Wave Systems Corp. (fka WAVXQ)

[boombreaker]

Disapointing intregation progress 2004 year for HIPAA and associations despite new appointments - has to improve! E-commerce will suffercate under the malicious internet crud unless there's a awareness tech' turnaround IMO. e

Will 2005 Bring a Safer Internet?
By Larry Seltzer
December 24, 2004

Opinion: I want to be optimistic, but the security situation—including spam, bugs, browser holes and spyware—is bound to get worse before it gets better.

Sometimes writing about security is just too easy. Making predictions about next year is like this in some ways.

Let's pick some of the low-hanging fruit early. Even though most spam-tracking companies show that spam already comprises 75 percent or more of all e-mail, that proportion will go up in 2005. We are approaching the situation in which, I have always assumed, users will begin to withdraw from e-mail because it is so unpleasant.

It seems to me that the consensus number at the end of last year was at or just above 50 percent, so I'll assume it will go up another 50 percent of legit percentage, up to 87.5 percent. Of course, with an overall number like that, there will be many days where 95 percent or more of all e-mail is spam. No matter how good filters are, more and more is going to get through.

Fed up with spam? Read eWEEK.com's special report "Canning Spam."

Will authentication, the last great hope to save e-mail, make a difference? We can hope that by the end of 2005 it will have taken deep roots, but will we be in a position where domains can really begin blocking and rejecting mail that isn't authenticated? That's the ultimate goal, and I think it will take longer.

Perhaps this is some more low-hanging fruit. You might have noticed that December has so far been a gangbusters month for vulnerability reports. Microsoft is well-represented, not just on its own controversial December patch day, but with a separate report about the Windows Firewall and an independent report about Internet Explorer.

But it's not just Microsoft. We've also had reports this month of vulnerabilities in products from Cisco and Veritas, along with the Samba file-sharing system.

There were separate reports about the PHP Web programming system and Mozilla-based Web browsers. And let's not forget the 16 serious holes Apple reported early this month.

December must have been the most bug-ridden month of 2004, but researchers tell me that inventories of unpublished vulnerabilities are running high. I think that months like December will become more the norm than the exception in 2005.

We'll need some new metric to quantify this, but I think the average number of vulnerabilities reported per month in 2005 will increase substantially over 2004.

On a related point, we and others have been reporting that usage of the Firefox browser has been increasing rapidly. I'm actually skeptical of the numbers, but let's take them for granted for the sake of argument.

If they're true, then Firefox and Mozilla are on track to reach the point of penetration where malware programmers will begin targeting them specifically.

I don't want to overstate things—Firefox has a long way to go before its problem list rivals that of Internet Explorer, but it does have problems, some of them serious. I pointed to a new one just above, and there are other fairly recent ones here, here, here and here.

It's not hard to imagine attacks on Mozilla and Firefox originating with spam messages aimed at them. "Subj: Attention Firefox Users - Sign Up for Update Notification" or something along those lines. What, you think only IE users are stupid enough to click through?

Speaking of user error, most of us pundits a year ago predicted an increase in phishing, but boy, was there an increase in phishing! Most of it is rather unimaginative stuff, simply trolling for Paypal account information.

I've seen an increase recently in the cleverness of these attacks and I think the attackers have barely scratched the surface of what is possible. So, look for another large increase in the volume of phishing attack e-mails, but look especially for an increase in the quality of the attack.

Spyware got annoying enough in 2004 for the mainstream security industry to start ramping up to attack it, either through their own products or through buying established anti-spyware/-adware companies (as Computer Associates did with PestPatrol).

Look for the security industry to try to push new anti-spyware products, especially in the corporate market. In fact, this has already begun.

Click here to read about Microsoft's acquisition of anti-spyware startup Giant Company Software.

I hope, but won't predict, that buyers reject getting shafted on this anti-spyware scam. This is a function that the anti-virus companies should have taken on all along as part of what their products do. I'll dig further into this subject soon.

To quote Peter Coffee quoting Bill Gates, "There is a tendency to overestimate how much technology will change in the next two years, and a similar tendency to underestimate how much things will change in the next 10 years."

Ten years ago, most of us barely had our feet wet in the Internet. Who would have thought it would be such a hostile place and that so much of our attention would be spend trying to protect ourselves from criminals running rampant? I can't predict that it will be a safer place a year from now, but it will have to be in 10 years; there's a limit to how much of this security stuff we can all tolerate.

Security Center Editor Larry Seltzer has worked in and written about the computer industry since 1983.

Check out eWEEK.com's Security Center at http://security.eweek.com for security news, views and analysis.