{"id":55586,"date":"2020-01-23T00:00:00","date_gmt":"2020-01-22T21:00:00","guid":{"rendered":"https:\/\/prohoster.info\/blog\/blog_prohoster\/slozhno-uyazvimo-nedonastroeno-kiberugrozy-2020"},"modified":"2020-02-18T14:03:43","modified_gmt":"2020-02-18T11:03:43","slug":"slozhno-uyazvimo-nedonastroeno-kiberugrozy-2020","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/slozhno-uyazvimo-nedonastroeno-kiberugrozy-2020","title":{"rendered":"Complex, vulnerable, misconfigured: Cyber threats of 2020.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

\"Complex,
\n
\nTechnologies are evolving and becoming more complex year after year, and along with them, attack methodologies are also improving. Modern realities demand online applications, cloud services, and virtualization platforms, so it's no longer possible to hide behind a corporate firewall and avoid the 'dangerous internet'. All of this, along with the spread of IoT\/IIoT, the development of fintech, and the growing popularity of remote work, has dramatically changed the landscape of threats. Let's talk about the cyber dangers that await us in 2020.<\/i>
\n<\/a><\/noindex><\/p>\n

Exploitation of 0day vulnerabilities will outpace the release of patches. <\/h3>\n

\nThe complexity of software systems is increasing, and as a result, they inevitably contain bugs. Developers release fixes, but first, the problem must be identified, which takes time from adjacent teams, including testers who are forced to conduct tests. But many teams are catastrophically short on time. The result is an unacceptably long patch release, or even the appearance of a patch that only works partially. <\/p>\n

Released in 2018, the patch for the 0day vulnerability in the Microsoft Jet engine turned out to be incomplete,<\/a><\/noindex>that is, it did not resolve the issue completely.
\nIn 2019, Cisco released patches for vulnerabilities CVE-2019-1652 and CVE-2019-1653 in router firmware that did not fix the errors.<\/a><\/noindex>.
\nIn September 2019, researchers discovered a 0day vulnerability in Dropbox for Windows and informed the developers about it,<\/a><\/noindex>however, they did not fix the error within 90 days. <\/p>\n

Blackhat and Whitehat hackers are diligently searching for vulnerabilities, so the likelihood that they will discover a problem first is significantly higher. Some of them aim to receive rewards through Bug Bounty programs, while others pursue specific malicious goals. <\/p>\n

More attacks using deepfakes.<\/h3>\n

\nNeural networks and artificial intelligence are advancing, creating new opportunities for fraud. Following the fake porn videos featuring celebrities, concrete attacks causing serious financial damage have emerged. <\/p>\n

In March 2019, perpetrators stole $243,000 from an energy company with a single phone call.Criminals stole $243,000 from an energy company with a single phone call.<\/a><\/noindex>\"The head of the parent company\" instructed the branch manager to transfer money to a contractor from Hungary. The CEO's voice was forged using artificial intelligence. <\/i><\/p>\n

Given the rapid development of deepfake technology, it is expected that cybercriminals will incorporate the creation of fake audio and video clips into BEC attacks and technical support scams to increase user trust. <\/p>\n

Top executives will be the main target for deepfakes, as recordings of their conversations and speeches are publicly accessible. <\/p>\n

Attacks on banks through fintech<\/h3>\n

\nThe adoption of the European payment services directive PSD2 has enabled new types of attacks on banks and their clients. This includes phishing campaigns against users of fintech applications, DDoS attacks on fintech startups, and data theft from banks through open APIs. <\/p>\n

Complex attacks through service providers<\/h3>\n

\nCompanies are increasingly narrowing their specialization, outsourcing non-core activities. Their employees develop trust in outsourcing firms that handle accounting, provide technical support, or ensure security. As a result, compromising just one service provider is sufficient to infiltrate the target infrastructure with malicious code, steal money, or information. <\/p>\n

