After last year’s struggle with network-clogging malware such as Mydoom and Netsky, IT departments should expect no respite from viruses and worms in 2005, a recent IBM Corp. report suggests. And in the ongoing war against malware, mobile devices are the “new frontier” for viruses, spam and other potential security threats, according to the 2004 IBM Global Business Security Index report.
E-mail-based worms and viruses were in full force on corporate networks in 2004, the report said. Specifically, IBM reports that 6.1 per cent of scanned e-mail in 2004 contained malware, up from three per cent in 2003. In 2002, this number was 0.5 per cent. The Mydoom, Netsky and Bagle e-mail worms topped the list in the number of variants and overall impact on IT security, the report found.
But towards the end of 2004, malware — such as the Cabir worm — increasingly targeted cellular phones and PDAs, IBM said, and warned it’s possible such worms could be used as templates to spur “an epidemic of viruses aimed at mobile devices.” Embedded computers, such as those found in automobile and satellite communication systems, could also be at risk. When it comes to malware, malicious software writers are not only getting smarter, they’re employing basic software development practices to spread destructive software, IBM said.
Virus writers are also targeting smartphones, including handsets running the Symbian and Windows mobile operating systems. According to the Finnish antivirus company F-Secure Corp., last month a Brazilian virus writer unleashed a “proof-of-concept” mobile phone virus — a virus designed to prove infection was possible rather than to actually cause damage to phones — called Lasco.A that is capable of spreading both through Bluetooth technology and by attaching itself to files.
Bluetooth and other wireless technologies that connect mobile devices present new exposures for hackers to target, said Michael Small, national practice executive for security, identity and privacy with IBM Canada. While Small acknowledges that traditional desktop malware will continue to dominate and burden network traffic 2005, he expects this year also to continue a trend of more targeted attacks to mobile devices. Currently, there are enough mobile devices out there to at least warrant concern, Small said.
The current level of security risk depends on the particular makeup of an enterprises’ IT environment, Small said. But as these threats grow, Small said, enterprises can prepare by looking at their aggregate data. Business intelligence (BI) tools can be used to examine this data and determine where the major security threats lie. “Start your trending analysis looking at the various threats and exposures that you have in the environment,” Small said. The IBM report is based on data collected by 2,700 information security professionals worldwide and from 500,000 monitored devices.
Other IT security predictions for 2005 by IBM include:
• Instant messaging platforms will likely be targeted by botnets — computers infected by worms or Trojans and taken over by hackers — for command and control of systems.
• This year will continue to see the rise of “phishing” attacks that use fake Web sites to deceive recipients into divulging personal information. There will also likely be an increase in the disruption of VoIP networks, particularly in denial of service attacks. 055599