in the past, the argument many experts have used against putting in the effort to actually correct people's misconceptions about what a computer virus is and what it does and how it's different from other forms of malware have centered on the idea that it doesn't really matter to a victim what kind of malware they have. when they have malware on their computer, all they care about is getting rid of it. i can understand this school of thought, even though i've never agreed with it. however, the world has changed.
this is a post stuxnet world and defenders/victims aren't the only ones we need to consider anymore. we now have people barking orders to create digital weapons, and the details of those orders matter. if they say make me a virus then someone will make them a virus even if they didn't understand what they were asking for - and there's evidence to suggest they don't.
stuxnet is generally believed to have been a targeted, covert operation, but it used a noisy, untargetable* type of malware - a computer virus (or more specifically a worm). there were and are better ways to achieve the ends we believe the creators of stuxnet were after, so one can only assume that high level decisions were made in ignorance of the differences between malware types and the consequences those differences would have on that type of operation.
the question, then, of whether to put in the effort to educate people about the proper use of the term virus can no longer be answered by looking exclusively at the victims who want their computers to be clean. it is now also necessary to consider aggressors who want to use malware as a weapon to serve national interests. as misguided as such behaviour is, we have to accept that it's happened and will continue to happen, and actually knowing the differences between malware types may mean the difference between a surgically precise operation, or one with a lot of collateral damage.
this isn't to say that i think we should start helping aggressors create and/or launch their digital weapons. i still don't believe in helping the bad guys, and even if i believed such nationalistic aggressors weren't bad guys (which i don't), i don't believe there's any way to help them without also helping those who are much more unambiguously bad. what i am saying, however, is that this particular form of ignorance that experts have been too lazy to address can cause real harm and ignoring it means ignoring the opportunity to reduce the unintended harm such people will cause.
(*many believe stuxnet was highly targeted, but there's a distinction to be made. while it's destructive payload was highly targeted to a very specific environment, it's self-replication was not - it spread far beyond it's intended target)
Showing posts with label terminology misuse. Show all posts
Showing posts with label terminology misuse. Show all posts
Thursday, June 13, 2013
Monday, January 17, 2011
how do you get to the top?
so how do you get to the top? well, if you're an anti-virus company it stands to reason you get there through technical excellence (yes, i can hear you snickering from here). of course if you have technical excellence then it also stands to reason that your people know what it is they're talking about when they go and say something about malware in public.
specifically, what i and many other people expect is that people working for the #1 anti-virus company to at the very least know the difference between viral and non-viral malware. those kinds of basics seem like they should be prerequisites for achieving technical excellence in the anti-virus industry.
apparently that is expecting too much, since some people (in the industry, no less) are still using the term 'virus' as the umbrella term instead of the more accurate term 'malware'. i'm not sure exactly when it happened, but at some point i started hearing more terminology misuse from media sources within the industry than i hear from general media sources in the world at large.
to say that cancels out any willingness i might have had to suspend disbelief about the question of technical excellence is an understatement.
now one explanation i could entertain is that this is actually part of a very clever plot to keep the public confused and disoriented. governments long ago figured out that it was easier to control their subjects if they kept them stupid and uneducated. it doesn't seem unreasonable to suppose that corporations might make use of similar tactics. the foundation upon which greater understanding and ultimately greater self-reliance is built on is an accurate and consistent body of knowledge about the topic at hand. authoritatively using terms where they don't belong unquestionably undermines the process of developing that body of knowledge. it is precisely the type of tactic i would expect if corporations were trying to keep the masses easily manipulated.
that being said, i'm still prone to give the benefit of the doubt. never attribute to malice that which can easily be explained by incompetence. of course, since that reflects poorly on the possibility of technical excellence, that still leaves open the question of how one can get to the top and stay there.
without technical excellence being the driving force to keep the top players on top, we eliminate the possibility that the system is a meritocracy - or at least if there is a meritocracy, it's not the merits of the technology that are important but rather the merits of the efforts to manipulate people into thinking their technology has the most merit. that's called marketing. in essence, it's the best manipulator, not the best technology, that wins.
