About
"Distrust and caution are the parents of security" - Benjamin Franklin
The nation-state sponsored malware arms race is on. Stuxnet may have been the “Shot heard round the world” but we think its likely that 2012 will witness a number of other skirmishes, with malware linked to foreign governments hostile to (or allied with) U.S.
Adoption of Google’s Android operating system is accelerating faster than a run-away train. That’s good news for Google, which always saw Android as a potential iPhone killer. But the events of the past year also make it clear that the company will be forced to deal head on with a dirty little secret: both the Android operating system and the Android Marketplace have become the preferred platform for malicious software authors interested in compromising mobile devices.
Counterfeit and “certified pre-owned” hardware is nothing new, but we think 2012 will see this issue morph from a sideshow in the cyber security world to center stage, with new revelations about contamination of the global supply chain by hardware and software components of dubious origin and possibly malicious intent.
User backlash against Facebook’s ever-evolving but always overreaching data privacy plans is almost as old as the site itself. But there’s good reason to believe that 2012 will mark a turning point for the fast growing social network. For one thing, Facebook is on track for an IPO (initial public offering), possibly before the end of 2011. Valuations for the 800 million person social network range as high as $100 billion in private markets. With an IPO looming, Facebook is under more pressure than ever to generate outsized revenue from its massive, 800 million strong user base.
The past year saw the emergence of a series of cleverly named hacking groups like Anonymous, LulzSec, and TeaMp0isoN. In 2011, these groups brought the fight to corporate America, crippling firms both small (HBGary Federal) and large (Sony). As the year drew to a close these groups noticeably shifted from prank-oriented hacks for laughs (or “lulz”), aligning themselves with political movements like Occupy Wall Street and using their skills to lend material and virtual support to the protests in various cities.
Stuxnet and the specter of sophisticated, state-sponsored attacks were still dominating the news a year ago, as 2010 ended and we welcomed the New Year. Soon enough, however, there would be a new phenomenon to contend with: hacktivists. As the attack on HBGary Federal and Sony showed, faceless online activists or anarchists can do plenty of damage to even sophisticated and well protected firms.
Pity poor Iran. They can’t catch a break. After cleaning up the mess Stuxnet wreaked on their nuclear ambitions, the Middle Eastern country admitted in November that a number of machines across multiple industries were infected with Duqu. While academic arguments raged over whether similarities in source code proved Duqu was the spawn of Stuxnet, researchers digging around under the worm’s hood discovered some interesting and unique characteristics.
Admit it. It would scarcely break your heart if the legions of slack-jawed smartphone Facebook and FourSquare gawkers were forced to confront their own digital mortality – however briefly – with a few scary exploits made just for them. In 2011, the untethered among us saw several mobile security challenges to be concerned about. High on the mobile hackers’ hit list is Android, the market-leading smartphone OS.
Few things sent shockwaves to all corners of the security community like news in March that RSA’s popular SecurID two-factor authentication tokens had been rendered all but useless by a small but cleverly targeted phishing campaign that included a payload of a malicious Flash object embedded in an Excel file.
Not even a techno-religion is immune from security snafus, as the folks at Apple are steadily discovering. After years of watching the bad guys use crimeware kits like Zeus against Microsoft, the iGang finally got a malware construction tool to call its own in May of this year.
Infosec Insider content is written by a trusted community of Threatpost cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
Sponsored Content is paid for by an advertiser. Sponsored content is written and edited by members of our sponsor community. This content creates an opportunity for a sponsor to provide insight and commentary from their point-of-view directly to the Threatpost audience. The Threatpost editorial team does not participate in the writing or editing of Sponsored Content.
