Cybercrime is no longer exclusive to PCs and Macs, with hacks, spam, malware and trojans hitting smartphones, tablets and cloud storage services too. No-one knows this better than Costin Raiu of the security specialists at Kaspersky Lab. As the company's Director of Global Research and Analysis Team, he's got over ten years worth of computer and mobile security knowledge. We caught up with him at the InfoSec conference in London's Earls Court today and had a chat about the increased threat from smartphone hackers, social networking spam and the growing danger of international cyber warfare.
We associate malware and viruses most closely with desktop computing, but we're increasingly told that smartphone platforms are vulnerable too. Is there any particular mobile OS that is especially vulnerable?
There are four strong players on the market in terms of mobile platforms; Google with Android, Apple's iOS, RIM's BlackBerry OS, and with Nokia's Symbian OS effectively dead, Microsoft's Windows Phone 7. In my opinion Android will become the standard operating system in smartphones, but has a few quirks that makes it attractive not only to users but malware creators too.
Firstly, it's very open, secondly it's well documented in terms of the best ways to make applications for it, and thirdly has security vulnerabilities, especially in older Android versions. The problem here is that Google left the responsibility of patching Android largely to the carriers or smartphone developers. Looking back over past years, patching has always been a weak point of operating systems and third party software, and I have a feeling this will be a problem for Android as well because it's not very easy to update the operating system. There will always be flaws and vulnerabilities that will be exploited by hackers.
Will the vulnerabilities of mobile operating systems extend into security flaws with tablet devices then?
Yes. Netbooks being replaced by tablets seems to be the trend for the future. I believe that with Android becoming more and more popular, growing in popularity on tablet devices too, we're going to see more and more threats here. Do we need protection? I believe so. What is different with Android is maybe the kind of protection that is necessary is different here. Applications bought from the Android Market come with a prerequisite set of permissions, and there's no easy way to allow only certain permissions to be given to an app without not installing it altogether. In the near future Android security needs to focus on application control, and restricting the length in which applications can access data on your tablet or mobile phone.
More and more of our personal data is stored on a wider number of sources online, sometimes without our knowledge. Should we be concerned with how we safeguard our cloud-stored data?
Yeah, I think this is another interesting development. For instance, Google recently launched version 10 of Google Chrome which has the feature to synchronise passwords to the cloud, meaning you don't need to enter passwords for things like Facebook every time you use a different computer running that browser. It's my feeling that Google and other big cloud providers are not doing a very good job at informing the user as to the extent to which they are storing user data into the cloud.
Interestingly, Twitter recently settled with the Federal Trade Commission (FTC) about the fact that they put their users at risk by not providing a decent level of security. The fact that Twitter agreed to implement HTTPS encryption is not only a giant "Win" for consumers, but also shows that we need a greater level of security when dealing with social media in general. Remember, it's not only about ensuring that companies do their best to protect our data, but that the connection sending the data back and forth is secure too.
Are the social networks doing enough to educate users as to how to identify dodgy links and phishing scams?
The FTC ruling shows that at least Twitter aren't doing enough, but this problem goes back several years. MySpace for instance didn't have secure log-in, with passwords going without encryption over Wi-Fi networks and the like for anyone to steal. All the social networks could be doing more about it, especially in terms of making users aware of the risks. But the FTC did a wonderful job, and it's exciting that Twitter understood the problems and took the necessary steps to improve their security.
So the more general authorities are now taking cybercrime more seriously too?
Yes. Security companies are pretty limited in the amount of things they can do. We can tell the big players that they aren't fully secure, but it takes more than that to make them change their ways. Governments have a very important role here, not just in the US but all around the world.
Kaspersky Labs have previously stated that the recent Stuxnet worm could only have been implemented with "nation/state" support. What does this tell us about international cyber security in relation to foreign policy?