(though a system that rewards manipulation seems like it should eventually evolve into one that actively tries to keep people stupid in order to manipulate them more easily)
specifically, what i and many other people expect is that people working for the #1 anti-virus company to at the very least know the difference between viral and non-viral malware. those kinds of basics seem like they should be prerequisites for achieving technical excellence in the anti-virus industry.
apparently that is expecting too much, since some people (in the industry, no less) are still using the term 'virus' as the umbrella term instead of the more accurate term 'malware'. i'm not sure exactly when it happened, but at some point i started hearing more terminology misuse from media sources within the industry than i hear from general media sources in the world at large.
to say that cancels out any willingness i might have had to suspend disbelief about the question of technical excellence is an understatement.
now one explanation i could entertain is that this is actually part of a very clever plot to keep the public confused and disoriented. governments long ago figured out that it was easier to control their subjects if they kept them stupid and uneducated. it doesn't seem unreasonable to suppose that corporations might make use of similar tactics. the foundation upon which greater understanding and ultimately greater self-reliance is built on is an accurate and consistent body of knowledge about the topic at hand. authoritatively using terms where they don't belong unquestionably undermines the process of developing that body of knowledge. it is precisely the type of tactic i would expect if corporations were trying to keep the masses easily manipulated.
that being said, i'm still prone to give the benefit of the doubt. never attribute to malice that which can easily be explained by incompetence. of course, since that reflects poorly on the possibility of technical excellence, that still leaves open the question of how one can get to the top and stay there.
without technical excellence being the driving force to keep the top players on top, we eliminate the possibility that the system is a meritocracy - or at least if there is a meritocracy, it's not the merits of the technology that are important but rather the merits of the efforts to manipulate people into thinking their technology has the most merit. that's called marketing. in essence, it's the best manipulator, not the best technology, that wins.
(though a system that rewards manipulation seems like it should eventually evolve into one that actively tries to keep people stupid in order to manipulate them more easily)
Friday, December 24, 2010
getting the wrong message across
it's that time of year again, jack frost nipping at your nose and chestnuts roasting on an open fire. and while we have that fire handy, lets hold some feet to it, shall we?
see there was a post about our favourite type of malware (the virus) published on the panda security support blog by javier guerrero díaz that seems to have a number of issues that need addressing. let's jump right in.
to start with there's the issue of terminology misuse:
next was some over-generalization about worms:
there was also some over-generalization about the complexity of viruses:
on top of complexity, there was also some over generalization about the scope of virus infection:
i understand that the post was intended for those less familiar with the subject of viruses and malware, but the problem with over simplification is that there's no agreed upon degree to which things should be simplified. the consequence of this is that everyone presents different 'facts' and that confuses the people you're trying to explain things to. i genuinely believe it's possible to explain things to people in such a way that they can understand you without sacrificing technical accuracy. it takes effort, and i'm certainly not going to suggest that i succeed in reaching this goal in all circumstances, but at least i don't give up trying. if we accept the sacrifice then we have to accept that people will never really understand what we're talking about because we don't give them the power to do so.
finally there is the market-speak that makes me cringe every time i see it:
i've long despised the use of the term "solution" to describe things that are better presented as tools. it's a trick used by marketing to make people believe they're getting the impossible dream - perfect protection. to see these words written by someone in R&D makes me think somebody's been drinking the marketing koolaid.
worse than that, however, is the reference to keeping systems virus/malware free, without qualification or caveat. this is one of the hallmarks of snake-oil in the anti-malware industry; and guess what, when i went searching through my archives looking for examples of this i found one - involving panda! is there something in the water? is it a language thing? do i have to go looking through my archives for the intersection of panda and snake-oil to see if there's a pattern emerging?
see there was a post about our favourite type of malware (the virus) published on the panda security support blog by javier guerrero díaz that seems to have a number of issues that need addressing. let's jump right in.
