Ransomware, Social Scams Lead 2013 SMB Security Fears

Windows 8: 8 Big Benefits For SMBs

The greater the changes in security threats, the more determined businesses should be to stick with best practices to defend themselves.

That's the general takeaway from the security researchers at Symantec, who believe attackers will find new and better ways to reap profits from mobile, cloud, and social usage in 2013. But although threats such as more "professional" ransomware might evolve, the advice on how to combat them should sound familiar. The right mix of security technologies, backup and recovery processes, and employee awareness will help keep the risks, new and old, in check for small and midsize businesses (SMBs).

"I don't think any of those steps are new," said Kevin Haley, director of Symantec Security Response, in an interview. Still, it's a good time of year for an update on what SMBs should be watching for.

With ransomware, Haley predicts criminals will become more sophisticated in their attack methods, more vicious and emotional in their threats, and greedier in their demands. Whereas the fake antivirus scareware of the past might try to fool users into giving up credit card numbers or other information, its ransomware descendants are more likely to openly threaten the user to extort payment. "We're going to see that kind of harder attitude [of] 'I don't care if I fool you or not, I'm holding you hostage and you're going to pay up,'" Haley said.

[ Read Fake Antivirus Ringleader Must Pay $163 Million. ]

Threats of this nature aren't new, but they're expected to grow fiercer. One key reason: It's easier than ever for the criminal to collect the extorted funds, by using prepaid cards or electronic money services such as MoneyPak in the U.S. or Ukash in Europe. Credit cards are too easy for victims to cancel, and other tools such as premium text messaging proved to be inefficient collection methods for attackers, according to Haley. Prepaid cards and online payments, on the other hand, provide "an easy way for [criminals] to get the money and prosper, unfortunately, and to come up with creative ways to rip us off," Haley said.

Haley thinks ransomware will appear increasingly polished on affected users' PCs -- which will make it more difficult for the typical employee to identify it as a scam. The threats themselves will also progress. The classic ransomware pitch is to impersonate a law enforcement agency and claim the user has illegal material on his machine, and order him to pay a fine or face imprisonment. A newer instance, according to Haley, involved the attacker pretending to be with the hacktivist group Anonymous group and threatening online ruin unless the users paid up. For SMBs, such attacks might also take the form of taking control of databases or applications and demanding payment for their release.

"[Ransomware attacks] are going to do things to keep people scared [and] off-balance, so that they don't think clearly and are willing to pay that ransom to get it off that machine," Haley said. His advice if you're affected: Don't pay. "They're not really going to unlock your system," Haley said. "Once they've got your money, why do they care?" A company might still face a productivity problem while IT fixes affected systems, but calling the extortionist's bluffs at least prevents an added financial loss.

Symantec also predicts a new wave of malware and social engineering delivered via social networks. As sites such as Facebook and Twitter continue their hunt for revenue streams, attackers will follow the money. Expect employees who use applications such as Facebook Gifts, for example, to be hit with a rising number of scams that attempt to lift personal data, payment information or corporate credentials. Such attacks might also simply be designed to deliver malware to the user's machine and network, with similar bottom-line goals. Security vendors such as Symantec and its competitors will pay increasing attention to socially borne threats in hopes of preventing them from reaching end users, Haley said. But that won't eliminate the problem altogether. Such threats exist because they eventually succeed -- there's a sucker born every minute, as the saying goes. Employee education and awareness can help minimize the chance that the sucker works in your office. Haley said criminal attempts to cash in on social network monetization will take familiar forms, such as too-good-to-be-true offers via Web or email. Facebook posts or Twitter messages of the "look at what this girl did on camera" variety should set off alarm bells that something's amiss.

"My friends don't share those videos, so if I see that on their wall I'm not clicking on it because I know they didn't post it," Haley said. "Just using some common sense is going to protect you in a lot of cases."

On a less malicious -- but no less annoying -- front, Haley suspects 2013 will bring a new trove of "madware" to smartphones and tablets. Not to be confused with malware, madware is an invasive, aggressive form of app-delivered advertising, the mobile descendant of adware spam on laptops and desktops. Much as adware was delivered as part of seemingly safe downloads such as a free screensaver, madware comes embedded in mobile apps. Madware typically delivers pop-up alerts, adds icons to the device's screens, or modifies settings.

"As [SMBs] adopt BYOD and they're using phones for work as well as pleasure, you've got a distraction and loss of productivity dealing with the nonsense of these [madware] applications," Haley said. His advice: Know your apps before you download them. Just because it made it past the app store gatekeepers doesn't guarantee it's safe.

In the bigger picture, Haley believes "cyber conflict" will become standard practice around the world. These are the types of national or organizational attacks that cause damage, financial or otherwise, for a wide range of political, military, financial, criminal, or other motives. Look no further than the online spillover from recent fighting in the Gaza Strip. In 2013, Haley suspects more individuals and groups will instigate such attacks simply to rattle a perceived opponent -- the modern equivalent of firing a warning shot across the bow of a ship.

That doesn't mean SMBs will suddenly be under siege from state-sponsored hacks or hacktivist attacks. But they could become susceptible if they're seen as a back-door entrance to a larger target. Examples might include a SMB in the supply chain of a much larger enterprise, or one with significant government contracts.

An interesting note on which to close: Symantec also predicted that cloud outages will significantly increase in 2013, saying things will "get worse before they get better." At first blush, this might sound like some saber-rattling of Symantec's own. The firm made its name with traditional on-premises software. But Symantec has its own stake in the cloud game now, such as Symantec.cloud and Backup Exec.cloud. Haley said the prognostication isn't a doom-and-gloom warning but a recognition that, although cloud applications might already seem business-as-usual to many users, the platforms are still relatively young.

"It's an inevitable kind of growing process of the industry," Haley said.

For the 16th consecutive year, InformationWeek is conducting its U.S. IT Salary Survey. To date, more than 200,000 IT professionals have participated in this survey. Take our InformationWeek 2013 U.S. IT Salary Survey now, and be eligible to win some great prizes. Survey ends Jan. 18.