syssec_red_book

22.4. Industrial Reportsrepresent the best information we can get to estimate what kind of problemswe will have to face in the short-term future.Therefore, we decided to complete this chapter on previous work on researchroadmaps by reviewing a number of industrial reports, looking forrecurrent patterns or common threats that we can reuse in our study. Inparticular, we covered the threat forecast published by Microsoft [377], Imperva[216], WebSense [393], McAfee [271], Symantec [367], Kaspersky [232],Bullguard [115], and by the Georgia Tech Information Security Center [193].22.4.2 Common Threats and RecommendationsNot surprisingly, most of the predictions for 2013 have several points incommon. In particular, these are the main areas on which experts from variouscompanies seem to agree:Mobile Malware. The emergence of mobile malware is one of the main concernwe observed in the industrial reports. However, if the area itself iscertainly the major threat on the landscape, the way in which it is goingto materialize in the short term can vary. For instance, some experts seean increase in exploitation of vulnerabilities that target the OS and onthe development of drive-by downloads; others think that malware willfocus on the payment capabilities of phones to either steal informationor to purchase applications developed by the attacker. Some companieseven forecast the appearance of the first mass worm for Android devices.Finally, a common point in many reports is the likely increase of mobileadware, e.g., software that sends pop-up alerts to the notification bar,adds new icons, or change some of the phone settings.Cloud-Based Malicious Activities. Attackers will leverage cloud infrastructurein general, and IAAS in particular, to perform a wide range ofmalicious activities. According to the experts, these can range fromsimple denial of service attacks (paid with stolen credit cards) to usingthe cloud to spread malware or to develop cloud-based botnets.Malware fighting back. An interesting point raised by several experts is thefear that malware writers will start adopting more sophisticated techniqueseither to hinder the analysis and detection, or to make theircommand and control infrastructures more resilient. For instance, itis expected an increase in the adoption of techniques to detect virtualmachines and in protection methods similar to those employed in DigitalRights Management (DRM) systems. Rootkits will also diversify, and willadopt new persistence mechanisms and bootkit techniques. McAfee alsothinks that botnets will become harder to take down because malware135