suggested reading

geez, i need an alarm clock to remind me to do this or something...

• PC Got a Virus? Consider Getting Help Offline - Security Fix
  well it just goes to show, if you can't trust a suspect machine to report it's own infection state (as the saying goes) then you certainly should trust it for making online purchases
• Multi-Layering and User Education: a random thought from AVAR | ThreatBlog
  one of my favourite topics - user education, and an interesting framing to boot... user education as simply another layer in a multi-layered defense... not only does that correctly imply that it's inherently an imperfect control just like all the others, it plants it squarely where it belongs - along side all the other controls, all working in unison...
• hype-free: Actively working against security...
  this sound eerily familiar, but lets not talk about where i've heard this before... all i can say is i've always known it was a bad idea, and i don't care if the customer's departments don't co-operate with each other - either get buy-in from IT or go over their heads to force co-operation, but don't surreptitiously bypass their security defenses just because it's an inconvenience for you...
• Andrew Hay » Blog Archive » Tactics Must Evolve
  security pros need to be students of military history and tactics? hear hear... i know security isn't really like warfare but strategy and tactics are a much bigger part of security than some people wish to admit
• ThreatExpert Blog: How to Defeat Koobface
  great post - i always like to see people identifying exploitable weaknesses in malware
• Scammers Evade Spam Filters by using Email ‘From’ Fields | TrendLabs | Malware Blog - by Trend Micro
  i almost laughed when i saw this - it seems so obvious now, why hasn't this happened sooner? (or has it?)
• iSpy an iPhone Spy - F-Secure Weblog : News from the Lab
  well what do you know - mobile malware for the iphone... i know some people don't count these sorts of tools as malware, but this is the very picture of spyware, just like neo-call's spyphone or vervata's flexispy...
• Roger Thompson: Awww.... puppies!
  scamming with puppies... the bad guys are sinking to new lows...
• Major Web browsers fail password protection tests | Zero Day | ZDNet.com
  i've always said it was better to use a password manager that was separate from the browser and unable to respond to content on webpages (because some 3rd party tools are just a little TOO integrated) but now i actually have figures to point to show why
• Lois Lane and the Craigslist fake landlord scam - Graham Cluley's blog
  a super(b) example of scamming a scammer
• Most Abused Infection Vector | TrendLabs | Malware Blog - by Trend Micro
  always interesting to find out which methods of attack are the most active... right now it seems to be downloads (though apparently not drive-bys) and droppers (not surprised at all about that one)...
• Is there no end to the AutoRun madness? | Zero Day | ZDNet.com
  a good comparison of the autorun infection vector across multiple versions of windows
• Graham Cluley's blog - Facebook data loss fiasco
  i got one of the same emails graham talks about here - yes folks, facebook is training their users to be phishing victims...

suggested reading

• As stock market drops malware rises - PandaLabs
  it's not even marginally novel to suggest that malware authors take advantage of the emotional reactions people have to significant world events, be they tsunamis, ice storms, or presidential elections... thus, it it shouldn't come as any great surprise that when people feel their personal finances are vulnerable they are more likely to fall for fake security software, ironically in an attempt to better protect themselves...
  
• Schneier on Security: The Neuroscience of Cons
  schneier says fascinating and i have to agree... i just wonder how well this applies to the kinds of social engineering we see in malware and related online threats...
  
• ThreatExpert Blog: McColo - Who Was Behind It?
  the story behind the story of mccolo... i wonder what the rap group's connection with the carders was (ie. why were rappers sending out their message for them)...
  
• White Listing – The End of Antivirus??? | ThreatBlog
  another balanced whitelisting opinion... i especially like the airbag vs seatbelt metaphor at the end... blacklists and whitelists complement each other, folks - one is not a replacement for the other...
  
• Shoulder Surfing a Malicious PDF Author « Didier Stevens
  interesting post about a couple pieces of pdf-embedded malware... the takeaways are 1) malware authors are STILL not great programmers (seems like script kiddies are packaging their 'work' in other files now), 2) incremental update functionality allows script kiddies like this to 'show their work', and 3) script kiddies don't learn from the past (re: formats that contain unique identifiers - might want to ask david l smith about the consequences of that)...
  
• Spire Security Viewpoint: WabiSabiLabi Update
  wabisabilabi to close? sounds like good news to me... auctioning off vulnerabilities is a slippery slope that leads to providing a financial incentive for the general public to create attacks, which really isn't a precedent we as a society should be setting...
  
