Forgot your password?
typodupeerror
Security Crime The Internet United States IT Technology

Paul Vixie On DNS Changer: We're Dealing With Malware the Wrong Way 163

Posted by timothy
from the should-be-using-branding-irons dept.
AlistairCharlton writes with this snippet: "Victims of the DNS Changer malware think they have better things to do than check their internet security, and as a digital society we're dealing with malware in completely the wrong way. These are the thoughts of Paul Vixie who worked with the FBI in intercepting servers used by a gang of Estonian hackers who made millions of dollars from redirecting internet users away from the websites they requested, directing them to advertisements instead." The linked article also offers an interesting description of how the FBI's quiet takeover of a botnet came to be.
This discussion has been archived. No new comments can be posted.

Paul Vixie On DNS Changer: We're Dealing With Malware the Wrong Way

Comments Filter:
  • by Alranor (472986) on Tuesday July 10, 2012 @09:34AM (#40601363)

    ... the victims would have noticed that their internet was cut off, and had to take steps to fix the problem then and there.

    But presumably somebody at the FBI realised that they could collect all that lovely data on where everybody was going on the internet, and all without the need for a single warrant

    • by fermat1313 (927331) on Tuesday July 10, 2012 @09:46AM (#40601445)

      But presumably somebody at the FBI realised that they could collect all that lovely data on where everybody was going on the internet, and all without the need for a single warrant

      Care to show a source, even a single one, for that? The FBI handled this right, asking ISC to install and run the DNS servers. I really doubt the ISC would play ball with any extra-legal requests for data.

      Amazing how much pure paranoia is modded up around here

      • by h4rr4r (612664) on Tuesday July 10, 2012 @09:48AM (#40601475)

        How is this handling it right?

        Dropping the requests on the floor and teaching these folks a valuable lesson would have been handling it right.

        • How is this handling it right?

          Dropping the requests on the floor and teaching these folks a valuable lesson would have been handling it right.

          We can debate whether just dropping the servers should have happened or not. Personally I think that was correct, as just dropping internet connectivity for a large group of infected people (most of whom wouldn't have a clue about what's going on and how to fix it) would have been far more disruptive than the campaign that attempted to notify people they had a problem and how to fix it (with clickable links that worked while they were on the computer.)

          That said, my original comment about them "handling it

          • by jafiwam (310805)

            Oh christ. Are you that lacking in imagination you can't think of any way that possibly, some techies could spread this out a bit?

            How about, ISPs can run their own campaigns and then voluntarily ask to have their blocks shut off on their schedule?

            Or, the DNS server admins do it on a schedule using simple hash codes. "Hey, ISP, if your IP address block octets add up to X hash, we are blocking it on Monday. If it's Y, it will be next week.

            ISPs themselves could block traffic to these servers slowly to

        • Re: (Score:3, Insightful)

          by kiriath (2670145)
          I appreciate the FBI intervention, it gave people ample time to upgrade their virus scanners and get it fixed - or go to the website that gave them tips on removing it and get it fixed... worst case they wound up with another piece of malicious software and had someone fix it in the interim. Being in direct to customer Tech Support, I was grateful that I did not have to answer a single call regarding this yesterday, and that would not have been the case had they just turned off those servers when they took
        • by zotz (3951)

          I am not so sure. Perhaps instead of sending them to the ad sites, send them to a site that tells them they are infected and that they will get progressively slower responses until they fix things. Then progressively slow their requests down making things more an more painful?

          IOW. make it worth their while to care? Someone is, after all, having to spend extra money to keep them working.

          Or did I misunderstand something here?

          all the best,

          drew

          • by gorzek (647352)

            Apart from making the requests slower, I agree with your suggestion. Allowing an infected computer to proceed without incident isn't something the FBI should've done. Getting those systems fixed ASAP--by letting the user know they were infected and how to remove it--should've been the priority.

        • Dropping the requests on the floor and teaching these folks a valuable lesson would have been handling it right.

          Suppose a cop sees someone walking down the street checking doors to see who's left their houses unlocked. Should he let an obvious burglar continue in his work to "teach folks a lesson" about locking their doors?

          • It's not an unlocked door, it's more like a contagious disease. Whoever leaves the door open, is only damaging itself. Those infected are often letting their computers send spam, spread malware or participate in DDOS attacks. Sometimes the computers in question host fishing sites or even CP, therefore actively harming others. A contagious person should be kept away from the public, a contagious and unprotected computer should be kept away from the Internet.

