Malware vs. Anti-Malware, 20 Years Into The Fray 62
jcatcw writes "Steven J. Vaughan-Nichols considers the dissimilarities between malware of yore and current infiltrations as we approach the 20th anniversary of the Robert Morris worm. Modern malware apps curl up and make themselves at home in your system, where they wait for a chance to snatch an important password or a credit card number. Welcome to the era of capitalist hacking. Any self-respecting malware program today is polymorphic, making signature-based antivirus approaches difficult. Heuristics and virtual sandboxes offer alternatives, but all such methods are reactive. Unfortunately, monitoring lists and networks is about the only current alternative."
There is no cleanup anymore (Score:4, Interesting)
Non-admin rights, client-side file-scanners, web-side black-lists, and user training is the only way malware is going to go away.
Re:There is no cleanup anymore (Score:4, Insightful)
Re: (Score:2)
Only if we don't unify our code, which probably won't happen because people will want to target broad user bases. When code can be compiled on a Windows machine to target a Linux machine, you still have problems.
Re: (Score:3, Funny)
either that or you have to develop a self compiling virus, which has the chance of suffering random code changes and evolving...hmmm
Re: (Score:2)
Is it possible Compaq sold me infected CDs???
I shouldn't have a virus after a brand-new install.
Re: (Score:2)
Re: (Score:2)
I would argue for putting every OS deployment on its own vlan, and then using NAC to make sure they are all properly patched before getting out.
Homogen
Diversity is a healthy thing! (Score:2)
DUH.
Diversity is HEALTHY.
As opposed, for example, to forced quota-based mixing-up. As in college "affirmative action", which serves to homogenize colleges throughout the U.S. based on, of all things, "national averages" rather than
Re: (Score:2)
Non-admin rights are fine to a point. There still can be compromise issues without admin rights. You can still compromise the administrators as well.
Client-side file scanners are and will always be one step behind the bad guys.
Web-side blacklists, while being the best way t
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
Re: (Score:2)
Yeah, 'cause we've seen how great all these methods have worked so far. We're using them for 20 years now and malware's doing better than ever.
You know what I find interesing about all these methods you listed? They all assume that security has already been breached, that malware is on your computer, and attempt to contain damage and patch things up.
Is it just me that finds this
Re: (Score:1)
I wish I had written the Checklist Form For Why Your Anti-Malware Idea Will Not Work already.
Non-admin rights : yeah, right. "Your mouse has moved : cancel or allow"?
Client-side file-scanners : reactive security. Useless. Moreover, there are tons of ways to hide malware so that file scanners don't see them.
Web-side blacklists : Not going to happen. When the file is on the blacklis
Robert Morris, OMG (Score:5, Informative)
http://pdos.csail.mit.edu/~rtm/
You're thinking of the William Morris talent agency in Hollywood, or something. Mods, please correct this.
Re: (Score:2)
Wyrm with Nicely Textured Paisley Wallpaper (Score:2)
Re: (Score:2)
Re: (Score:2)
Some ways to win. (Score:3, Informative)
Prevent any other changes from being made to the system, mount system partitions read only.
Where users are installing software, force it into a sandbox (one for each application). Each sandbox will have limited access to the network, user files and hardware (such as web cams and microphones).
The simplest solution is to never allow software from users to run (mount home partition as no-exec). However, this doesn't cut it much of the time, which is why I would suggest doing something similar to no-exec, but as a sandbox rather then not running the file at all. I'm not sure how hard that would be, but I'm sure it is possible.
(Oh wait, are we talking about MS Windows here? I guess you can ignore what I said then...)
How does a vendor become trusted? (Score:3, Interesting)
Re: (Score:2)
Of course, when it comes down to it, do I trust Microsoft? Well, no, they have a history of making buggy products, ev
Re: (Score:2)
A vendor is someone with a name, a face, a business name, an email, a phone number, a building address and so on. A trusted vendor depends on your criteria and could range from the length of time a vendor has been in operation (i.e. don't trust a two week old start up), the size of the company (a two person job might be less trust worthy then a 100 person place), and other such possibilities.
