Attacks in 2013 are set to become more sophisticated and stealthy, as hackers leverage the loopholes of HTML5 with the standard gaining traction, and cybercriminals become more organized with the rise in underground forums.
In addition, embedded devices will also become a greater target to bring down industrial systems more easily, and malware becomes designed to avoid detection by security researchers. Social engineering too, will become less conventional with attackers gathering information through the Internet and social media, and targeting not only users but gatekeepers.
Here are some IT security trends set to take center stage this year:
HTML5 new threat frontier
According to McAfee's 2013 Threats Prediction report released Monday, 74 percent of users in North America, 72 percent in Asia and 83 percent in Europe use browsers supporting HTML5 features today.
With strong adoption of HTML5, there will be a reduction in exploits focused on plug-ins and more focus on finding security holes in HTML5, the report said.
"In 2013, we will see browsers expand on HTML5 features and improve HTML5 compatibility. HTML5-based applications and websites will continue to grow," McAfee said in the report. "We’re certain that attackers will turn their attention to finding holes in HTML5 security in 2013."
Even with the increasing amount of attention paid to HTML5 security, its newness mean developers are bound to make mistakes when they use it and attackers will look to take advantage, Rajlingam Sokalingam, Check Point's regional director, said.
Hacking-as-a-service to be more anonymous
For many years, cybercriminals have attended public forums to discuss and make business deals with other criminals, offering software and other services for sale, McAfee noted in their report.
However, highly professional cybercrooks saw these forums as "a waste for time" since they were full of "newbies". It also led to a loss of confidentiality as each deal needs direct contact with the client who could be an undercover cop, as well as a loss of money, as the purchaser attempted to negotiate lower prices. For these reasons, the number of invite-only criminal forums requiring registration fees or guarantors has increased, the report explained.
In order to improve anonymity without discouraging buyers, online sales sites modeled on legal trade activities will grow in 2013. On such sites, buyers will make their choices through clicking, use an anonymous online payment method and receive their purchases without negotiations or direct contact with their sellers.
Embedded devices to be common target
Attacks against embedded devices will be more frequent and professional, David Maman, CTO and founder of security firm GreenSQL, observed. This includes air-conditioning management systems, lightning management systems, printers, game consoles and SCADA industrial control systems.
Over the past two years, the borders were breached regarding attacks of embedded devices had been transcended, Maman observed.
The best example is when Stuxnet emerged, aiming to attack a specific version of Siemens industrial software and hardware, with variations such as Flame emerging, he pointed out.
Rise of precision targeted malware
Attackers are learning faster how to avoid detection by studying the steps researchers take in analyzing malware, Sokalingam said. This will give rise to more hackers designing malware that can render analysis ineffective and unable to perform correctly in any environment other than the one it originally targets, he observed.
Examples of these attacks include Flashback and Gauss, who have both been effective at stopping researchers from automated malware analysis, he pointed out.
"In 2013, attackers will continue to improve and implement these techniques and make their malware more dedicated so it only attacks computers with a specific configuration," Sokalingam said.
Rise of social engineering with more advanced techniques
Social engineering is a "tried-and-true blackhat tactic" in both the physical and digital world, Sokalingam said.
In 2013, attackers will increase their use of social engineering over social networks, and go beyond calling targeted victims and try to trick them into giving up information, Sokalingam explained.
After all, social networks are about connecting people, and a convincing-looking profile of a company or person followed by a friend or connection request can be enough to get a social engineering scam rolling," he said.
In August last year, former Gizmodo writer Mat Honan discovered his Google, Twitter and iCloud account were breached within an hour and found out the hacker targeted Apple's tech support using "clever" social engineering. The hackers had called the Apple Support team, pretending to be Mat with identification information, in order to bypass the security questions and gain access to his accounts.
Observers also told ZDNet social engineering was becoming more sophisticated and difficult to spot, and now targets not only users but also IT administrators and call centers.