          • Yes the cop should. Trying a door to see if it is unlocked is not illegal. Breaking and entering is illegal - so yes the cop would be right to wait until a person entered and then there would be an arrestable offense. The very most the cop would be able to do prior to entry would be to stop and search, if there was reasonable suspicion to think the person was a burglar, for burglary tools , which are illegal to carry. But if the person didn't have anything illegal on them, and the cop stopped them before t
          • by h4rr4r (612664)

            No, that would be more like what the FBI did. They allowed infected machines to continue to be useful.

            Dropping the requests would be more like arresting and removing the person messing with doors.

            • by KhabaLox (1906148)

              They allowed infected machines to continue to be useful.

              Did they? I was under the impression that they shut down the C&C servers that the malware was pointing the infected computers to. That was how they were able to (eventually) shut them all off. If the FBI, through ICS, controlled the DNS server the malware was pointing to, how does the malware continue to be useful to it's creator?

              • by h4rr4r (612664)

                It does not, but these machines were still infected with this and likely other malware. You think these machines only had one infection?

          • by jd (1658)

            No you should STOP the burglar and place crime scene tape down, just as they would have done by removing the DNS servers (as evidence) and leaving nothing in their place.

        • by LocalH (28506)

          No, forcing ALL lookups to resolve to a server that gives cleaning instructions and tools would have been better.

          • by DarkOx (621550)

            No redirecting users to a page they were not expecting to see and then encouraging them to run software or blindly make system modifications they don't understand is a terrible idea.

            The right thing to would have been to have a simple message telling them their system is compromised (show a nice FBI logo) and direct them to contact their ISP or a local computer support firm.

            • ...just make sure you don't say the computer itself was compromised, as for many people, the computers on the network are all fine now, but their router has been redirected. I've had to help out a number of people who got nastygrams from their ISP saying their Windows PC was infected with the Alureon virus... people who tossed their Windows PC shortly after it got infected with said virus and switched to a Mac. The trick is that while infected, their PC used the default credentials for their routers to re

        • How is this handling it right?

          Dropping the requests on the floor and teaching these folks a valuable lesson would have been handling it right.

          Hopefully you don't actually work in IT... If you do, I'm sure it won't last with an attitude like that. Dropping requests, and disconnecting users with no warning is almost never a good idea.

          • by h4rr4r (612664)

            I do work in IT, I have been doing it a long time, and it is often the right approach.

            When I got into my current job it was a total undocumented mess, step one was to document who was using what machines, since none of the users had any idea we unplugged the network connections from one machine at a time and waited for the complaints to roll in. In less than a week were were able to find out that more than half of the machines were not used by anyone, and were not at the time running any needed service. We

        • Dropping the requests on the floor and teaching these folks a valuable lesson would have been handling it right.

          No it wouldn't.. Redirecting EVERY SINGE request back to a web server that says "your computer is possibly infected with malware, and after $DATE will stop working, please click HERE to read how to fix it, or who to contact, or click HERE to proceed on to the page you requested.

          That would have annoyed them, educated them, and given them a still working connection. Just stopping all resolving is an ugly thing to have to fix.. especially since its not like they just go look at their IP config, and see the w

          • by arth1 (260657)

            No it wouldn't.. Redirecting EVERY SINGE request back to a web server that says "your computer is possibly infected with malware, and after $DATE will stop working, please click HERE to read how to fix it, or who to contact, or click HERE to proceed on to the page you requested.

            Your presumption that a DNS server can know whether a request was made for a web server or not is incorrect. The WKS record was never used properly, and was abandoned over a decade ago.

            Pointing a user's requests for the IP address of pop3.provider.net or ntp.microsoft.com to a web server will only cause outages, delays and error messages the user won't be able to understand.

            Also, two wrongs doesn't make a right.

        • by Monoman (8745)

          How about resolving all requests to the IP of a web server with a single page explaining the issue to them?

      • by Alranor (472986)

        Aah. Every story i've read (and I haven't paid that much attention to this beyond making sure I wasn't infected), has oversimplified it to "The FBI took over the running of the DNS servers".

        I stand corrected on that point, my apologies.

        I entirely stand by the "they should just have let the infectees internet access die so they're forced to fix their problems and learn about the importance of security" part of my comment though :)

      • Re: (Score:2, Insightful)

        by Anonymous Coward

        I seriously doubt the FBI needs to run DNS servers to get your private data without a warrant. The US government, evil or not, does have an interest in keeping its people's computers safe from non-US gvmt surveillance.

