2013: A Perilous Year on the Internet

Surfing the Internet last year was a dangerous proposition, and it isn’t getting any safer.On average, 200 samples of malicious software were collected every minute by McAfee Labs, the company reported Monday in its threat report for the last quarter of 2013.

All kinds of Internet nastiness increased last year — from ransomware and suspicious URLs to bogus digital certificates, master boot record attacks, and poisoned mobile apps, the firm said.

It was also the year that — thanks to Target — the malware problem was brought home to many civilians in the war against cybercrime.

“The fourth quarter of 2013 will be remembered as the period when cybercrime became real for more people than ever before,” said Vincent Weafer, senior vice president for McAfee Labs.

“These cyber thefts occurred at a time when most people were focused on their holiday shopping and when the industry wanted people to feel secure and confident in their purchases,” he noted.

“The impact of these attacks will be felt both at the kitchen table as well as the boardroom table,” said Weafer.

Healthy Market for Mischief

The repercussions felt from last year’s data breaches at Target and Nieman Marcus will be long lasting, the report predicts, and not just because they will lead to changes in security practices and lawsuits.

“The big lesson is that we face a healthy and growing cybercrime industry which played a key role in enabling and monetizing the results of these attacks,” the report says.

“There’s a healthy market out there, and it’s not people making custom code to do stuff,” said Adam Wosotowsky, a messaging data architect with McAfee and one of the report’s authors.

“Criminals can get these packages, and they don’t need a lot of computer knowledge to build their infections and Trojans,” he told the E-Commerce Times. “After they’re built, the underground market can be paid to distribute them.”

While the cyberunderground may be healthy, the targets of its wares are less so, noted Michael Belton, head of the assessment team at Rapid7.

“Systems are less-protected than they should be because patches are not being deployed, monitoring systems are not being watched, and processes are just too unpredictable,” he told the E-Commerce Times.

Malicious Certificates

There was a disturbing increase in the amount of malicious binaries containing valid certificates, McAfee also reported. Certificates are used to validate the author of a program and ensure that software hasn’t been tampered with since the certificate was issued.

The threat of digitally signed malware is not only expanding ever more rapidly, but also becoming more complex, the report points out. During the last quarter of 2013, McAfee discovered more than 2.3 million new and unique malicious signed binaries — a 52 percent increase over the prior quarter — and for the year, 5.7 million malicious signed binaries — more than three times the number found in 2012.

“Cybercriminals are looking for ways that they can gain trusted status,” said Kevin Bocek, vice president of product marketing at Venafi.

“Whether I’m Edward Snowden or a member of a cybergang, I want to get trusted status, and I want to go undetected. That’s what the use of digital certificates allows me to do,” he explained.

“Cybercriminals are running wild,” Bocek told the E-Commerce Times. “They are compromising certificates, and there is very little enterprises have done to prepare for this.”

Wild, Wild Net

Mobile malware continued to climb in 2013, the McAfee report observes. The company collected some 2.47 million new mobile malware samples, growing its “zoo” of unique samples by 197 percent for the year.

While mobile malware continues to grow, smartphone users who walk the straight and narrow should not be too concerned about infections.

“If you’re getting your apps from an official site — the iTunes Store or Google Play — then everything is pretty safe,” said McAfee’s Wosotowsky.

However, Web surfers have less cause to feel safe.

“Internet citizens today are like the intrepid settlers of the American West 200 years ago,” Paco Hope, principal consultant with Cigital, told the E-Commerce Times. “We need to be vigilant, protect ourselves a bit more than we might if the law were protecting us, and encourage lawmakers to catch the next train out to the undiscovered country.”

As for the war with cybercrime, there doesn’t seem to be a clear winner yet.

“No one has won or lost the war, but battles waged every day have to still tilt toward attacker victory over the defenders,” said Tom Bain, director of marketing and security strategy at CounterTack.

That will change as defenders begin to leverage the attacker’s methods and technologies against them to prevent data compromise, he told the E-Commerce Times. “Then companies can start to turn that fight around.”