• Pirates and Internet Crime - F-Secure Weblog : News from the Lab
  one of the most salient points i've seen made about online crime in a long time... it is indeed as much a social problem as it is a technological one - it is a subset of crime and the reasons for it's existence or it's driving factors are the same as those for conventional crime... so long as those social factors exist so too will crime (both online and offline)...
  

suggested reading

• ThreatBlog » Blog Archive » Giving (Samples) to Charity
  responsible sample handling is very important and, from what i've seen, very misunderstood... i wrote about it myself quite some time ago but it's something that bears repeating and david harley does a good job of explaining what's accepted/expected in the anti-malware industry/community (as opposed to seeming to put one's foot down, as i did)...
• ICMPECHO · Malware landscape in 2020?
  interesting question/answer about the future of malware from daniel nystrom... there's just one thing i think he missed - if the the past was about fame and the present is about fortune, power/influence seems to be the logical next step... no idea when we'll get there, but as we grow more connected and dependent on technology it will become more and more feasible...
• hype-free: Popular ideas about AV
  here, cdman reminds me of what i can't stand about slashdot and similar sites - it's a mob of clueless people who somehow manage to influence the thinking of other clueless people... if only there were some way to get them to spread the right idea instead of the wrong one...
• hype-free: Stepping beyond the vendor-centric security solution
  good post on the importance of understanding the threat and the tools as opposed to listening to marketing (stop listening to marketing!)... the wording reinforces the av = 'blacklist only' impression most people have, but other than that this is a good post with xkcd-style graphics (for people who need diagrams in their explanations - hmmm)...
• Virus Bulletin : VB2008, Ottawa - conference slides
  no, i'm not going to cherry pick out the best ones... it really doesn't take long to flip through each one... use your best judgment about which are the most interesting to you...
• Sunbelt Blog: Virus Bulletin 2008 keynote address
  great presentation about the perception of the av industry by both consumers and enterprises... also a great observation on why enterprises are less satisfied - it's scale... everything fails sometimes but when you're dealing with thousands of machines the problem posed by those occasional per-machine failures is magnified... the law of large numbers is not your friend in this context... this is not an easy thing for someone to put into the proper context (unless they've got a really good handle on finite mathematics) so the resulting perceptual bias isn't too surprising...
• hype-free: Everything is grey
  an unfortunate observation about the virus bulletin conference this year... everything may be shades of gray these days, but i'm still an uncompromising s.o.b. who only sees black and white...

suggested reading

• SecuriTeam Blogs » Worditudinality
  rob slade on why technical jargon, unlike normal language, should not be considered 'living'...
• The Security Catalyst » Catalyst Conversation Starter: The High Cost of “Freeware”
  interesting observations by michael santarcangelo about the hidden costs of freeware security... i think the secret to keeping the cost low is to know the right programs to pick or the right people to ask, but his experience should give the vendors of the products he examined (and those like them) a reason to reevaluate what they've been doing...
• ThreatBlog » Blog Archive » VirusTotal is not a Comparative Analysis Tool!
  that's right, it's not... nor does it accurately represent the detection capabilities of the products it uses... but is that going to stop the naysayers from continuing to use it as 'proof' that av sucks? not as long as it continues to serve as a source of confirmation for their confirmation bias...
• hype-free: Autorun malware
  this has a good description of the autorun feature and a number of ways to disable it

suggested reading

• Don't be naive: computers will never be secure | Phil Hendren - Times Online
  a great article about the impossibility of total security, the inevitability of security weaknesses, and the responsibility of individual users to take care of their own security...
• The Art Of Noh: The dark side of teaching
  another look at teaching malware writing in schools, this time from someone once faced with such a curriculum...
• Sampling a Malicious Site « Didier Stevens
  a nice little video showing the extraction of malware from a malicious site...
• TaoSecurity: Microsecurity vs Macrosecurity
  an interesting delineation between two security approaches...
• Spire Security Viewpoint: Response to Schneier on Full Disclosure
  some interesting thoughts on vulnerability disclosure (and indeed, vulnerability research itself) that don't often get heard above the din produced by the full-disclosure-or-bust crowd...
• Removing Malware With a Live CD « Didier Stevens
  i highlighted the f-secure livecd when they wrote about it on their blog so it's only natural that i'd also highlight a video demonstrating it's use as well...
• An Unexpected Demonstration of Mobile Security - F-Secure Weblog : News from the Lab
  an intersection between the concepts of mobile malware and old malware, showing that even in the mobile market old platforms (and thus old malware) can still be found and still cause (some) problems...
• AMTSO Blog » Blog Archive » Principles and Guidelines available for download
  a good read if you're at all interested in how anti-malware products *should* be tested... i like that the very first principle is to not endanger the public - it's very reminiscent of "above all else, do no harm"... it's a principle that's fairly well established in the mainstream anti-malware community but seems to be noticeably absent elsewhere...
• ThreatBlog » Blog Archive » It Doesn’t Hurt to Ask
  this isn't the first time randy has underlined an easily exploited weakness in a social engineering scheme, and hopefully it won't be the last... "ask now, click later" indeed...

suggested reading

oops, a little on the late side, but not by too much...