        Remember, the NSA has two goals: getting into your data and keeping its enemies out. Don't forget #2.

      • by Sloppy (14984)

        The FBI handled this right,

        FBI spying paranoia concerned, that's just plain wrong. FBI did nearly the worst thing they could do: they masked the problem from the users.

        If they had allowed the DNS lookups to fail, the problem would have been over in a few days, and dns changer would have been a complete non-story and nearly forgotten a week after the fraudulent servers were taken down.

        Instead, they got involved for no good reason that anyone has explained, somebody spent extra money dealing with it, and th

      • But presumably somebody at the FBI realised that they could collect all that lovely data on where everybody was going on the internet, and all without the need for a single warrant

        Care to show a source, even a single one, for that? The FBI handled this right, asking ISC to install and run the DNS servers. I really doubt the ISC would play ball with any extra-legal requests for data.

        Amazing how much pure paranoia is modded up around here

        Go look at msnbc or fox news or pick your news source - it's no secret. In the USA, the most reasonable thing to do is to assume the government is up to no good lately. It's been that way for about 11 years now. Maybe you are not American so you weren't aware what has been going on? I assume I don't have to post a link to lmgtfy.com, right?

  • by SJester (1676058) on Tuesday July 10, 2012 @09:37AM (#40601393) Journal
    I'm not sure why it's even the government's obligation to "close the deal" (from TFA) and help a victim fix their infected systems. If the victim felt they "have more important things to worry about" than prevent infection, then felt they "have more important things to worry about" than routinely scan their system, AND THEN when told that they were infected they "have more important things to worry about" than fix it themselves and pay out of pocket... maybe the government has "more important things to worry about", too. tl;dr If you didn't wear a condom, and you didn't get tested, and you found out you had syphilis and didn't care - why should I?
    • If it's malware that could spread and infect other PCs, then the government may need to intervene above and beyond simply notifying people. It's not too different than doing something "for the public health". I'm usually all for the government being hands-off, but if they can help stop malware from spreading to my machines (or worse yet, my mother's) and it doesn't cost me too much more as a taxpayer, then I'm all for them. However, I'd rather see them take the Obamacare approach here and "tax" people who c

    • by ftobin (48814) *

      I'm not sure why it's even the government's obligation to "close the deal" (from TFA) and help a victim clean their food supply of contaminants. If the victim felt they "have more important things to worry about" than prevent infection and disease, then felt they "have more important things to worry about" than routinely verify the quality of their food supply, AND THEN when told that their food supply was contaminated they "have more important things to worry about" than fix it themselves and pay out of po

    • Re: (Score:3, Interesting)

      by fa2k (881632)

      It's like if someone left their car unlocked, and did not have car insurance, and they had their car stolen. Then the FBI had to drive them to and from work in a police car for 6 months.

    • Because you are human, and you care about other humans. Otherwise you are a narcissist and on the fast track to corporate success.

  • Cornficker (Score:5, Funny)

    by SJHillman (1966756) on Tuesday July 10, 2012 @09:37AM (#40601395)

    "Taking the Cornficker virus as another recent example of computer malware, Vixie predicts an uncertain future where computer users don't understand or simply don't care about the risks involved."

    Cornficker is related to the Conficker malware, but prefers to fick it's victims with vegetables instead. Many vicitms did not mind.

  • by Lord Grey (463613) on Tuesday July 10, 2012 @09:41AM (#40601413)

    From TFA:

    Summing up, Vixie says: "These victims seem to feel that [they] have more important things to worry about. My gut feeling is that they're wrong, but I can't seem to prove it. My other gut feeling about all this is that we, as a digital society, are doing this all wrong."

    My gut feeling is that International Business Times didn't really have a useful article but needed some more ad space, so they wrote this thing.

    For the few of you considering actually reading the article: There is nothing new to see there. Move along.

    • Totally agree. This is a completely useless article that brings nothing new. Best quote is the last line from the article.

      My other gut feeling about all this is that we, as a digital society, are doing this all wrong.

      ...which I read as: There's a big problem. I have no solutions, but dammit, this is a problem.

    • by grahamm (8844)

      A pity that the article does not give any indication of how he it could be better done. A gut feeling that 'we are doing this all wrong' is not much (practical) use without some idea of how we should be doing it.

      • by tlhIngan (30335)

        A pity that the article does not give any indication of how he it could be better done. A gut feeling that 'we are doing this all wrong' is not much (practical) use without some idea of how we should be doing it.

