expert misuse of the term "virus"

in the past, the argument many experts have used against putting in the effort to actually correct people's misconceptions about what a computer virus is and what it does and how it's different from other forms of malware have centered on the idea that it doesn't really matter to a victim what kind of malware they have. when they have malware on their computer, all they care about is getting rid of it. i can understand this school of thought, even though i've never agreed with it. however, the world has changed. 

this is a post stuxnet world and defenders/victims aren't the only ones we need to consider anymore. we now have people barking orders to create digital weapons, and the details of those orders matter. if they say make me a virus then someone will make them a virus even if they didn't understand what they were asking for - and there's evidence to suggest they don't. 

stuxnet is generally believed to have been a targeted, covert operation, but it used a noisy, untargetable* type of malware - a computer virus (or more specifically a worm). there were and are better ways to achieve the ends we believe the creators of stuxnet were after, so one can only assume that high level decisions were made in ignorance of the differences between malware types and the consequences those differences would have on that type of operation.

the question, then, of whether to put in the effort to educate people about the proper use of the term virus can no longer be answered by looking exclusively at the victims who want their computers to be clean. it is now also necessary to consider aggressors who want to use malware as a weapon to serve national interests. as misguided as such behaviour is, we have to accept that it's happened and will continue to happen, and actually knowing the differences between malware types may mean the difference between a surgically precise operation, or one with a lot of collateral damage. 

this isn't to say that i think we should start helping aggressors create and/or launch their digital weapons. i still don't believe in helping the bad guys, and even if i believed such nationalistic aggressors weren't bad guys (which i don't), i don't believe there's any way to help them without also helping those who are much more unambiguously bad. what i am saying, however, is that this particular form of ignorance that experts have been too lazy to address can cause real harm and ignoring it means ignoring the opportunity to reduce the unintended harm such people will cause.

(*many believe stuxnet was highly targeted, but there's a distinction to be made. while it's destructive payload was highly targeted to a very specific environment, it's self-replication was not - it spread far beyond it's intended target)

how can you know who to trust?

there are a lot of conflicting messages out there concerning malware issues and so naturally one is faced with the question of who do you trust to give you the right information?... i'd like to say that this an easy question to answer, particularly because i don't have a big problem separating the wheat from the chaff... however, the fact is that i've spent years honing that particular skill and, with numerous examples of everyone from ordinary users to security experts choosing to either listen to or be people suffering from false authority syndrome, the evidence suggests that it's really not as easy as it ought to be...

with that in mind i thought i'd share my own mental processes on this subject in hopes that it might raise the bar, even if only a little bit... now i'm not going to just tell you to listen to the experts; for one thing that just shifts the onus on to how to figure out who's actually an expert or not, but also because that can be a little more exclusionary than it needs to be (for example, it excludes me, and if you shouldn't be listening to me then you should stop reading this)... here's what i am going to tell you, though - what to avoid and what to look for...

here's what you should probably avoid:

• famous people / big names - being famous on it's own doesn't make one smarter, it doesn't make one more accurate, more capable, or more in tune with the truth... fame is pretty much orthogonal to the truth...
• the media - their power to elevate the audience is matched only by their failure to do so... their job, ultimately, is to make their content look better/more important/more interesting than it is in order to sell advertising and thus make money... their is no motivation for them to present the unmodified / unhyped truth...
• vendors, or at least the marketing departments thereof - one need only search this blog for references to the term snake oil to see examples of why their words need to be taken with a grain of salt... marketing's interests are aligned with the company's interests rather than the publics interests...
• experts in some other field - though many experts seem to not be aware of this fact, expertise is non-transferable... you could be a genius when it comes to networking but that doesn't mean you know the first thing about malware...
• crowds - the wisdom of crowds is not universal, especially not where malware is concerned... in malware it usually turns into the wisdom of mobs, or digital maoism (to borrow a term from jaron lanier)...

all that being said, here are some of the things you should be looking for:

• relevant (malware-related) credentials - this means some kind of significant experience that's relevant to the field; maybe it's professional experience, maybe academic, maybe something else, but relevant credentials are the first and probably most important thing you should be looking for when trying to decide whether someone knows what they're talking about in this field...
• consensus with those who have credentials - just because someone doesn't appear to have credentials themselves, that doesn't mean they can't know a thing or two about the field... if what they say agrees with what those who do have credentials say then perhaps they do know something... this can be particularly significant when combined with past performance...
• past performance - if someone is right (or appears to have been right) most of the time about the subject then there's a good chance they'll be right in the future too...
• impartiality - all the credentials in the world won't matter much if someone has a vested interest that isn't aligned with the publics interests... the extent to which this matters depends a lot on the message; the easier it is to objectively and independently verify the information the person is giving, the less impact a vested interest can have...
• does it make sense - there comes a point where you'll have gained enough knowledge of the field that the idea being presented will just click and you'll be able to judge the message itself rather than having to worry about whether the person sending it knows what they're talking about and is impartial...

nothing is foolproof of course, even being an expert yourself won't guarantee that you are only trusting the right people...