to start with there's the issue of terminology misuse:
In fact, we still use today the term “virus” to refer to any type of malware in general, when reality shows that, except for the occasional surge, the number of viruses in circulation is much lower than that of Trojans, for example.the public has already started to pick up the use of the term malware as an umbrella term, replacing it's previous misuse of the term virus. while javier did hint at the inaccuracy of calling all malware viruses, it would have been better to not suggest that "we" (meaning the folks at panda, including himself) still misuse terminology that way. it makes it seem ok to be sloppy with the terms (something which ultimately leads to confusion amongst those who don't know better). i would hope that technically oriented folks were more precise in their word choice.
next was some over-generalization about worms:
Computer viruses differ from other malware specimens like Trojans or worms in that the latter do not need a host to spread.not all worms are free from the requirement of a host. win32/ska (also known as the happy99 worm) for example must infect the wsock32.dll in order to send itself over email.
there was also some over-generalization about the complexity of viruses:
Also, this characteristic makes them more complex to develop as a computer virus must know the internal structure of the file it tries to infect in order to be able to install on it.not all viruses need to know the internal structure of the file they're infecting. overwriting infectors (which destroy the original file rather than trying to preserve it) and companion viruses (which don't actually alter the original file at all) have no such need, nor i think do macro viruses.
on top of complexity, there was also some over generalization about the scope of virus infection:
Finally, given that viruses affect all executable files on the system...not all viruses affect all executable files on the system. some (perhaps many) are much more selective. lehigh, for example, only infected command.com. quite a few affect files that most people would not consider executable (macro viruses for example go after documents instead of executables).
i understand that the post was intended for those less familiar with the subject of viruses and malware, but the problem with over simplification is that there's no agreed upon degree to which things should be simplified. the consequence of this is that everyone presents different 'facts' and that confuses the people you're trying to explain things to. i genuinely believe it's possible to explain things to people in such a way that they can understand you without sacrificing technical accuracy. it takes effort, and i'm certainly not going to suggest that i succeed in reaching this goal in all circumstances, but at least i don't give up trying. if we accept the sacrifice then we have to accept that people will never really understand what we're talking about because we don't give them the power to do so.
finally there is the market-speak that makes me cringe every time i see it:
Any Panda Security solution will keep your computer free from viruses and other malware.panda's *tools* (if it's really a solution, what problem does it solve?) will not keep users' systems virus free. they may keep them mostly virus/malware free, but there will always be exceptions capable of slipping through.
i've long despised the use of the term "solution" to describe things that are better presented as tools. it's a trick used by marketing to make people believe they're getting the impossible dream - perfect protection. to see these words written by someone in R&D makes me think somebody's been drinking the marketing koolaid.
worse than that, however, is the reference to keeping systems virus/malware free, without qualification or caveat. this is one of the hallmarks of snake-oil in the anti-malware industry; and guess what, when i went searching through my archives looking for examples of this i found one - involving panda! is there something in the water? is it a language thing? do i have to go looking through my archives for the intersection of panda and snake-oil to see if there's a pattern emerging?
Thursday, October 14, 2010
i am a hacker...
i have previously touched on the fact that the word hacker gets used inappropriately to mean criminal, and i've objected to it on semantic (pedantic?) 'that is not what it originally meant' grounds. that's only one dimension, however.
while i do object on semantic grounds and take that objection seriously in it's own right, the fact is that because i self-identify as a hacker (among a variety of other things) i also happen to find the characterization of hackers as criminals to be rather insulting. not that i expect the people using that characterization to bend over backwards for little old me, of course, but guess what - i'm not the only non-criminal who self-identifies as a hacker.
in fact there are so many of them, especially in the security domain, that a conference that (among other things) fosters the spirit of hacking in children was held for the first time this year (called hackid). i can't help but think that a lot of those parents/infosec professionals would be less than enthusiastic about the idea of imparting the spirit of hacking onto their little tykes if they were willing to accept a world where the term has taken on such a pejorative meaning. it's not just me who is insulted by the 'criminal' insinuation, it's all these people and their kids too.
