Peter Suciu for redOrbit.com — Your Universe Online
Every cloud may have a silver lining the saying goes, but there will likely be no such silver lining for the future of cloud computing, which tops the list of serious computer security threats for 2013. On Wednesday, the Georgia Tech Information Security Center (GTISC) and the Georgia Tech Research Institute (GTRI) released the Georgia Tech Emerging Cyber Threats Report for 2013 at the Georgia Tech Cyber Security Summit, a gathering of industry and academic leaders in the field of cyber security.
According to the findings of the report, there are several specific threats to follow over the next year. Among the most ominous is the use of cloud computing for malicious purposes. As this emerging technology offers flexible provisioning capabilities that allow legitimate businesses to quickly add or subtract computing power, it could also be used to instantly create a powerful network of so-called zombie machines for use in nefarious purposes.
“If I’m a bad guy, and I have a zero-day exploit and the cloud provider is not up on their toes in terms of patching, the ability to exploit such a big capacity means I can do all sorts of things,” said Yousef Khalidi, of the Microsoft Windows Azure team in the report.
The cloud also opens the possibility for cloud-based botnets, which could provide a way to create vast, virtual computing resources. This could actually convince the cyber criminal to look for other ways to co-opt cloud-based infrastructure, such as using cloud computing resources to create clusters of temporary virtual attack systems.
Other worrisome trends for 2013 include dangers with globalized supply chains, search poisoning, mobile threats including browser and wallet vulnerabilities, and malware counteroffensive.
George Tech researchers noted serious security problems with globalized supply chains, including security flaws in products manufactured by some Chinese companies, notably Huawei and ZTE. The concern is that these systems could offer built-in backdoors for cyber espionage and make those systems vulnerable to compromise. And it isn´t just American companies that could be at risk — or believe that there is a risk. According to the report, the Chinese have the same concerns about U.S.-made products.
Cyber criminals may also continue to look at ways to manipulate search engine algorithms and other automated mechanisms that control how and information is presented to Internet users during a search. This threat, known as search history poisoning, could move beyond typical search engine results as researchers fear that cyber criminals may look to find ways to manipulate the histories of search results from users and use legitimate resources for illegitimate gains.
This threat could be especially worrisome when coupled with cloud-based data. If an individual machine is compromised a user is generally “safe” when moving to a “clean” machine, but if the user´s search history and online profile are compromised then the malicious search follows the user to any machine!
And these threats could increasingly make a jump from the desktop to mobile in 2013. The good news, according to the findings in the report, is that the threat is not as serious as previously thought. The app store model through which most mobile software is distributed remains a fairly stalwart first line of defense against the bulk of smartphone-based malware. However, researchers noted that aggressive patching policies and updates from the OEMs and carriers would only increase the security of the devices.
The bigger threat in mobile devices will come from the explosive proliferation of devices that will only serve to tempt attackers. The biggest threat thus won´t be in apps, but could be through the mobile web and increased use of the mobile wallet.
The final notable concern noted in the report was malware counteroffensive techniques as the developers of malicious software work to employ various methods hinder malware detection. This includes efforts to harden their software with techniques similar to those already employed in Digital Rights Management (DRM), as well as looking for exploits in new interfaces and features on mobile devices.
If this sounds bleak there is hope besides simply unplugging and giving up on technology. The key is knowing the threats exist, which is the goal of such reports in the first place.
“Every year, security researchers and experts see new evolutions in cyber threats to people, businesses and governments,” said Wenke Lee, director of GTISC. “In 2013, we expect the continued movement of business and consumer data onto mobile devices and into the cloud will lure cyber criminals into attacking these relatively secure, but extremely tempting, technology platforms. Along with growing security vulnerabilities within our national supply chain and healthcare industry, the security community must remain proactive, and users must maintain vigilance, over the year ahead.”
Comments