Looming Online Security Threats in 2008

Web-based services, including social networks MySpace and Facebook, are becoming prime targets for hackers seeking your personal information

by Aaron Ricadela

It's nearly enough to make you long for the days of typo-ridden e-mails pretending to come from your bank.

As Internet users display more of their personal information on social networking Web sites, and office workers upload more sensitive data to online software programs, computer hackers are employing increasingly sophisticated methods to pry that information loose. In many cases, they're devising small attacks that can fly under the radar of traditional security software, while exploiting the trust users place in popular business and consumer Web sites.

In September, the names and contact information for tens of thousands of customers of Automatic Data Processing (ADP) and SunTrust Banks (STI) were stolen from Salesforce.com (CRM), which provides online customer management software for those two companies. The incident occurred after a hacker tricked a Salesforce employee into disclosing a password.

The assaults on consumer sites are getting more unnerving as well. A security researcher reported Nov. 8 that hackers had hijacked pages on News Corp.'s (NWS) social networking site MySpace, including the home page of singer Alicia Keys. Clicking nearly anywhere on the page would lead viewers to a Web site in China that tries to trick them into downloading software that can take over their PCs. "We're going to see a lot more of this in the consumer space," says John Pescatore, an Internet security analyst for Gartner (IT).

Exploiting Trust

These kinds of targeted attacks on Web-based services may constitute the top computer security threats of 2008 (BusinessWeek.com, 11/12/07), according to security experts. "One of the biggest challenges of 2008 will be, how do you do business online when you know there's a bad guy in the middle?" says Chris Rouland, chief technology officer in IBM's (IBM) Internet security systems division. "The personal computer isn't the target of 2008; it's the browser," he says. IBM sees the landscape changing profoundly enough that the company plans to spend $1.5 billion next year to develop security suites that can address a broad array of threats rather than different products aimed at specific security risks.

Although a rash of e-mail-borne virus outbreaks in recent years have made most PC users wary of opening attachments or clicking on links in suspicious messages, it may be harder to prevent attacks that exploit the Web-based lists of friends and business contacts that users store in widely used services and social networks. "We've definitely seen the bad guys use malware to go after friends lists on MySpace and Facebook," says Pescatore. "They're exploiting trust."

By targeting a relatively small number of users at a time—tens of thousands vs. millions—new hacking strategies can elude efforts to detect them. Hackers also are employing more professional approaches to maximize damage without being caught. These include division of labor by hacking expertise and wider use of black-market sites to hire programmers and purchase professional malware-writing tools.

Hackers Shift Attacks

Factor in the growing variety of places where people are connecting to the Internet—from work, from home, from Starbucks (SBUX)—and the growing array of devices they're using to do so, and the coming year could present a potent brew of problems.