really there's only two reasons to misuse the term hacker this way: stupidity or laziness. stupidity requires no explanation, but by laziness i mean too lazy to find a better term - and there are better terms, such as criminal or computer criminal or online criminal or even (gasp!) cybercriminal. these were what was being implied by using the term hacker anyways, so why not cut out the middleman?
well because apparently the unwashed masses are more familiar with the term hacker ({ahem} who's fault is that, exactly?) and it's too much work (laziness rears it's head again) to dispel that misconception and actually educate them properly. and this at a time when we're actually winning the war against the misuse of the term virus as an umbrella term (the media is increasingly and correctly using the term malware as the catch-all term for bad software and as a result malware is becoming the term the public uses as well). would you believe some of the same lazy bums who use that 'too much work' line of reasoning actually fancy themselves educators? i'm sorry but if you can't be arsed to dispel misconceptions and educate about the social dimension of the security space, why should anyone believe you'll do your due diligence with respect to dispelling misconceptions and educating about the technical dimensions? uh huh, yeah, i thought so - there is no good reason for anyone to believe that.
stupid media uses the term everybody else uses because they don't know any better. lazy media uses the term everybody else uses because it's easier to just go with what the experts say, and lazy experts use the term everybody else uses because it's too much work to change the tide. but the tide changed with virus - no doubt in part because viruses stopped being the primary issue and experts for the most part couldn't bring themselves to call a non-viral piece of malware a virus, so the proper umbrella term for malicious software started to trickle down.
that same trickle-down effect could work for the term hacker too, but only if the lazy bums out there (and you know who you are) actually start taking their supposed roles as educators seriously and start doing their job properly instead of half-assed.
Sunday, December 06, 2009
malware classification fail
here's one from the drafts pile, hopefully it's not too stale
i'm wondering what the anti-malware world is coming to when the leading vendor classifies something as a trojan even though it clearly discloses what damage it does.
by this logic, every copy of every operating system also ships with a trojan horse program, either in the form of the delete command or the format command.
one of the basic requirements of a trojan is that it tricks the user into executing it - the original trojan horse wouldn't have gotten very far if there was a warning sign on the outside that said it contained enemy soldiers that would sack the city when night fell. so too would suspected malware not get very far if it plainly disclosed what it does.
this game is at worst a potentially unwanted program - in other words, grayware. we can't just go around calling every bad program (or even just every bad non-viral program) a trojan anymore than we can go around calling all malware viruses. not using the proper terminology is a great way to confuse everyone and confusion is something we don't want to sow, right?!?
i'm wondering what the anti-malware world is coming to when the leading vendor classifies something as a trojan even though it clearly discloses what damage it does.
by this logic, every copy of every operating system also ships with a trojan horse program, either in the form of the delete command or the format command.
one of the basic requirements of a trojan is that it tricks the user into executing it - the original trojan horse wouldn't have gotten very far if there was a warning sign on the outside that said it contained enemy soldiers that would sack the city when night fell. so too would suspected malware not get very far if it plainly disclosed what it does.
this game is at worst a potentially unwanted program - in other words, grayware. we can't just go around calling every bad program (or even just every bad non-viral program) a trojan anymore than we can go around calling all malware viruses. not using the proper terminology is a great way to confuse everyone and confusion is something we don't want to sow, right?!?
Sunday, August 17, 2008
terminology rant
remember me saying the word infect (and it's derivatives) was overused/misused? probably you don't, this blog had a lot fewer readers back then...
but infect is still being overused and here's an example... describing the deployment of a drive-by download attack as putting up an infected website... viruses are what infect things but viruses only infect programs (or computers in the case of the subset known as worms)... websites aren't programs (though they may contain one or more of them in the form of scripts/flash/etc) and what gets put on them for drive-by downloads are generally not viruses but rather some non-viral form of malware...
misusing the term 'infect' like this reminds us that collectively we still haven't gotten over calling all malware a virus, and i think by now we've all realized that such imprecise thinking/communicating only leads to ambiguity and confusion...
