This post is from the Heise Security website and it attempts to predict the trends for 2007.
It’s the season of the end-of-the-year reviews. We have used our crystal ball to jump forwards a year to provide you the ultimate review of 2007 — here and now.
2007 was the year of the super bots: Never before has malicious software been equipped with so many functions that help it to hide from antivirus software and to resist removal. The majority of malicious software programs used root kits, and their number doubled again on last years figure to over 500. Local privilege escalation vulnerabilities in Windows were increasingly exploited; accounts with restricted user rights were used to gain system rights. Initially, the protective functions in Windows Vista, which has been available for end customers since January, made it more difficult for malicious code to infiltrate the system. The crimeware scene responded and numerous vulnerabilities appeared as the year progressed and these were exploited to cancel or bypass the majority of the security functions. The user account protection (UAC), in particular, proved to be ineffective: Most users just confirmed any respective requests, since they did not undertand the displayed information.
While in 2006, DDoS attacks with botnets were mainly targeted at unwanted competitors, online betting offices and consumer protection sites, 2007 also saw large attacks launched on critical infrastructures. In April, the stock exchange nearly crashed, when a DDoS attack on the electronic trading system disconnected it from the Internet for several days, resulting in automated control programs loosing control and attempting to divest shares in a panic reaction.
When analysing this event, neither law enforcement agencies nor other specialists involved were able to switch off the responsible botnet with its decentralised control. The individual bots communicated with each other in a peer-to-peer structure, similar to those used for file sharing sites; the commands transferred in the Net were encrypted and had a digital signature.
An insurance company suffered significant damages, when a botnet attack cut off all the telephones in the entire company group for two days. While the Voice-over-IP infrastructure proved to yield operational cost savings, this was at the expense of system stability, when vulnerabilities of the SIP protocol were used for targeted attacks. So far, no explanation has been found for why the attacks stopped abruptly after two days; persistent rumours say that a six-digit sum changed hands.
For security software vendors, too, 2007 was a black year: The number of critical holes detected in products that had been designed to provide a higher degree of security was higher than ever before. For instance, various worms used zero-day exploits for holes in antivirus software to find a way into the system during the mail scanning process.
For the first time, underground prices for such zero-day exploits dropped in 2007, compared to the previous year. Insiders think this drop in prices was caused by a glut of such exploits, mainly due to the broad usage of simpler fuzzing tools. Bit by bit, these half-automated vulnerability scanners are uncovering the (security) sins of a whole generation of programmers.