For PCs in a home environment, would you recommend criteria that shut out software developed and self-published by a micro-ISV [wikipedia.org]?
I don't know of any tool similar to System Restore Points from MS Windows in GNU/Linux land, but dd could easily do a similar job.
Especially considering the more robust separation of programs and read-write data that the *n?x mindset has always encouraged.
Re: (Score:2)
Obviously single developer outfits are going to have more trouble being "trusted" if for no other reason then their signing key is not signed by some key company.
Personally, I tend to be a lot more willing to download random things off the web if:
The software is free software.
The website "smells" clean.
I've heard of the software (or had it recommended to me).
But that's for X/GNU/Linux, what about MS Windows? Well, I'm a lot more war
Who the hell is William Morris? (Score:4, Funny)
Re: (Score:2)
Re: (Score:2)
It further benefits computer shops and geeks who get paid to nuke and pave compromised systems. If Windows were robust and easy to "disinfect" I would have far fewer free computers and less pocket change.
Re:You are absolutely correct, there is no clean u (Score:2)
If we had secure operating systems, you think all the A/V and other companies would make money?
Of course they would. AV and anti-malware software isn't there to replace OS security, it's there for when the OS security has already been circumvented (typically deliberately by the end user).
No amount of OS security will protect the machine from an end-user deliberately running malicious code.
Criminals and Elections (Score:5, Informative)
Between spam, malware, and credit card fraud, the criminals are winning, big time.
The eventual consequence of this is a faltering of trust in our financial systems and economies, and the rise of new kinds of criminal mafias, with billion dollar portfolios. If you thought the mob was scary, wait until you see what rises out of the ashes of the current system.
The solution to this, I believe, is first to limit the information transferred in any transaction to that which is necessary for the transaction (no grocer, you don't need to know where I live); second to implement electronic cash (in the current credit card system you give authorization to perform transactions at any time in the future without verification); and third to establish and teach strong cryptography for communications, transactions, and identity.
But the biggest thing we can do now is get the world's police forces to get off their asses. As long as these things are not prosecuted, criminals will flourish, and they are.
It's time to make this an important issue in elections, before we all lose big.
Re: (Score:2)
Re: (Score:2)
Re: (Score:2)
Re: (Score:1)
tell em no thanks and they would chime in that they could then send you catalogues. well what was my phone number for?
i found it easiest to tell em my name was "jim john joe billybob" and my address was 123 A St. and make up a phone number with the local area code. then complain if they thought it was hokey. i wonder if jim
Throw out 2 level access control! (Score:3, Insightful)
When you need to install something esoteric then you would have to do some more advanced steps but if you are installing something strange then you probably know what you are doing anyway.
This could maybe be combined with some sort of trust network. Say your friend installs something that needs non-standard access rights, they could grant the required permissions and create a new profile. You would have them in your trusted list and would have access to all of their profiles so when you install that application, it can categorise it using the info your friend provided.
I think this system provides a good balance between really fine grained permissions and not blindly clicking through loads of confirmation dialogs.
Re: (Score:1)
Re: (Score:2)
Re: (Score:2)
The whole way security is treated needs to be changed. Having root and an ordinary user just doesn't offer the level of granularity that users need. As a user I want to be able to do everything on my computer, what's really needed is fine grained access control per program. Of course, that has issues with users having to grant those privileges but you could have profiles. Imagine installing Evolution or something and it pops up and says "This software says it's a mail client, does that sound right to you?"
Re: (Score:1)
time to throw malware in jail (Score:2)
Re: (Score:1)
Re: (Score:1)
But either way, it's like trying to change the weather by pissing in the wind. Isn't going to do much, apart from getting you dirty.
The _only_ solution to people using these powerful, complicated tools, without making a complete mess of them, is by adequate knowledge and training.