In August 2019, hackers penetrated the infrastructure of two IT companies providing data storage and backup services, and through it deployed ransomware in several hundred dental offices across the United States. <\/a><\/noindex>
\nAn IT company servicing the New York Police Department temporarily incapacitated the fingerprint database, by connecting an infected Intel NUC mini-computer to the police network.<\/a><\/noindex><\/i><\/p>\n

As supply chains grow longer, more weak links emerge that can be exploited to attack the largest targets.
\nAnother factor that will facilitate supply chain attacks is the widespread adoption of remote work. Freelancers working via public Wi-Fi or from home are easy targets, as they can interact with several major companies, making their compromised devices a convenient platform for preparing and executing further stages of cyber attacks. <\/p>\n

Widespread use of IoT\/IIoT for espionage and extortion<\/h3>\n

\nThe rapid growth of IoT devices, including smart TVs, smart speakers, and various voice assistants, combined with a large number of vulnerabilities found in them, will create many opportunities for unauthorized use.
\nCompromising smart devices and using AI for speech recognition allows the identification of the surveillance object, turning such devices into tools for extortion or corporate espionage. <\/p>\n

Another area where IoT devices will continue to be used is in creating botnets for various malicious cyber services: spam distribution, anonymization, and conducting DDoS attacks<\/a><\/noindex>.
\nThe number of attacks on critical infrastructure objects equipped with components of the industrial Internet of Things<\/a><\/noindex>will increase. Their aim could be, for example, ransom extortion under the threat of stopping the operation of the enterprise. <\/p>\n

The more clouds, the more dangers<\/h3>\n

\nThe mass migration of IT infrastructures to the cloud will create new targets for attacks. Deployment and configuration errors in cloud servers are successfully exploited by malicious actors. The number of leaks related to unsafe database configurations in the cloud increases every year. <\/p>\n

In October 2019, an ElasticSearch server was discovered in the public domain, containing 4 billion records of personal data.<\/a><\/noindex>
\nAt the end of November 2019, a database from True Dialog was found publicly accessible in Microsoft Azure, containing nearly 1 billion records<\/a><\/noindex>, which included full names of subscribers, email addresses, and phone numbers, as well as the texts of SMS messages. <\/i><\/p>\n

Leaks of data hosted in the cloud will not only damage the reputation of companies but also lead to fines and penalties.<\/p>\n

Insufficient access restrictions, improper permission management, and negligence in logging are just some of the mistakes companies will make when setting up their cloud networks. As migration to the cloud increases, third-party service providers with varying security expertise will become more involved in this process, creating additional opportunities for attacks. <\/p>\n

Escalation of virtualization issues<\/h3>\n

\nContainerization of services simplifies the development, maintenance, and deployment of software; however, it also introduces additional risks. Vulnerabilities in popular container images will continue to be a problem for all who use them. <\/p>\n

Companies will also have to face vulnerabilities in various components of the container architecture, from runtime errors to orchestrators and build environments. Malicious actors will seek and exploit any weaknesses to compromise the DevOps process. <\/p>\n

Another trend related to virtualization involves serverless computing. According to Gartner's forecast, by 2020, more than 20% of companies will use this technology.<\/a><\/noindex>These platforms allow developers to execute code as a service, eliminating the need to pay for entire servers or containers. However, transitioning to serverless computing does not guarantee immunity from security issues. <\/p>\n

Entry points for attacks on serverless applications will be outdated and compromised libraries, as well as improperly configured environments. Attackers will use these to collect sensitive information and infiltrate corporate networks. <\/p>\n

How to counter threats in 2020<\/h3>\n

\nGiven the increasing complexity of cybercriminal activities, companies will need to expand their collaboration with security experts to mitigate risks across all sectors of their infrastructure. This will enable defenders and developers to gain insights and better control network-connected devices and address vulnerabilities. <\/p>\n

The constantly evolving threat landscape will require the implementation of multi-layered protection based on security mechanisms such as: <\/p>\n