Malware - Future Trends

Malware has truly evolved during the last couple of years. Its potential for financial and network
based abuse was quickly realized, and thus, tactics changed, consolidation between different
parties occurred, and the malware scene became overly monetized, with its services available on
demand.
What are the driving forces behind the rise of malware? Who’s behind it, and what tactics do
they use? How are vendors responding, and what should organizations, researchers, and end
users keep in mind for the upcoming future? These and many other questions will be discussed in
this article, combining security experience, business logic, a little bit of psychology, market
trends, and personal chats with knowledgeable folks from the industry.

This publication is in no way intended to be a complete future prediction or a reference, as future
can never by fully predicted, that’s the beauty of it. Instead, its intention is to discuss the
possible future trends backed up by a little speculation, and also use some of the current ones as
a foundation for future developments. Malware authors, and antivirus vendors would never stop
playing a cat and mouse game, that’s the nature of the market, but as in any other, there are
core factors affecting all the participants, and variables whose movements shape the future
direction of events. In this publication, I did my best to cover the most significant ones,
expressing entirely my point of view as an independent security consultant.Author’s comments

Back in 2003 when I first wrote The Complete Windows Trojans Paper1, things were entirely
different from what they are today. Trojans used to have fixed ports2, servers were open to
anyone scanning and using the right client for the right trojan. Then, malware started getting
smarter, and port 80 or anything else allowed by default started acting as a communication
platform. Infected PCs started getting controlled over Web browsers, and SensePost’s Setiri3
concept deserves to be mentioned among the many other important ones back in those days.
Slightly highlighting the future potential of what used to be Remote Access Trojans (RATs) back
in 2003, today this threat is represented by IP (intellectual property) worms, cryptoviral extortion
schemes, or industrial espionage 0day cases like the Israeli’s operation “Horse Race”4.
Furthermore, many others trends and factors should also be considered. I greatly hope that this
trend analysis will result in more constructive discussions, or perhaps, even expectations from
any of your security vendors!
For others thoughts on security, you can also go through my blog posts at :
http://ddanchev.blogspot.com/

What will you learn after reading this paper?

- you will be able to easily graps the big picture and know where you, or your organization
stands

- you will maker better purchasing decisions, and become a more informed opinion leader

- how the current threats affecting the scene will influence the trends to come?

- why malware will continue to be an inseparable part of the Internet?

- how malware turned into a cost-effective industrial espionage tool?

- and many more insights or topics to speculate on!

This paper is distributed in PDF format due to its size (26 pages). You can download the document here.

1.) Protecting Your Network Against Spoofed IP Packets - Brien M. Posey
2.) Pivoting BOUNCEr - pbounce 0.1 released - Meder Kydyraliev
3.) TCP and IP Options - Don Parker
4.) Coping with A Major Security Breach? What’s your Contingency Plan? - Martin Allen
5.) Caveat Lector: Authentication, the Forgotten, Should-be Predominant - Justin Troutman
6.) Malware – future trends - Dancho Danchev