Based on last year's threats and exploits, here are some brief information security predictions for 2009. But remember, many of the new threats we will face in the near and distant future will look similar to the ones we have faced in the past.
Wireless risks continue
There are so many ways to attack a client system via wireless vulnerabilities, as you can see just by looking at Karma [6], a set of tools for assessing the security of wireless clients, and karmetasploit [7], a tool that acts as a wireless access point and responds to all probe requests from wireless clients.
I believe that many organizations are about five years behind the curve when grappling with Wi-Fi threat vectors. The concept of wire-side attacks is becoming well known in many management circles, but it has taken some time. While wireless has been around for a while, the core of many wireless security policies is simply to not use the inherently insecure WEP protocol. Unfortunately, there needs to be a greater focus on other vulnerable protocols and the variety of other wireless attacks. For example, traditionally we have viewed our risks in terms of a network perimeter. As we extend our networks with wireless connectivity, vendors implement new protocols and authentication schemes like TKIP, LEAP and PEAP in different ways. We need to fully research the protocols used by our vendors before implementing them in our organizations.
Return of operating system attacks
While operating system attacks have not reached the effectiveness and prominence they had from 2003-2005, malicious hackers will most likely discover operating system vulnerabilities again. There has been a tremendous amount of research over the past few years in browser-based attacks like cross-site scripting (XSS) [8], cross-site request forgery (XSRF) [9] and clickjacking [10]. But what if these techniques were used in conjunction with an operating system vulnerability?
I believe we will begin to see more hybrid threats that target weaknesses in Web servers and browsers while also damaging the OS. If attackers can compromise one machine, they can utilize OS attacks against additional internal systems, allowing malicious hackers to greatly extend the damage of their tactics. Because of this convergence, we'll need to start identifying possible security blind spots, like the applications installed on our desktops. We'll also need to develop mechanisms to identify vulnerabilities in applications beyond our servers and operating systems.
More strain on antivirus products
The release of Metasploit 3.2 is a watershed event. With the security exploit platform's capability to dynamically encode malicious payloads, it's now possible for novice attackers to bypass an enterprise's antivirus software. Using a few simple commands, a hacker can generate a piece of malicious software that will bypass most (if not all) of the current signature-based antivirus products.
This trend has been a long time in the making however, I think 2009 will bring attacks using these techniques in targeted situations. Employing Metasploit to create part of a worm or a botnet will provide limited utility, as the AV vendors will be quick to release a new signature. However, if one organization is targeted for a specific goal -- think Department of Defense, credit card companies or organizations possessing health information -- the damage can be inflicted quickly. Without the need for a long-term, persistent attack, a hacker can use Metasploit to get in, get what he or she wants and get out.
As an alternative, many organizations will look into security products that also include application heuristics, which flag malware based on recognition of improper behavior rather than a signature, as well as application whitelisting [11] techniques.
More limitation on users' Web surfing
When many organizations look at their main vectors of compromise, one thing is going to stand out above all others: corporate user Web surfing. Why exactly do many companies allow their users to surf the Internet? I understand that some organizations need their users to be able to do research, but many enterprises allow this activity because they want their environment to be a 'fun place to work.' At some point, every company needs to weigh the benefits of letting their users surf the net versus the risk of attack through that vector.
Almost all of the compromises I help my customers with today are the result of an internal user surfing to a site that is hosting malware. Currently, this is the easiest way for attackers to bypass all of the shiny IDS/IPS/NAC/AV technology that organizations implement.
Even if your organization needs to allow a certain portion of their users to access the Internet, stronger approaches exist that can be utilized. For example, you could isolate those systems from the rest of your network via a segmented VLAN.
Training budget bathtub
Training budgets are going to get cut in 2009. There is no question about that. However, I believe that many organizations are going to reduce security resources as more of a kneejerk reaction to overall reductions in revenue and budgets. Information security is not something that is stagnant. The threats are constantly evolving, and an organization's security staff must evolve with it.
By cutting their security training budgets, some organizations will fall behind. I believe, however, that we are going to see an upswing in training budgets for security in the second half of the year as organizations begin to realize the seriousness of emerging threats. Because of the dynamic nature of our profession, there is a constant need for training to stay current on the newest attack vectors and, more importantly, defenses.
Fewer vendors saying 'Hack Proof'
Finally, this is just a small request. Lately I have seen an increasing number of vendors using this phrase again. I have some simple advice for vendors who are planning on using this phrase to market their products: don't do it. You're only daring malicious hackers to try to compromise your product, and with enough time and effort, ultimately anything can be compromised. This is why a defense-in-depth approach that does not rely on any one product or method is so critical for enterprises. To that end, enterprises should always be wary of any product marketing slogans that seem too good to be true, because they probably are.
About the author:
John Strand currently is a Senior Security Researcher with Black Hills Information Security, and a consultant with Argotek, Inc for TS/SCI programs. He teaches the SANS 504 'Hacker Techniques, Exploits and Incident Handling,' 517 'Cutting Edge Hacking Techniques,' and 560 'Network Penetration Testing' classes as a Certified SANS Instructor. Strand also answers your questions on information security threats [12].
Future security threats: Enterprise attacks of 2009
