Microsoft’s 2013 security predictions: Espionage helps criminals, apps are weapons, and rootkits evolve

Today Microsoft released five predictions for 2013’s security frontier, noting that current trends will likely produce a certain set of results.

Microsoft’s position as a company pontificating about security is not a new one, but it is a role that it has new standing in. Following the rougher years of Internet Explorer 6, Windows XP, Microsoft was widely mocked as a company that sold and provided insecure software.

However, in the new age of Microsoft, with Windows 7 and 8, alongside Internet Explorer 9 and 10, the company has turned over a new leaf. Those products, supported by Microsoft Security Essentials – Windows Defender in Windows 8 – have provided a new basic level of security for the average computing individual. This is not to say that Patch Tuesday is no more; it in fact remains as important as it has since its inception.

Now, to the predictions. I’ve put each of Microsoft’s claims in bold, and then explained them in the following plain text.

The 💜 of EU tech

The latest rumblings from the EU tech scene, a story from our wise ol' founder Boris, and some questionable AI art. It's free, every week, in your inbox. Sign up now!

Prediction #1: Criminals will benefit from unintended consequences of espionage

As governments increasingly use cyber tools to attack each other, those efforts often spill over to the private sector, where the technologies can be employed into new, consumer-facing threats.

After all, if a team of professionals have done all the heavy lifting to build a piece of malware that can crack into nuclear facilities and cause havoc, what could such a system do to a less secure system? As these super-bugs are discovered, their guts can be repurposed and reused.

Sadly, the trend is likely set to only become worse. As Microsoft notes. “[t]he barriers to entry for criminals to leverage highly sophisticated techniques in their attacks are lowered each time the malware and vulnerabilities that highly skilled professionals develop and use, are discovered.”

Prediction #2: Attackers will increasingly use apps, movies and music to install malware

This one is simple: as spyware and more classic viruses fall from glory, trojan attacks, social engineering, and any attack vector that allows for the point of entry to be part of a standard consumer activity is a tempting attack path.

Microsoft has a pretty simple maxim for how to stay safe: “if you don’t trust the source of the software, don’t trust the software.” The use of audio or visual files to deliver malware isn’t encouraging, but a little common sense and one will be fine.

Prediction #3: Drive-by attacks and cross-site scripting attacks will be attacker favorites

According to Microsoft, “attackers have been leveraging drive-by download attacks and cross-site scripting attacks more and more each year.” Exploit kits have made the game easier for bad folks, as they need to only devote time to attack points, and not what to do afterwards.

Prediction #4: Software updating gets easier and exploiting vulnerabilities gets harder

In Microsoft’s view, the ability to keep a piece of software up to date is exactly correlated with how vulnerable its users will be. The more up to date your software is, the less chance there is of vulnerability being exploited.

In short, as updating software becomes easier, it will be harder to launch certain forms of attacks as holes will be plugged before any malicious traction can be found.

It’s not hard to see the role that app stores play in this, as they have brought updating applications to the fore, and some operating systems such as Android now allow for users to opt-in to all future app updates, which will install automatically.

That and the fact that Microsoft has built a wall around its own Windows Store will likely help keep users clean.

Prediction #5: Rootkits will evolve in 2013

In short, secure boot and Unified Extensible Firmware Interface (UEFI) will make rootkits of yore far less effective. If they don’t work, new methods will have to be created. Microsoft thinks that at a minimum, people are going to try.

Now, that was a bit dry and sad. This will perk you up. Top Image Credit: Haleyface