What 2013 Portends
As we near the end of the year, it’s a good time to assess the evolving methods of attack employed by cybercriminals and the countermeasures aimed at limiting the effectiveness of their schemes. Websense Security labs told Business Standard that traditional tools used to thwart attacks will no longer get the job done because attackers’ techniques and targets are evolving. For instance, cybercriminals are already working out how to sidestep virtual machine defenses such as sandboxes. Advanced attacks, says Websense, will remain hidden until they are sure they aren’t in a virtual security environment. Furthermore, Websense told Business Standard, more computers and mobile devices will be vulnerable to malware because legitimate app stores such as Google Play and Apple’s App Store will unwittingly serve as dissemination points for malicious code designed to slip through the sites’ validation processes.
Even your TV set could put hackers hot on your trail. A Computerworld article quotes Eddy Willems, a security expert at G Data Software: “We think that cyber criminals are already using the freely available software development kits from the TV manufacturers to discover opportunities for [attacking Internet-connected smart TVs that let viewers do many of things they currently do on their home computers]. Just as worrisome, the security experts say, is the specter of more governments stepping into the cyberwarfare arena. The Business Standard article sums it up thusly: “While the effort to become another nuclear superpower may be insurmountable, almost any country can draft the talent and resources to craft cyber-weapons. Countries and individual cybercriminals all have access to the blueprints for previous state-sponsored attacks like Stuxnet, Flame and Shamoon.”
Subverting Smart Card Security
Smart cards are supposed to make online transactions much more secure. But according to Computerworld, a team of researchers from Luxembourg has demonstrated that malware can be installed on a Windows computer so that attackers can take remote control of a USB smart card reader attached to the infected machine. The malware—which they tested using the Belgium national electronic identity card—installs a special driver that lets the hacker manipulate the middleware provided by the smart card manufacturer. A hacker can then conduct “authenticated” transactions with the victim's card as if the reader was attached to the hacker’s own computer. The malware even has a keylogger component so it can steal PIN or password information associated with a smart card. The researchers say will present their proof-of-concept malware at the MalCon security conference in New Delhi, India, on 24 November.
Court’s Former Webmasters Charged With Stealing Database
On 14 November, two former IT workers at Alabama's Administrative Office of the Courts were indicted on charges that they stole the source code for a court-records database. The suspects, one of whom had been director of information systems for the courts, not only took the source code to the Namemaster database, but purloined hundreds of thousands of court records and turned them over to CyberBest Technology in Orlando, Fla. It remains to be seen whether CyberBest—which specializes in computer systems for the courts and police agencies—will face legal penalties, though it stood to benefit the most. The accused are being prosecuted in federal court, and could each serve 10 years in prison and be hit with a US $250 000 fine.
You Might Remain Silent, But Anything Your Computer Says Will Be Held Against You
A riveting and revealing Business Week article with the ongoing Syrian conflict as the backdrop provides ample evidence that governments see hard drives as important theaters in any battle. But think for a second: How does the story of Taymour Karim, a doctor who stood up to torture aimed at getting him to divulge the names of his compatriots who were also protesting the Syrian government, parallel what could happen (or already be happening) to you? Karim didn’t give up the info. But, says the Business Week article:
It didn’t matter. His computer had already told all. “They knew everything about me,” he says. “The people I talked to, the plans, the dates, the stories of other people, every movement, every word I said through Skype. They even knew the password of my Skype account.” At one point during the interrogation, Karim was presented with a stack of more than 1,000 pages of printouts, data from his Skype chats and files his torturers had downloaded remotely using a malicious computer program to penetrate his hard drive. “My computer was arrested before me,” he says.
Willie Jones is an associate editor at IEEE Spectrum. In addition to editing and planning daily coverage, he manages several of Spectrum's newsletters and contributes regularly to the monthly Big Picture section that appears in the print edition.