        That's because there are none that are satisfactory.

        First, we have to accept the fact that computers and the internet are a necessity to participate in a modern economy. Especially in developed nations - where it's extremely difficult to do anything without the Internet, including stuff like apply f

        • by Todd Knarr (15451)

          With that under our belt, the next thing to realize is that we can't expect the entire population to become computer experts. Cars are a necessary evil as well, but we don't expect the entire population to become a mechanic, either.

          We do, though, expect people who drive to know the basics about cars. If for instance you insist on driving on bald tires, when they inevitably blow out on the freeway we don't provide free towing and free replacement tires. And if the blow-out caused you to hit another car, the

    • by jd (1658)

      The correct way IS to be disruptive. Be as disruptive as possible. Evolve or perish is the whole of the law. Complacency allows the least-fit to survive as "captains of industry". And we found out with the Titanic what happens when an unfit captain is left in charge. Why repeat the experience?

  • This solution is not perfect, but it is the only one yet devised that doesn't require allowing some third party to either access arbitrary computers and the data on them at will without the user's knowledge or consent, a warrant, or even suspicion of wrongdoing, or to assume complete control over what can and cannot be installed on a computer.

    Neither of these is acceptable. The ends don't justify the means.

    • by h4rr4r (612664)

      There seems to be one solution you over looked, just turn off those DNS servers and let the users figure it out themselves. I am sure the loss of name resolution would have been noticed.

      Another approach would be to make any requested url return a page that showed only a simple declaration that your machine is infected get it fixed.

      • by Millennium (2451)

        What the article seems to call for is a system that does not expect anything from regular users.

        The people who reject the FBI's approach would also reject the one you propose, because ultimately it still expects something of users (namely, to notice something is going on and to take steps to fix it). Yes, it's a trivial expectation, but the core assumption behind the article is that expectations are bad.

  • by speculatrix (678524) on Tuesday July 10, 2012 @09:44AM (#40601433)
    "I'll get round to doing backups one day"

    "I'll renew my antivirus licence next day pay"

    "The cheque is in the post"

    "I'll pull out in time"

    All are the many lies people tell themselves and each other.

    Basically as humans we tend to only do things which will have an immediate impact, and are capable of doublethink over things which might not happen or can be deferred.
    • by Chrisq (894406) on Tuesday July 10, 2012 @09:50AM (#40601491)

      "The cheque is in the post" "I'll pull out in time" .

      Hey, is that you Dad?

  • why did the hackers think they were ever going to get away with it?

    it is a brutally effective hack, but...

    1. they thought no one was going to notice?
    2. and if they noticed, no one was going to do anything about it?
    3. and if anyone was going to do anything about it, they didn't see the glaring weak point that would so easily undo all of their hard effort?

    commandeer your rogue DNS server. duh!

    how come these hackers spent so much time energy and effort in a scheme so easily undone?

    this not a matter of "oh, it's easy to point problems in hindsight". these guys obviously had the intellectual capacity to think through the technical requirements of their hack. so they obviously had the intellectual capacity to think through the tactical requirements. none of them said "it will never work: single easy point of failure."

    "These are the thoughts of Paul Vixie who worked with the FBI in intercepting servers used by a gang of Estonian hackers who made millions of dollars from redirecting internet users away from the websites they requested, directing them to advertisements instead."

    well ok, jokes on me: they realized the weakness, and they bet the authorities were going to react slowly, and they won the bet

    • by jd (1658)

      The problem with DNS poisoning is that DNS caches change slowly. Also, DNS is often slow and unreliable so zone transfers to locally mirror the bits of DNS needed is a fairly routine practice. This keeps the poison in the system.

  • An entire article about the shutdown of the servers and one "We're doin' shit the wrong way" comment becomes the title without any further explanation. Pardon the car analogy, but that like saying "A Ford Pinto will explode if rear-ended. This is a major safety issue. We're addressing auto safety the wrong way." What the fuck does that mean exactly? Would you care to make a suggestion as to what's wrong with the current approach?
  • by SlashDev (627697)
    Let me take this opportunity to ask you to please update CRON to allow per second frequency. Thank you!
    • by higuita (129722)

      10 04 * * * sleep 15 && /usr/local/bin/comand.sh

      done, its fixed

    • If you need run something every second why not have it be a persistent application? If you want cron to do it it's a pretty trivial hack to do so.

