Fortinet’s FortiGuard Labs highlights five threats to watch out for next year:
1. Android malware expands to industrial control systems and the IoT
As sales of mobile phones likely plateau in the coming years, Android developers are being tasked to find untapped markets for the Google operating system. A few of these emerging markets include tablets, portable game consoles, wearable devices, home automation equipment and industrial control systems (ICS/SCADA).
Next year, we predict we’ll see the first instances of malware on these new device types, specifically around embedded ICS/SCADA systems. While we don't believe we'll see a "mobile-Stuxnet" in 2014, we think cybercriminals will be attracted to platforms that go beyond common SMS fraud.
This includes new home automation devices that have control over our electrical consumption, the temperature of our fridges, etc. and feature software with remote login control panels to show/confirm who may be at home at a given time. This is bound to give cybercriminals new and nefarious ideas around how and when to rob someone’s home.
2. New exploits target off-net devices to penetrate corporate resources
The increased maturity of desktop exploit and advanced mitigation tools in the enterprise, such as malware sandboxing and next-generation antivirus, makes penetrating corporate networks a substantive challenge. The increased difficulty hackers are having penetrating today’s enterprise firewalls, will force them to take more creative approaches into networks or devices that are traditionally not hardened compared to the corporate network. These soft targets can include home routers, smart televisions, home automation and/or set top box connections. We predict we’ll see the first generic exploitation frameworks and mass malware agents for these types of home devices later next year.
3. More botnets will cross breed with other botnets
Historically, botnets worked alone. In rare instances, when a botnet such as TDSL infected a computer, the first thing it did was to look for traces of other botnets running on the same PC and remove them, thus preventing the compromised computer from becoming too unstable. In time, rather than compete against other botnets, the trend we’re seeing is botnets actually joining forces with other botnets in order to better grow their bases of infected users. This year we’re seeing an uptick in this type of activity, with the Andromeda, Bublik, Dorkbot, Fareit, and ZeroAccess botnets doing just that.
4. Increase in attacks targeting Windows XP
Microsoft will end support for Windows XP on April 8, 2014. This means that newly discovered vulnerabilities will not be patched, leaving systems around the world vulnerable to attacks. According to NetMarketShare, as of September 2013, Windows XP is still used on 31.42% of PCs in the world. According to Gartner, by the time April 8 rolls around, it is estimated that more than 15% of mid- to large-sized enterprises will still have Windows XP running on at least 10 percent of their PCs.
Next year, we predict hackers, already in possession of zero day exploits, will wait until the 8th in order to sell them to the highest bidder. Because of their expected high price tag, these zero days will likely be used to launch targeted attacks against high-value businesses and individuals in order to propagate mass infections.
5. Biometrics for authentication will increase
This year Apple made a bold move when it announced its new iPhone 5s would integrate fingerprint authentication into the device. Never mind that it was hacked a few days after the phone shipped. It got people talking about the importance two-factor authentication in a world where the single factor password login is growing increasingly archaic.
As a result of this renewed interest, we predict next year we’ll see additional mobile companies including a second factor of authentication into their devices. We’ll also see an increase in additional forms of authentication, such as iris scanning and facial recognition.
MORE COVERAGE OF 2014 PREDICTIONS