The past year in cybersecurity has been one of combating ransomware extortion attacks, bracing systems against DDoS attacks and securing internet of things (IoT) systems. Looking to next year, cybersecurity experts at McAfee Labs laid out their predictions for the industry's top concerns in 2018.
Among the top concerns for next year are hackers using machine learning to create an arms race of development, newer ways that hackers will target businesses with ransomware and potential exploits in serverless applications. Privacy is also a growing concern as consumer data collection through our devices shows no signs of slowing.
The McAfee Labs 2018 Threats Predictions Report explains five of the top cybercrime trends to be aware of and prepare for.
Adversarial machine learning
Machine learning has been put to use in dozens of industries, including cybersecurity, but cyber criminals are adapting it to automate the process of discovering exploits, responding to defenses and disrupting systems. While machine learning can help automate our defenses by checking defenses and using data to predict attacks, attackers will likely use it as a response, creating an arms war of machine versus machine.
Attackers can use machine learning for a number of purposes, such as machine-driven searches for vulnerabilities, more sophisticated and data-driven phishing attacks, and successfully using weak or stolen credentials over services and devices. Machine-driven attacks can scan for vulnerabilities much faster than humans, allowing them to exploit systems faster than they can be patched.
"We must recognize that although technologies like machine learning, deep learning and artificial intelligence will be cornerstones of tomorrow's cyber defenses, our adversaries are working just as furiously to implement and innovate around them," said Steve Grobman, senior vice president and chief technology officer for McAfee.
According to McAfee, machine learning is only as good as the humans who feed it data. Therefore, human and machine partnerships will be essential for combating cyber criminals and their machine learning techniques. It will be up to human defenders to work with machines to find vulnerabilities first and patch them.
Ransomware has already been a problem for businesses everywhere, costing them millions of dollars. According to McAfee, ransomware attacks have risen 56 percent over the last year; however, payments toward the extortions have declined. This can be attributed to more companies improving their data backups, decryption technology and overall awareness of the attacks.
Cyber criminals adapt and are changing their strategies with ransomware. Traditional ransomware is targeted toward computers and databases, blocking users with encryption and demanding a fee (usually in nondetectable cryptocurrency) to return access. Experts, however, see an even greater potential for damage as more of our devices become part of our networks in IoT systems.
While it may seem outlandish now, imagine hackers locking you out of your smart car and demanding a ransom before unlocking it. If hackers find ways to gain access to a company's devices that are essential to its productivity, analysts predict that the greater loss of profits due to these disruptions will prompt the attackers to go after higher-profile targets.
"The evolution of ransomware in 2017 should remind us of how aggressively a threat can reinvent itself as attackers dramatically innovate and adjust to the successful efforts of defenders," Grobman said.
McAfee predicts that individuals who are seen as high-value targets can expect threats to shut down their essential devices, such as expensive smartphones and smart home appliances like thermostats and vehicles. Wealthier targets are perceived by hackers as more likely to pay the ransom.
Another trend with ransomware are attacks that encrypt businesses' data and shut them out of essential systems but that don't ask for a ransom or appear to have any means to request one. These types of attacks, such as the outbreak of WannaCry Ransomware, are puzzling, with experts theorizing that these attacks are tests or demonstrations to show others their destructive power, making an example of certain businesses so other companies are more willing to pay for their removal.
Vulnerabilities in serverless apps
The use of serverless applications using platforms such as Amazon Web Service to build high-quality and smooth-running applications is growing in popularity, but security experts warn that proper precautions need to be taken before rushing into this technology. Serverless applications are built on a framework where the backend setup and upkeep are handled by a third-party cloud service.
McAfee says that while this saves developers the trouble of maintaining servers and allocating resources, these applications are still vulnerable through traditional means, such as privilege escalation attacks, which allow hackers to hijack the application's network. Because an application's function must be transferred over a network to the servers where the data resides, it creates a new point of intrusion for hackers.
As serverless applications continue to catch on, McAfee warns that attacks on the companies that implement them will also increase. As security methods evolve for serverless computing, it's advised that developers ensure traffic on their application takes place over a VPN or that some form of encryption is used.
Corporate marketers collecting more data
Gathering data on consumers becomes easier with each device added to a household. Corporations rely on a consumer's willingness to hit the I Agree button on privacy agreements without reading them. Corporations have incentives to gather and sell as much data as possible so our connected devices that are capable of listening, watching, tracking and analyzing are turning consumers' homes into buffets of information.
Corporations can, and likely will, push the line as to how far they can go with data collection, according to McAfee. New updates and firmware installations usually come with new privacy agreements that users must agree to in order to use them, with more permissions and disclosures snuck into the agreements. McAfee predicts that some corporations will tow this line by calculating the cost of breaking privacy laws and paying fines against profits gained by data collection.
While this mass data is consumed with the purpose of marketing in mind, with high-profile data breaches of notable corporations occurring regularly, this trend could result in such data falling into criminal hands.
Children are already building a digital history
It's no secret that employers often pull up search results, histories and digital records of potential employees. For most adults, this history extends to the time we first starting using the internet and building social profiles. It's technically possible that children born and raised during this time of mass collection could have these profiles created from moment they're born.
For most small children, data collected is likely trivial. But habits and behaviors can still be recorded and stored. A worst-case scenario explained by McAfee is a child being denied entry to a school because officials could find out they spent most of their time binge-watching videos. The capabilities of technology to gather data on children should be concerning. While it's hard to tell what this data collection will result in as time goes on, it's important to know that it's happening and will likely escalate.
If a child's privacy is important, then parents are advised to pay attention to the devices they buy, turn off unnecessary features and change the default passwords to something stronger.