(and now that i've written this, i suspect that it can apply to fields other than malware as well)

the end of security experts

no, i'm not talking about some sort of apocalypse that's going to wipe out all the security experts, i'm talking about the fact that the very notion of a security expert is starting to become ridiculous...

what's brought this line of thinking on is the raging false authority syndrome being displayed in the security community over the recent consumer reports contraversy... everywhere i look i'm finding so-called security experts offering their opinions about how the anti-virus community is overreacting or people citing security experts when discussing virus related issues...

i have a computer science degree, does that make me an expert in (or qualified in any way to talk about) artificial intelligence? no... sure AI research is a computer science discipline but my computer science background was not in AI... in fact there are a number of computer science disciplines which are so far outside of my experience that i know better than to open my mouth about them most of the time... too bad this doesn't hold true for the computer security community...

see, the security domain is not a simple one and it's not getting any simpler as time goes by... it's a complex and diverse set of quasi-related fields and specialized disciplines and the reality is that it's no longer possible (and hasn't been for some time) for any one person to have expert knowledge of them all... so what we have instead of security experts are experts in some specialized security subdisciplines with good heads for a lot of the more generic security concepts... they call themselves (or are called by others) security experts but that's not really what they are, and the knowledge from their own particular area of expertise is not necessarily applicable to all other parts of the computer security domain...

that doesn't stop them, however, as the consumer reports contraversy clearly illustrated... anti-malware in general and anti-virus in particular is a highly specialized discipline that deals with a kind of threat unlike anything else currently in the computer security domain... unfortunately we still have security experts saying viruses artificially generated in a lab represent the real world more accurately than viruses from the real world, or likening the threat posed by viruses to the threat posed by remote code execution exploits, or that the only reason the anti-virus companies reacted the way they did was because consumer reports made their products look bad (in spite of the fact that retrospective testing does the same thing, or the fact that some of the companies complaining weren't even included in the consumer reports test), etc...

if these people have no real background in the anti-virus field, why should what they say about virus issues be given any weight above that of a novice? because they're security experts and the anti-virus field is part of the security domain? please - security experts are not experts in all the security related disciplines, usually only one or two... most don't even bother to get enough of a taste of the other disciplines outside their area of expertise to know the true extent to which their own knowledge can apply there, otherwise they wouldn't behave like authorities on subjects for which they quite obviously have no real qualifications - the epitome of false authority syndrome... most security experts have no appreciation for the limitations that computational complexity places on detection techniques, or for the autonomous nature of the threat, or the environmental conditions that caused the anti-virus community to evolve the way it has, or any of a myriad of other details that are required to be a true authority in the anti-virus field...

the title of security expert is dead, it just doesn't know it yet... it doesn't mean what people think it means anymore, it's just a way of putting on airs... next time someone gets called or calls themself a security expert ask yourself "is that like an animal expert?" and then ask yourself if you have a question about a particular type of insect, do you want to talk to an animal expert or an entomologist?...

what is an expert?

an expert is someone that YOU feel has advanced knowledge or skills in a certain field...

the classification is an entirely subjective and personal matter... calling someone an expert is a sign of respect that a person or persons can show to another person, however there are certain ways in which the label can lose it's meaning...

one way the title of the title of expert can lose it's meaning is when the the person holding the title of expert gave him/herself that title... this is the self-proclaimed expert that most people recognize as not being a REAL expert, at least when they recognize that the title was self-given... you see it's easy to identify a self-proclaimed expert when the person actually calls themself an expert, but it can much harder to identify them when they simply act like they're experts... one tell tale sign of an implicit self-proclaimed expert is making claims and then failing to back them up in a reasonable and logical way... it's not always so clear, however, so the line between the implicit self-proclaimed expert and the person who is just confident that s/he is right can become quite blurred... that's one of the reasons why i occasionally take it upon myself to explicitly state that i am not an expert, so that people won't mistake me for a self-proclaimed (or even real) expert...

another way the title of expert can lose it's meaning is when it's applied through the 'friend of a friend' approach... this is where person A says person B is an expert and instead of taking that declaration with a grain of salt (as one should) and determining for yourself if person B really deserves to be called an expert, you simply take person A's word for it for whatever reason... this effectively gives person B respect (your respect) that person B hasn't earned - and respect is something that should definitely be earned, not just given away...

back to index