Until that exists, NOTHING that you do, precaution wise, is going to do a
Re: (Score:1)
"Capitalist" hacking? (Score:2)
What does the theft of personal information have to do with the private ownership and exchange of wealth?
Re: (Score:2)
1) Hack system (manually or via malware)
2) Steal personal information
3) Sell personal information
4) ?????
5) Profit
Does "Hacker for hire" or "For profit hacking" work better for you? The correct term is "Cracker". Either way, it is a capitalist system that they function under. There is demand for a good (personal information). The cracker answers the demand by producing a supply of that good.
NOT William Morris (Score:3, Funny)
There ARE other alternatives (Score:4, Interesting)
There are many alternatives to this, starting with: "Recognize that operating systems which are readily compromised by malware are broken and not acceptable for use." If you choose to use an OS which is so intrinsically weak that it cannot survive exposure to the (unfirewalled) Internet without anti-virus, anti-spyware, anti-adware, etc., then you have chosen poorly, and no subsequent choice you make will compensate for that.
A followup point would be "Understand that it is not possible to 'clean' a malware-contaminated system. The only acceptable course of action is to wipe to bare metal, reinstall, and restore from backups." While it might have been partially true in a limited sense that some malware could be removed by anti-whatever products, that's certainly not the case now: it's much more likely that malware will evade detection and removal. Of course, it serves the purposes of both anti-whatever companies and lazy system administrators to continue propagating this fiction, because if they actually had to scrub and rebuild systems as often as they're infested, they might have to face some hard choices that they'd rather not.
And an excellent set of auxiliary points may be found in Marcus Ranum's The Six Dumbest Ideas in Computer Security [ranum.com], where he enumerates the most egregious (and sadly, most common) mistakes made by nearly everyone, including supposed "experts" with strings of meaningless, worthless certifications after their names.
So there are plenty of alternatives -- but choosing them and implementing them requires vision and insight, two qualities badly lacking in many in the profession.
Alarmist (Score:4, Insightful)
There is a balance to be struck, and "Better safe than sorry" can be answered "better neither than either".
1 Print Page (Score:2)
that's ROBERT Morris worm, son. (Score:2)
Agree with Criminals Winning (Score:1)
Terrorist Malware (Score:1)
Why have we seen no 'terrorist malware'?
I would naively assume that it would be easy enough to buy off the shelf botnet code release it and when it gets to a sufficient size upload something really toxic. For bonus points the attack could be limited via IP address or targeted at idealogically unsound files.
From a practical POV this sort of attack would circumvent the normal surveillance as there is no need to go to terrorist camps, no need to buy suspicious chemicals ...
they would still need to keep th
Re: (Score:1)
No one ever died as a result of a computer virus.
Re: (Score:1)
I think it's more that a distributed denial of service attack, is just plain unexciting on the grand scheme of flying aircraft into office buildings.
No one ever died as a result of a computer virus.
I wasn't really thinking of DoS ... how about on 8th August every infected computer
overwrites its hard disks with copy's the the Lampton manifesto.
There are bound to be a few infected computer in hospitals airports, power stations etc. and it does not matter if they were not attached to anything important, the news story's will be all about how the Lampton worm nearly caused planes to fall, patents to die and 'endangered' the Grimbledown nuclear power plant.
Later on they will move to human interest
Sci-fi - AI (Score:1)
But anyway, one of the ideas it espoused was that malware is what's driving systems development to the point of passing Turing tests. Between captchas, baysian filters, and similar 'proove you're a human' malware countermeasures, with virus heuristics, and malign software detection, you have a very potent 'reaper' process, which kills off substandard malicious code.
The stuff that sticks, is the
Better computer architecture (Score:2)
A so-called "worm" always spreads by injecting and executing its code into a vulnerable process on a remote computer. For example, on an IBM AS/400 it can not do this, because if you overwrite a pointer with data, then it is not a pointer anymore - so it can not be used to address memory (that's why the machine actually has 65 bits instead of 64 bits, the 65th bit is a tag flag that marks pointers. aka pointer in memory protecti