so, like i did when i suggested an alternate term for when a computer has non-viral malware, i'm going to suggest a term (2 actually) for the websites used in drive-by downloads... the first should be rather obvious, when the entire website itself is put up by the blackhat then it's a malicious site - no need to mince words, the site attacks visitors in one way or another so it's malicious... the other comes about because sometimes the malicious content is on what is otherwise a completely legitimate site like yahoo or cnn or the superbowl... we can't exactly call those malicious sites, however we can call them tainted sites (maybe even poisoned sites for those who prefer more pejorative terms)...
but infect is still being overused and here's an example... describing the deployment of a drive-by download attack as putting up an infected website... viruses are what infect things but viruses only infect programs (or computers in the case of the subset known as worms)... websites aren't programs (though they may contain one or more of them in the form of scripts/flash/etc) and what gets put on them for drive-by downloads are generally not viruses but rather some non-viral form of malware...
misusing the term 'infect' like this reminds us that collectively we still haven't gotten over calling all malware a virus, and i think by now we've all realized that such imprecise thinking/communicating only leads to ambiguity and confusion...
so, like i did when i suggested an alternate term for when a computer has non-viral malware, i'm going to suggest a term (2 actually) for the websites used in drive-by downloads... the first should be rather obvious, when the entire website itself is put up by the blackhat then it's a malicious site - no need to mince words, the site attacks visitors in one way or another so it's malicious... the other comes about because sometimes the malicious content is on what is otherwise a completely legitimate site like yahoo or cnn or the superbowl... we can't exactly call those malicious sites, however we can call them tainted sites (maybe even poisoned sites for those who prefer more pejorative terms)...
Monday, December 17, 2007
when is a botnet not a botnet?
when the term botnet is misused... at least misuse seems to be the interpretation allysa myers made... although i'm not sure the headline "fbi: 'botnets' threaten online shopper security" can actually be attributed to the fbi (because the media is well known for twisting things to make a catchy headline) there certainly does seem to be a lot of ambiguity in the way the term botnet is being used...
that said, i really don't think the suggestion of coming up with a new term for what used to be called a botnet is the answer... i'm reminded of another term that got watered down in a similar way... that term was virus... it seems to me that we never tried to come up with an alternative for virus (or if we did it thankfully died a quick death), rather we came up with terms for what the label virus was being misapplied to...
come to think of it, it seems to me that not too long ago the same problem occurred with the term spyware... arguably rootkit as well...
i don't think playing musical chairs with terminology is the proper way to resolve the problem... if people are misusing a term and confusing the issue in the process, abandoning the term in favour of a brand new one isn't going to make the issue any less confusing... instead it will simply introduce a new term that they've never heard of before and are unfamiliar with and they'll wonder why it's being used where botnet was being used before... that seems likely to confuse people, if you ask me...
i think the first thing to consider is what the problem really is - to my mind the root problem (ignoring it's consequences) is terminology misuse... changing terminology to run away from that misuse doesn't actually address the problem... to address the problem we need to know why it happens...
so why does terminology misuse happen? the simple answer is ignorance - people who misuse these terms do so because they don't know any better (or because the audience they're trying to reach don't know any better and they don't care to elevate their audience)... they don't know any better because malware is not a mainstream topic in our society... certain concepts bleed through into the mainstream and get assimilated by mainstream culture... those concepts then get used to try and explain things in the malware field, but with only a few concepts in their repertoire those explanations wind up being a distortion of reality rather than an accurate model...
in this case it seems that people are struggling with the idea of identity theft related malware and how botnets scale that problem up... they're struggling because the general public doesn't have the conceptual currency to properly express these ideas, while a select few (relatively speaking) do... some people are haves, but most are have-nots...
that imbalance is something i've certainly been trying to address for some time by trying to make information more available and accessible and hoping that the knowledge would trickle down (for lack of a better phrase)... obviously that is a rather slow process (and just as obviously, i seem to appeal more to technically minded folks) in part because only those who seek the information will find it... i think what we really need is a revolution in the way we disseminate knowledge, not just a set of new words...