• Chris Quirke's Blog: Should You Detect Old Malware?
  another perspective on old malware
• F-Secure Rescue CD 3.00 - F-Secure Weblog
  tools like this need to get more attention - outside the box analysis is the best way to deal with stealth and other malware defense mechanisms...
• Devil's Advocate Security - Malware Analysis and Response: A Quick Howto
  i dunno why, i just like to see more approachable examples of malware incident response like this... i could almost see more or less ordinary people learning a thing or two from this, unlike those policy document driven enterprise level procedures...
• Infectious Music, Malware-Style | TrendLabs | Malware Blog
  interesting - i'm not sure if i'd call it infection but the fact that the music still plays after the 'codec' is downloaded is a neat twist...
• Vulnerabilities in AV software - McAfee Avert Labs Blog
  looks like i'm not the only one who saw fud in that '800 vulnerabilities in av software' report... this entry doesn't take as hard a line as i did, but there was a much more indepth analysis...
• security religions (terminal23)
  this is actually an older post but i've been wanting to comment on how good it is because after reading it i'm finding a lot of things i see falling into one of the two 'security religions' described here... now if only it didn't make me want to let things slide when folks are seriously wrong/misguided...
• The End of Exponential Malware Growth? - McAfee Avert Labs Blog
  this is perhaps one of the best pieces of news i've heard in a long, long time... i'll take it with a grain of salt because it almost seems too good to be true but there seems to be indications that malware growth has plateaued... i hope that continues...
• Matasano Chargen » Internationalization of Malware
  finally an explanation of why internationalization of malware matters - and that is the contextual information found in the strings in the binary... i'm still a proponent of entirely functional definitions/classification, but at least now i know why other people are concerned with this issue...

suggested reading

• TaoSecurity: What Would Galileo Think
  don't know if i agree with it yet or not but interesting none-the-less to think about whether you can arrive at (or approach) a secure setup by experimental procedure... my gut says it'll only lead to resistance against whatever attacks happen to be current... in other words i suspect it would be weak against real novelty (and we already know something that's weak against novelty, don't we)...
• ThreatExpert Blog: New Rustock Switches to Hotmail
  in answer to the rising use of traffic monitoring to detect malware, malware authors will start making their malware operate the same way you do - and this webmail-using spambot is an excellent example...
• Schneier on Security: Ransomware
  i often think bruce should stick to his strengths when he starts talking malware but in this case he's got it bang on.... ransomware should be a non-issue - when recovery is as easy as restoring from backups then why give it so much special attention?
• Jeremiah Grossman: Why most WAFs do not block
  jeremiah brings us an interesting quote from dan geer concering default-permit/default-deny along with a discussion of it's implications for webappsec... the quote itself is perfect, though, and i suspect it applies to just about every branch of security... it certainly has some strong implications for application whitelisting...
• T2W --> Trojan to Worm - PandaLabs
  and people think worms and viruses are going extinct... they aren't, they're just a feature that's gone out of fashion like stealth did for a while - and like stealth they'll come back into style at some point and tools like this will help that happen...
• and I say we are detecting between 400,000 and 10,000,000 malware! - McAfee Avert Labs Blog
  an excellent post on counting malware threats - the take-away is that the most bloated numbers are those based on samples rather than variants or families due to having multiple copies of what is for all intents and purposes the same threat...
• R.I.P. CISSP | tssci security
  anyone recall me forecasting the end of security experts? i doubt i'll make any friends by saying so but this is a symptom/manifestation of what i was talking about before...
• Errata Security: Apple malware
  0-day or 1-day exploits for the mac in the wild... neither alternative is good and these are things more mac users really need to pay attention to - too bad most have been trained not to... some have made a point of saying that despite vendors reporting it to be in the wild there's no evidence that it actually is - you have to congratulate such people on knowing more than the folks whose business it is to know these things...
• Another way of restoring files after a Gpcode attack
  hahaha, after all these years the folks making gpcode still haven't figured out how to implement a cryptosystem properly - the ability to use plaintext/ciphertext pairs to decrypt other ciphertext tells me they don't understand stream ciphers like rc4 at all... apart from the various steps one needs to follow to use rc4 safely, they might want to consider that unless they're encrypting an actual stream there really isn't much reason to use a stream cipher...

suggested reading

changing the name of these posts due to a change in frequency... it won't be weekly anymore (that was starting to feel like noise), don't expect to see another until the end of the month...

• Schneier on Security: How to Sell Security
  so apparently we prefer sure gains and taking a risk with our losses - an interesting discussion of the bias in our decision making process...
• ThreatBlog » Blog Archive » The Race to Zero
  yet another response to the race to zero (credibility) contest... randy nails it by pointing out that it's a script kiddie contest, and then nails it again by observing the lack of spine on the part of the organizers...
• ThreatBlog » Blog Archive » The AV Industry from the Outside In and the Inside Out
  another great post from randy... i've said a number of the same things about the industry in the past but i'm afraid i've never really been able to credibly relate this perspective on how the industry operates to others in part because i'm not part of the industry... coming from me it would be second-hand so go read it from someone who is part of the industry...