I see two topics in the malware world today that bear some examination:
1. The lack of "Moore's Law" advancements in malware - and why
2. The players – who they are and what motivates them
The slow pace of malware advancement is easy to explain. Even while the march of processor advancements under Moore’s Law is starting to slow, the people writing malware and other badly-behaved software have stuck to their plan: not doing a lot of work. Apply the minimum effort necessary to get your goals accomplished and use a hole that you take a little time to find that no one knows about. It's clever, but more important, its follows the programmer’s central ethos: laziness. The less work you do for the biggest payout the better.
While some may be able to detect these advanced attacks, they are at best in the extreme minority with the largest population unaware of the attack until long after it happens, if ever. This is one of the biggest problems today: you can have data exfiltration or a subtle attack going on right under your nose and not know it. It doesn't even have to be sophisticated: FTP certainly isn't but it's extremely popular for exfiltrating a large quantity of data quickly (and insecurely). You just have to be looking in the right place at the right time to see it. Why is it that no one (else) talks about this happening? The reason is that most people either don't know it's happening to be able to report it, aren't legally obligated or are too embarrassed to say anything. I think the Verizon 2012 Data Breach report backs this up nicely. It shows the time to discovery is months, not hours or days, and most often reported by external sources.
The second issue is far more insidious, namely who the bad guys, or players, are. This can range from those interested in seeing what they can do to those with a political agenda and even to state-sponsored bad behavior now that cyber warfare is seen as more of a "spy-like, clean warfare" tactic. There was a huge panic attack, and let's face it our industry is rife with panic inducement, about insider threats. They do exist but it's been shown by many, including Verizon as mentioned previously and Carnegie Mellon, that they are far in the minority over external threats. I have come to believe that your adversaries are highly focused on your particular market. Right now banks have public enemies coming after them (mostly unskilled with financial grudges), government has interesting adversaries in foreign states sponsoring bad actors and the high-profile types looking to deface government agency websites and steal classified data, pharmaceuticals have both financially-motivated and healthcare reform actors after them, and so on. I think a full analysis by industry to see who is attacking and why would be an excellent thing to have. The most important use of this data set would be in letting us know what tactics the attackers can and will use based on the resources they have available and how "motivated" they are to get what they want.
There really are only two attack modalities. The first is the highly targeted attack which is looking for something "damning" as was seen in the Wiki Leaks attacks or something very specific such as Nation-State or targeted attack to get at one person or group. These highly targeted, whether to a company or an individual, and persistent threats have come to be known as Advanced Persistent Threats in the industry. The second modality is the splatter attack looking for as many victims as possible, like most financial scams designed to make money and get out fast. I think these both tie back into the overall motivations outlined above but they go a long way to understanding the kinds of attacks that have a higher probability of being used against a target.
While the future of malware is yet to be written you can be sure it will continue to issue from resourceful, focused and lazy authors using any obscure vulnerability they can find that you haven't patched and when you aren’t looking. You need to remain vigilant to ensure you aren’t losing data or being attacked without your knowledge. Finding this malware before it reaches your computers or before you begin losing data is a far less expensive proposition than the alternative.
-Darian Lewis