that said, i really don't think the suggestion of coming up with a new term for what used to be called a botnet is the answer... i'm reminded of another term that got watered down in a similar way... that term was virus... it seems to me that we never tried to come up with an alternative for virus (or if we did it thankfully died a quick death), rather we came up with terms for what the label virus was being misapplied to...
come to think of it, it seems to me that not too long ago the same problem occurred with the term spyware... arguably rootkit as well...
i don't think playing musical chairs with terminology is the proper way to resolve the problem... if people are misusing a term and confusing the issue in the process, abandoning the term in favour of a brand new one isn't going to make the issue any less confusing... instead it will simply introduce a new term that they've never heard of before and are unfamiliar with and they'll wonder why it's being used where botnet was being used before... that seems likely to confuse people, if you ask me...
i think the first thing to consider is what the problem really is - to my mind the root problem (ignoring it's consequences) is terminology misuse... changing terminology to run away from that misuse doesn't actually address the problem... to address the problem we need to know why it happens...
so why does terminology misuse happen? the simple answer is ignorance - people who misuse these terms do so because they don't know any better (or because the audience they're trying to reach don't know any better and they don't care to elevate their audience)... they don't know any better because malware is not a mainstream topic in our society... certain concepts bleed through into the mainstream and get assimilated by mainstream culture... those concepts then get used to try and explain things in the malware field, but with only a few concepts in their repertoire those explanations wind up being a distortion of reality rather than an accurate model...
in this case it seems that people are struggling with the idea of identity theft related malware and how botnets scale that problem up... they're struggling because the general public doesn't have the conceptual currency to properly express these ideas, while a select few (relatively speaking) do... some people are haves, but most are have-nots...
that imbalance is something i've certainly been trying to address for some time by trying to make information more available and accessible and hoping that the knowledge would trickle down (for lack of a better phrase)... obviously that is a rather slow process (and just as obviously, i seem to appeal more to technically minded folks) in part because only those who seek the information will find it... i think what we really need is a revolution in the way we disseminate knowledge, not just a set of new words...
Monday, February 05, 2007
words that mislead: protection
i've written about how there's no total, full, or complete protection before and i even touched on how the word protection on it's own was a little misleading, but now i think that that deserves to be more than just a footnote somewhere...
i think we're all intuitively aware of the implied boolean nature of the word protect and it's derivatives - you're either protected or you aren't... if you qualify it properly, then (and only then) the concept of partial protection gets acknowledged (ex. if you go into a sword fight with only part of a suit of armour, are you protected? no, not really... are you partially protected? sure)...
partial protection is all that anyone can ever offer, and usually partial protection is enough, so long as you're also aware of the fact that it's only partial and so have the opportunity to avoid situations where that protection might fall short... unfortunately security vendors rarely qualify their use of the word protect and it's derivatives (protection, protected, etc.) so ordinary folks get entirely the wrong message from the vendors and are lulled into a false sense of security, sometimes simply due to a sloppy choice of words (though as witnessed before, it's often a downright intellectually dishonest choice of words)...
so to help people make more accurate interpretations of the messages they get from vendors, whenever you see the word protect, protected, or protection, whether qualified or not, adjust it's qualification to mean partial protection and try and make yourself aware of the situations where that protection might fail...
i think we're all intuitively aware of the implied boolean nature of the word protect and it's derivatives - you're either protected or you aren't... if you qualify it properly, then (and only then) the concept of partial protection gets acknowledged (ex. if you go into a sword fight with only part of a suit of armour, are you protected? no, not really... are you partially protected? sure)...
partial protection is all that anyone can ever offer, and usually partial protection is enough, so long as you're also aware of the fact that it's only partial and so have the opportunity to avoid situations where that protection might fall short... unfortunately security vendors rarely qualify their use of the word protect and it's derivatives (protection, protected, etc.) so ordinary folks get entirely the wrong message from the vendors and are lulled into a false sense of security, sometimes simply due to a sloppy choice of words (though as witnessed before, it's often a downright intellectually dishonest choice of words)...
so to help people make more accurate interpretations of the messages they get from vendors, whenever you see the word protect, protected, or protection, whether qualified or not, adjust it's qualification to mean partial protection and try and make yourself aware of the situations where that protection might fail...
