware writers and criminals are all smiling into the new-year and sleeping well.
Predicting the future of malware is actually pretty easy. All you have to do is look at the increasing trends and figure out what technologies and platforms will be hot in the next year or so. Hackers hack what is hot.
If Apple computers gain market share as I’m sure they will do in 2008, then you can expect more Mac malware. Mac malware is showing up in greater numbers, and Apple already has its hands full patching and re-patching the Mac OS, Quicktime, and other related software. Apple patched more than 200 vulnerabilities in 2007. If history is a good judge of future behavior, then Apple will suffer through a few widespread exploits in 2008.
Windows Vista will continue to be attacked and exploited. In 2007, the number of publicly known exploits of Vista was down compared to those of XP (as predicted by many observers), but the numbers weren’t down significantly enough to make anyone feel like they could compute in relative safety. It will be nice if the number of Microsoft Office-related exploits goes down. 2006 and 2007 were banner years for Microsoft Office exploits. [Disclosure: I work full-time for Microsoft]. Because of SDL, I expect exploits in XP, Vista, and Office to go down in 2008.
Of course, no matter how secure an operating system is, most exploits will continue to rely on socially engineering users to install things they otherwise shouldn’t. As I covered in several previous columns, client-side attackers make up more than 90 percent of all malicious compromises. I don’t see that changing: User behavior is tough to alter. Last year I predicted a decrease in malware spread using e-mail vectors and an increase in exploits using Web sites. The only real surprise was the sheer number of completely innocent, commercial Web sites used to spread malware.
Application-side vulnerabilities will continue to grow. Quicktime, RealPlayer, Flash, and Windows Media Player all had significant exploits this year, and the numbers are still trending upward. Exploits will continue to target VoIP (Skype and the like) and social portals (YouTube, Facebook, Myspace, and others), as rootkit Trojans continue to grow in prevalence.
Will 2008 finally be the Year of the Massive Cell Phone Exploit? The popularity of the iPhone would almost dictate that it will be, but if that was the case I would have expected a major iPod exploit by now. Every year dozens of computer security prognosticators predict a cell phone virus will panic the world. But we’ve been predicting that since 1999 when a widespread Trojan hit Japan’s DoCoMo cell phone network. I’m not holding my breath. It will happen when cell phones become more popular than computers for online banking and commercial transactions. (And that will happen — I just don’t think it will be this year).
So, expect more of the same next year. I don’t see any paradigm shifts. Computer security vendors aren’t likely to make you significantly safer, and what the criminals are already doing is working quite well for them, so there’s no need for them to shift tactics.
Roger A. Grimes is contributing editor of the InfoWorld Test Center. He also writes the Security Adviser blog and the Security Adviser column.