Attending the BankTech Congress 2007 in Mumbai gave us more than one reason to be aware that the web in the future won’t be as safe as it is today. In a recent report, Gartner said that 2008 will be a real test for antivirus companies as more and more threats are added to the list. With code obfuscation – a new kind of threat – due to hit Indian cyber space in a big way, it’s better to be prepared now than wait for it to actually happen.

Yes Bank CISO Japjit Sandhu, while speaking on ‘Identifying the Latest Hacking Techniques’, mentioned that with the entry of Web 2.0, a new era of cyber threats has arrived. He elaborated on a new technique used in the US by many hackers called ‘code obfuscation’, wherein the source code is modified and written in such a way that it’s absolutely not understandable unless decrypted for the actual code.

A source code obfuscator identifies a source file and generates another functionally equivalent source file that is much harder to understand. “They have started identifying India as a big market, as the rupee gives a hard time to the dollar. Thus more and more criminals are here to create a specific and geographically isolated attack to pounce on the IT infrastructure and sniff loopholes in the network if any,” said Sandhu, who was formerly with ABN-AMRO holding the post of a Local Information Security Officer (LISO).

Cyber criminals are opting for a more evasive attack that functions along the lines of an ‘attack and avoid detection’ model. In a recent attack on Bank of India’s website, the attackers used an Iframe which is normally created to fill the webpage with malware such as trojans, diallers and binaries that automatically download themselves on to PCs that are not sufficiently secure. Sandhu explained that the attacks are more focused so that concentration on a particular region is maintained and the attack source can’t be verified.

Other techniques like RSS feeds, widgets, DNS poisoning, sniffing and phishing are also increasingly becoming a big challenge to the banking and financial sector, and these will only affect computers to a greater extent in 2008.

With the Beijing 2008 Olympic Games just around the corner, McAfee has stated that cyber attacks in the next year are likely to more or less revolve around the Olympic theme. So if you get a mail on the Olympics or a page link, especially from unknown persons, be very careful not to read it or visit the page. Right now, however, what can be done is wait and watch, and if need be make that big investment and beef up the security as much as you can.