  • by nitehawk214 (222219) on Tuesday July 10, 2012 @09:55AM (#40601527)

    Vixie predicts an uncertain future where computer users don't understand or simply don't care about the risks involved.

    As opposed to today when uhh...

    At what point did the average home user understand or care about security? We should consider ourselves lucky that service providers at least pretend to care about security these days. Any home user that can understand computer security policy and practice is most likely in the industry, or trained to do so.

    Now a High School / GED level computer security class might sound hilariously basic for someone on Slashdot; but might be as useful as drivers ed classes for the masses. Sure there are morons that will drive/compute unsafely no matter what training, but some basic learning on how to protect one's self would really help intelligent people that just don't know better.

    • by jd (1658)

      Today, computer users don't understand AND simply don't care about the risks involved. Since it's a boolean AND, not a boolean OR, there's no uncertainty involved.

  • by wkcole (644783) on Tuesday July 10, 2012 @09:55AM (#40601529)

    As has become all too common the /. summary is linked to a negative-added-value article at the totally worthless IBT.

    Paul's actual post is at CircleID: http://www.circleid.com/posts/20120327_dns_changer/ [circleid.com] and is over 3 months old. Not news. As is normal for Paul it is well written and smart but if you've been following DNSChanger, you've read this already.

  • >> Paul Vixie

    Not a bad porn star name. Or is he just a huge Fox and the Hound fan?

  • Behavior not new (Score:4, Interesting)

    by Guppy06 (410832) on Tuesday July 10, 2012 @10:05AM (#40601619)

    Victims of the DNS Changer malware think they have better things to do than check their internet security

    Victims of food poisoning think they have better things to do than check their food safety. Victims of STDs think they have better things to do than practice safe sex. Victims of car theft think they have better things to do than lock their car doors. Victims of lightning strikes think they have better things to do than to seek cover in a storm.

    Humans have always engaged in risky behavior, and generally for the same old reasons. You can educate those willing to listen, but you can't force those who won't.

    • by jd (1658)

      Yes, humans have always engaged in risky behaviour. And when done appropriately, this works extremely well. With appropriate risk-taking, you can maximize your benefits and minimize your costs.

      Of course, there's always INappropriate risk-taking. The Darwin Awards are based on one form, the Gor novels on another.

  • In a discussion with a network capacity planning firm some time ago, the discussion turned to the amount of outgoing spam that ISPs let flow out of their systems, while at the same time madly filtering incoming spam.

    A defence in depth would arguably be more effective, as much as four times as effective for the same amount of work, and probabilistically even better.

    The arguments we heard were that the ISPs could not legally block their customer's outgoing mail. In fact, the same applied to blocking thei

    • by fractalus (322043)

      I already get spam that pretends to be my mail server and instructs me to open the attached file to figure out why "my" message was rejected. Do we really want to encourage this pattern?

      • by davecb (6526)
        Don;t make them click anything, and include a warning about fake virus checkers asking them to click...
  • by erroneus (253617) on Tuesday July 10, 2012 @10:23AM (#40601721) Homepage

    It's at the core of all the problems. Many see the internet as [near]-free advertising and easy and anonymous commerce. Trust is placed in all of the wrong places.

    This, of course, was all inevitable. We are not going to overcome human nature, impulse or desire. There were things that could have been done to prevent that. The internet was not designed for or intended for the uses we have put it to today. But even in its early days, people were quite annoyed by mass emails among many other things. So I guess I am saying "they should have known" and should have adjusted and updated the internet's protocols with these problems in mind.

    The internet was not considered a "public internet" initially and so there was a weird notion that everyone can and should trust one another. People will always ruin Utopia. It is easier to blame the few than to blame the masses and it is the masses who are "ruining" the internet. The few who engineered the internet could have and should have done things to fix it. Now the standards and protocols are pretty much at "critical mass" and they are "too big to change."

    • by jd (1658)

      Within 24 hours of the Salt Lake lawyers spamming Usenet with advertising and publishing a book on how to pervert the Internet into an electronic billboard, it was obvious to 99%+ of the community that protocols needed replacing.

      Since that time, the other 1% have ripped ALL the security features out of IPv6, deprived the Internet of electronic congestion controls, exterminated network neutrality and otherwise done everything that 1%-ers usually do to make life hell for the 99%.

      We really need an Occupy Gophe

  • One of the basic problems today is when you buy as PC it doesn't come with an administration service. You, the purchasor are expected to "figure it out". Well, most people do not and that clearly should not be news to anyone. The result is that there are a lot of computers that are causing trouble for everyone on the Internet.

