Imperva predicts five key security trends to watch for over the next ten years.
1. The industrialisation of hacking
There is a clear definition of roles within the hacking community developing, forming a supply chain that starkly resembles that of drug cartels:
- Botnet growers / cultivators whose sole concern is maintaining and increasing botnet communities
- Attackers who purchase botnets for attacks aimed at extracting sensitive information (or other more specialized tasks)
- Cyber criminals who acquire sensitive information for the sole purpose of committing fraudulent transactions.
As with any industrialization process, automation is the key factor for success. Indeed we see more and more automated tools being used at all stages of the hacking process. Proactive search for potential victims relies today on search engine bots rather than random scanning of the network. Massive attack campaigns rely on zombies sending a predefined set of attack vectors to a list of designated victims. Attack coordination is done through servers that host a list of commands and targets.
SQL injection attacks, “Remote File Include” and other application level attacks, once considered the cutting edge techniques manually applied by attackers are now bundled into software tools available for download and use by the new breed of industrial hackers. Search engines (like Google) are becoming an increasingly vital piece in every attack campaign starting from the search for potential victims, the promotion of infected pages and even as a vehicle for launching the attack vectors themselves.
Organizations must realize that this growing trend leaves no web application out of reach. Attack campaigns are constantly launched not only against high profile applications but rather against any available target. An application may be attacked for the value of the information it stores or for the purpose of turning it into yet another attack platform. Protecting web applications using application level security solutions will become a must for larger and smaller organizations alike. End users who want to protect their own personal data and avoid becoming part of a botnet must learn to rely on automatic OS updates and anti-malware software.
2. A move from application to data security
The effectiveness of network layer attacks has decreased dramatically in this past decade largely due better network layer defenses. This gave raise to application level attacks such as SQL injection, Cross Site Scripting and Cross Site Request Forgery. As these are being gradually addressed by the use of web application firewalls, attackers will turn their attention to more sophisticated attacks either from the outside (business logic attacks) or from the inside (direct attacks against the database). Together with the fast growth in the number of applications that access enterprise data pools these will drive the evolution of data-centric security.
While organizations invest in protecting their major applications using application level tools, many of the smaller applications are still unprotected. Additionally, there’s no apparent decrease on the part of internal threats. Disgruntled employees, dubious individuals with internal network access and attackers who control (through Trojans) internal workstations all present a direct threat on enterprise data pools. It becomes apparent to organizations that controls must be put not only around applications accessing the data but also around the data itself. This holds true to data in its structured format within relational databases as well as unstructured data stored in files on organizational file servers.
To protect these vital assets, organizations must have a complete change of mindset focusing on protecting data at its source, regardless of the application accessing it, if necessary utilizing a combination of technologies such as a data based firewall, data and file activity monitoring and the next generation of DLP products.
3. Mainstream social networks and associated applications
Previously attracting student communities, the growing popularity of social networking sites, such as Facebook, Twitter and LinkedIn is fast infiltrating mainstream populations. As a consequence, large populations not previously exposed to online attackers can now be targeted by massive campaigns. Elderly people as well as younger children, people who did not grow up with an inherent distrust in web content may find it very difficult to distinguish between messages of true social nature and widespread attack campaigns. Attackers will also take advantage of the social networking information made accessible by social platforms to create more credible campaigns (e.g. make sure you get your phishing email from your grandchildren). The capabilities offered by the social platform and their growing outreach into other applications (webmail, online games) allow attacker to launch huge campaigns with a viral nature and at the same time pinpoint specific individuals.
Specific ads carrying attack vectors can be presented to named individuals at an attacker’s will. This in turn allows attackers to easily get their foothold inside specific organizations by targeting individuals within those organizations. Much like searching through the Google search engine for potentials target applications, attackers will scan social networks (using automated tools) for susceptible individuals, further increasing the effectiveness of their attack campaigns.
4. Password grabbing/password stealing attacks
Recent statistics show a surge in personal information leakage incidents as well as the compromise of huge amounts of credit card numbers. Leakage incidents were attributed to either media loss (or theft) or deliberate attacks such as SQL injection or sniffing on internal transaction processing networks.
As stolen personal information is increasingly available, the price it commands on the black market is falling, thereby forcing attackers to seek more profitable data. To this extent, the last few months has seen hackers target application credentials. Application credentials hold more value for certain types of attackers as they can be further used in automated schemes. While fraud schemes involving stolen personally identifiable information (PII) usually require manual procedures, an attack that makes use of valid credentials for an online banking system can be fully automated. Even when considering manually executed fraud, it is evident that having multiple sets of valid credentials for an online trading application makes it much more easier than having the personal data of account owners.
Of particular interest to attackers are credentials for webmail applications as these may further allow compromise of other credential sets through the password recovery feature of applications. This feature usually sends the credentials of an online application to an email account designated by the owner upon registration. Taking control of the email account (e.g. a Gmail mailbox) allows an attacker to collect owner credentials from a plethora of other applications. Worthy of mentioning is also the assumption that credentials used by a person for one application will serve that person on other applications as well. This assumption considers the human nature and the limited ability to remember multiple credentials. Thus, it is not uncommon for people to have the same username and password used for their Facebook account as well as their Twitter account and their Airline Frequent Flyer account.
Attackers use many different techniques for obtaining application credentials these include phishing campaigns, Trojans and keyloggers on the consumer side and SQL injection, directory traversal and sniffers on the application end. Earlier this year the media became aware of a partial list of Hotmail user credentials traded on the net. The list contained a few thousand records and was probably obtained through keyloggers.
5. Transition from reactive to proactive security
To date the security concept has been largely reactive – waiting for a vulnerability to be disclosed; creating a signature (or some other security rule) then cross referencing requests against these attack methods, regardless of their context in time or source. As a consequence a lot of resources are invested in distinguishing “bad” requests from “good” requests based on request content alone – a chore that is becoming more and more difficult due to advanced evasion techniques and sophisticated attack schemes. This in turn yields solutions that are forced to make difficult trade-offs between the rates of false detection and no detection.
Rather than waiting to be attacked, security teams must start to proactively look for attacker activity as it is being initialized over the network, identifying dangerous sources or malicious activity before it gets to attack a protected server and even establishing a defense against attacks before they become publicly disclosed by someone.
The online security community is in the early stages of digesting this information into actionable items. The future will reveal more offerings around IP reputation, early warning systems and other proactive tools. It will be at the hands of application owners and web application solution vendors to integrate with those tools to provide a proactive security suite for applications.