2009 in review: Security

The continued activity of the Conficker worm kept security professionals busy this year

Drive-by downloads
Drive-by downloads have become one of the major ways in which cyber criminals spread malware, according to Symantec security operations manager Orla Cox. This happens most commonly by infecting often legitimate sites with malicious code which will then infect any unprotected PCs which happen to visit the site, unbeknown to the user. There were 18 million infection attempts in the whole of 2008, but Symantec observed 17.4 million from August to October of 2009 alone.

Fake anti-virus
This year has also seen a rapid rise in the number of scams trying to trick users into buying fake anti-virus products. Symantec received reports of 43 million rogue security software installation attempts from 1 July 2008 to 30 June 2009. The danger, of course, is twofold: users are defrauded, and could leave themselves open to future attack by wrongly thinking that they are protected.

Attacks via social networking sites
If this year was the year of Twitter, it was also the year in which hackers began to exploit the site, and other social networking sites, to spread malware. In many ways, these sites are a goldmine for cyber criminals, as users are far more likely to click on potentially malicious links if they believe it comes from a friend on such a site. Thus we witnessed the great success of the Koobface worm, which saw criminals hacking accounts and spamming the account holder's 'friends' with malicious links, often obfuscated by a URL shortening service. Numerous Twitter accounts have been hacked this year and, although the site has tried to fight back with verified account service, this has proved far from impenetrable. Britney Spears's verified account recently fell victim.

Piggy-backing on popular events
A popular technique for some time now, cyber criminals have continued to exploit big events throughout the year to entice users to click on spam-ridden or malicious links in emails, Twitter feeds or other channels. Another technique exploited for events such as Michael Jackson's death is that of blackhat search engine optimisation, which involves hackers filling malicious sites with keywords to ensure they come top of the rankings when a user searches for more news about a big event.