    Who should be responsible? Clearly not the computer owner unless we start enforcing some education requirements and have real penalties for allowing your computer to be used for cr

    • There are really only two options... either turns computers into centrally managed appliances, completely restricting a user's ability to do what they want with them, or set up a computer use licensing system akin to a drivers license, and you need to be able to pass a test for basic competence before being allowed to purchase one.

    • by Sentrion (964745) on Tuesday July 10, 2012 @12:27PM (#40603265)

      Wasn't this the original intent of the web browser? Rather than connecting your computer to a network of other PCs and running executable files, internet users would be able to set up "webpages" using a markup language that did not execute code on the computers of others who were only viewing the webpage. Drive-by virus downloads were not even possible back in 1995 or 1997 when web browsers actually "browsed" the internet. But browsing endless pages of text, sound, graphics, pictures, GIF animations and even motion video was not enough. Users wanted more interaction. They wanted in-browser games rather than playing stand-alone games in multiplayer mode. They wanted interactive web applications that could perform calculations, not just read back text and pictures like a magazine. Rather than standing against the demands of the uneducated masses due to the risk of anonymous cyber criminals hijacking their machines, HTML was enhanced with JavaScript, Flash and other exotic tools. The browsers made add-ons available and later these functions were buried and integrated deep within the next release of the bare bones browser. Like a boy crying "wolf" the browsers began warning users of the dangers of clicking a hyperlink, allowing cookies, allow scripts, leaving a secure site, certificate missing, etc. while at the same time very few of the websites users needed to see could be accessed without these warnings. Naturally the users began to dismiss most if not all of the automated warning notices. With time the scale and bloat of web browsers increased to surpass that of whole operating systems of old. Plug-ins, pop-ups, location sharing, data mining cookies, and notifications became standard industry practice. The malware hackers had endless fun with the complex, bloated, and vulnerable layers of code that left gaping exploits such that even a benign jpg image could become the carrier for a globally devastating virus. Hackers were even able to add malicious code to legitimate sites. Before long the intrinsically safe browser became the PC users most vulnerable liability.

  • As the page rendered in my browser:
    """
    At its height, DNSChanger infected four million computers in 100 countries, with around 300,000 still under its control - something many victims are unaware of and unable to fix.

    Like us on Facebook
    """

    I'm sorry they're unaware of and unable to fix themselves, and therefore still under DSNChanger's control, on Facebook.

    Or vagina.
  • Well gee... they have better things to do than worry about internet security? Well *I* have better things to do than worry about cleaning up after their incompetence and lack of responsibility.

    Being hit by malware sucks. But being hit by malware because you actively refuse to take even basic precautions... well, you deserve anything that happens to you. It's like willingly walking into the middle of a warzone and then complaining because you got shot.

  • This DNSChanger thing is the biggest non-story I've seen since Y2K. This thing had 4 million clients across 100 countries. It seems to me that is pretty close to nothing. By the time of the shut off, I saw multiple numbers in the 300k range. Now that is the same as nothing as far as the Internet is concerned. I agree with the folks who say they should have just turned them off and walked away. But hey if ISC wants to do the work on their dime, that is very generous of them, I just wouldn't have bothered sin
    • by jd (1658)

      Nothing happened in 2000 not because Y2K was a non-story, but because the IT industry practically doubled in size for 3 years to fix billions of programs on a global scale.

  • by Tony Isaac (1301187) on Tuesday July 10, 2012 @03:49PM (#40606277) Homepage

    "...we're dealing with malware in completely the wrong way."

    So what would he suggest?

    Many problems in technology, computer-related or not, can take design lessons from nature. Nature's methods tend to be very elegant and ingenious, worth replicating in the digital world.

    How do our bodies deal with viruses or other organic "malware"? Antibodies may be the best analog to antivirus software, as they work in a very similar way. White blood cells are more intelligent and active, possibly more like heuristic algorithms applied network-wide. Barriers (skin) functions something like firewalls.

    I have to disagree with the author. We're not doing it all wrong. We just need to keep looking for new ways to make it harder for malware to survive. Yes, it's an arms race, it always will be. Same as nature...we learn to conquer bacteria, only to have superbugs crop up, that are resistant to antibiotics.

    Malware is a fact of life, both digital and organic.

I judge a religion as being good or bad based on whether its adherents become better people as a result of practicing it. - Joe Mullally, computer salesman

Working...