Stuxnet is a "one-of-a-kind" malware, totally different to anything we've seen before. We thought it couldn't be unique but we haven't been able to find anything similar. Stuxnet is opening the door to a new kind of security threat which indicates the existence of cyber way at the highest possible level within super powers. In the future we're going to see more of this as I believe it's a very cheap and effective way of attacking major targets. The evidence we've seen seems to indicate Stuxnet was successful in gaining the access it needed. Attacking an industrial installation with physical force is a lot more expensive and more complicated.
What sorts of security systems do you have planned for the future?
In terms of future Kaspersky Lab software we're looking into three new, very interesting directions for our products, be it in cloud and virtualisation, whitelisting and reputation or mobile software. Data Leakage Prevention is also important now; it's a lot more easy for you to lose your tablet or mobile phone than it is to misplace your desktop PC! A really interesting product we're looking to launch this year is for VMWare Visual; we've had a lot of talks with our customers and bigger cloud providers and they've all expressed an interest in having a security product that can be worked into their data centres.
OK to round things up then; if you could give three tips as to how Tech Digest readers can protect their data today, at as little cost as possible, what would they be?
In order of importance, firstly they should update their operating systems; Android, Windows, Mac OSX, Linux, whatever. I know this can be quite painful, but it's very, very important.
The second on is to make sure they don't use pirate software. A lot of pirate software, particularly with Mac OS, come loaded with trojans. This can also be extended to pirate movies; recently we've seen "movies" on pirate torrent websites where the files aren't actually real videos. Instead they claim the user doesn't have the proper codec to view the film, directing them to download it from unsafe websites. When they download it obviously their machines get infected. So staying away from pirate sources in general is my second free tip!
The third tip has to do with user mentality. A lot of things happen because users aren't aware of security threats, so they click on strange links or don't properly screen links that friends have sent purely because they trust their pals, even if they're not so sure of the source. It's about using common sense and being careful if you spot unusual messages from your friends or social network contacts. If you see strange applications trying to access your profile on Twitter or Facebook, just don't allow them unless you're absolutely sure they're approved! So that's my three tips for your readers!
Cool, thank you very much Costin!
No problem.
Kindle owners get a great new tool this morning with the launch of the new "Send to Kindle" feature for PC.
Tech gifts don't have to be about screen sizes or processing capabilities these days. In fact, they don't have to be physical gifts at all. You can put a smile on a loved one's face just by setting them up with one of the many ace online digital services and subscription packages that are tied into apps, download and streaming sites too.
Backing-up PC data can be a chore, but it's a necessary pain if you hope to protect your sensitive and precious files from the odd ghost in the system. The Acronis True Image Home 2012 suite aims to take the hassle out of backing up your files, while also having enough flexibility to sate the appetite of even the most avid PC tinkerer. Read on for our verdict.
Apple's latest OS update, Mac OS X Lion, touched down at a remarkable £21 last month, but was limited to in-store and Mac App Store download sales. The latter of which is fine if you've got a healthy web connection, but a nightmare if you're stuck in the dial-up dark ages.
Steam, the digital distribution gaming store that's been keeping PC gamers loaded with top quality titles since 2003, is to get a major backend overhaul that will drastically improve download times.
Adobe CEO Shantanu Narayen has stated that he believes tablets running Google's Honeycomb OS will eventually win out over the now-dominant iPad produced by Apple, just as Google's Android smartphones too are beginning to edge ahead of Apple's iPhone.
Nuance have updated their Dragon Naturally Speaking voice recognition PC software to let gamers control select titles using the power of speech.
Apple head-honcho Steve Jobs took to the stage once again last night to reveal a whole host of new products heading out and into stores worldwide. Whilst the new MacBook Air model was expected, Jobs also dropped in a few surprises. Read on to find out what they were.
Security specialists Webroot are bringing their knowledge of PC security up into the cloud with their new Internet Security Complete suite. Designed to keep your files and information stored online just as safe as those held locally on your PC, it'll keep you one step ahead of the internet crooks.
From: The 101 best iPhone apps in the world today