syssec_red_book

22.2. Emerging Issues per Area9. Identity Theft is perpetrated through the spread of advanced trojans thatperform information stealing, rather than phishing, which was morepopular in the past. Mobile platforms are the main repository of sensitiveinformation: Indeed, cybercriminals have ported information-stealingmalware to such platforms (e.g., Android ZeuS in the Mobile, or ZitMo).10. Abuse of Information Leakage is increasing, due to new technologiessuch as geo location and social advertising platforms (e.g., Foursquare),which create new venues for tracking users and compromising theirprivacy. Also aggressive advertising is abused to track users trough theinformation (e.g., “permanent” cookies) leaked by web browser.11. Rogue Certificates are being leveraged to break the chain of trust. Indeed,in the last two years, the offenders have been stealing (see 6. CompromisingConfidential Information), producing and circulating roguecertificates. As a result, the criminals managed to conduct large-scale,man-in-the-middle attacks with stolen certificates.There are threats which instead show a stable trend. Among them, denial ofservice, mostly used by hacktivists, is leaving traditional low-level protocols(e.g., UDP, ICMP, and SYN flood) in favor of application layer protocols (e.g.,HTTP, service APIs), where more targeted denial of service attacks can bedesigned. An exception is the IPv6 layer, which was also targeted. Phishinghas been stable (i.e., uptime of phishing sites dropped in first half of 2012),probably leaving the floor to more effective means such as information stealers(e.g., ZeuS or SpyEye), which can collect two-factor authentication credentials.However, cybercriminals are targeting VoIP systems via “vishing” (i.e., voicephishing) scams. Rogueware/scareware still be a problem, although the users aremore aware of these scams. Indeed, the report notices little technical evolutionin rogueware tools, although they are more widespread by leveraging thesame distribution channels used by regular malware (e.g., SEO poisoning).Noticeably, the first fake AV product that targets Macs appeared in 2011.Search engine poisoning is still one of the major methods used to drive users tomalware-distribution sites. SEO poisoning typically take advantage of eventsand trending topics to create campaigns that attract many victims.22.2 Emerging Issues per AreaThe report also presents a list of areas (i.e., assumed to grow), within whichthreat predictions are made from the current security issues.Mobile Computing is affected by cross-platform malware families (e.g., ZeuS,SpyEye), which impact is exacerbated by the widespread use of mobileplatforms for financial transactions. Unfortunately, the app stores arestill too immature to fight back.133