• Phishing Attacks, Threats to Confidential Information and to Windows - All Increasing, Says Symantec Report

Stuart McIrvine, director of IBM's security strategy, said yesterday: "After a year like 2004, many IT departments feel beaten down from combating viruses like Mydoom and Netsky. However, through sophisticated intelligence gathering and analysis, IBM can now identify and understand many of these risks. In addition, businesses and consumers can use this information to help them to not only anticipate these security risks, but more importantly, to prepare themselves to avoid a new breed of attacks in 2005."

According to IBM, results from its 2004 Global Business Security Index Report show mobile devices becoming targets of viruses and worms. IBM, looking at potential security threats in 2005, said this may be the year for the aggressive spread of viruses and worms to handheld devices, cell phones, wireless networks, and embedded computers, which include car and satellite communication systems.

The report, written by IBM's Global Security Intelligence Services team, said e-mail-based worms and viruses wreaked havoc on corporate networks in 2004. E-mail worms such as Bagle, Netsky and Mydoom led the pack in the number of variants and overall impact. During the latter part of 2004, a growing number of viruses aimed at PDAs and other mobile devices, such as the Cabir worm, were released. Such worms will likely be used by copycats and may start an epidemic of viruses aimed at mobile devices.

IBM's Global Business Security Index report contains a number of other potential trends in 2005. Identity theft may increase because of phishing attacks that use "spoofed" e-mails and fraudulent Web sites designed to deceive recipients into divulging personal information such as credit card numbers, account usernames and passwords, social security numbers, etc. will likely continue to plague businesses and consumers. Also, there will likely be an increase in the disruption of VoIP networks. In particular, eavesdropping and denial of service attacks carried out remotely against VoIP networks could provide significant damage for enterprise organizations.

What makes the new crop of security threats more difficult is that fact that writers are getting smarter and are employing basic software development practices to spread destructive software, according to the report. Automated "botnets" are also cited as likely to move to instant messaging networks for command and control of infected systems. The number of known viruses grew considerably in 2004. And even measures like the CAN-SPAM Act seem to not work, as spam has continued to proliferate. It is estimated that a majority of all email traffic on the Internet is spam.

The tsunami that impacted three continents in the Indian Ocean ended a devastating year of natural disasters. Hurricanes in North America, typhoons in Asia and numerous other events around the world impacted lives and property. For corporations, the safety of their employees, their property, and IT environments is of serious concern. The events of 2004 highlight the need for all organizations to have a continuity and disaster recovery plan in place.

Yet another target for viruses is digital images. The report said 2004 ushered in a new era of vulnerabilities that affected digital picture formats such as JPEG and BMP photos. Typically seen as benign files, hackers have discovered ways to embed malicious code in pictures in order to attack a number of different applications used to render images. Clicking on an infected image could set off a virus or worm without the user's knowledge.