Friday, February 02, 2007
words that mislead: solution
when is a solution not a solution? when it solves the wrong problem...
how many times have you seen an anti-malware product called a solution? i know i've seen it a lot and it's one of those things that really bugs me because they aren't solutions to the problem you're expecting... when people think of an anti-malware solution they naturally think of something that will solve the malware problem...
but there is no solution to the malware problem and there can never be such a solution... a solution to the malware problem implies that it wouldn't be a problem anymore - that you and i wouldn't have to worry about it, think about it, or deal with it anymore... it implies that the problem would just go away - that will never happen... there can never be perfect security so there will always be things that can be taken advantage of, and so long as there is darkness in mens' hearts someone will be taking advantage of those things...
what anti-malware solutions solve are not malware problems or even security problems, but rather they solve business problems... say you're given the task of finding a security product with some arbitrary set of properties and deploying it in your organization... the problem you face is finding the product that is the best fit, that has the most requirements from your checklist with the fewest undesirable trade-offs - that is the type of problem that anti-malware solutions solve...
unfortunately, most consumers of anti-malware products are not thinking about business problems, they're thinking about keeping malware away from their computers... most of them are people, not IT departments with a new demand from management - and those who work in IT departments are people first and IT workers second, they're people when they go home at night, they're people when they're with their families on the weekend...
as much money as anti-malware companies make off of corporate customers, framing their message for the narrowly defined business context sends entirely the wrong message to everyone else... it suggests the product can make the malware problem go away instead of more accurately suggesting that it's simply a tool that can help the customer to better protect their systems...
how many times have you seen an anti-malware product called a solution? i know i've seen it a lot and it's one of those things that really bugs me because they aren't solutions to the problem you're expecting... when people think of an anti-malware solution they naturally think of something that will solve the malware problem...
but there is no solution to the malware problem and there can never be such a solution... a solution to the malware problem implies that it wouldn't be a problem anymore - that you and i wouldn't have to worry about it, think about it, or deal with it anymore... it implies that the problem would just go away - that will never happen... there can never be perfect security so there will always be things that can be taken advantage of, and so long as there is darkness in mens' hearts someone will be taking advantage of those things...
what anti-malware solutions solve are not malware problems or even security problems, but rather they solve business problems... say you're given the task of finding a security product with some arbitrary set of properties and deploying it in your organization... the problem you face is finding the product that is the best fit, that has the most requirements from your checklist with the fewest undesirable trade-offs - that is the type of problem that anti-malware solutions solve...
unfortunately, most consumers of anti-malware products are not thinking about business problems, they're thinking about keeping malware away from their computers... most of them are people, not IT departments with a new demand from management - and those who work in IT departments are people first and IT workers second, they're people when they go home at night, they're people when they're with their families on the weekend...
as much money as anti-malware companies make off of corporate customers, framing their message for the narrowly defined business context sends entirely the wrong message to everyone else... it suggests the product can make the malware problem go away instead of more accurately suggesting that it's simply a tool that can help the customer to better protect their systems...
Tuesday, January 30, 2007
HIPS: what's in a name?
i was reading this HIPS article and i came upon something that struck me as being considerably less than optimal right in this first paragraph:
what do i mean? i mean that everything short of virus (or spyware) scanners and simplistic firewalls get lumped into the HIPS pile... just look at this example, scanning network traffic for exploits (vulnerability inspection) couldn't be more different than application whitelisting (application/process vetting)... then there are the HIPS' that use behaviour blocking, or the ones that try to implement application-centric access control lists, or even known-exploit scanners (which are apparently different/more specific than vulnerability inspectors)...
if you were a consumer looking to compare different HIPS products meaningfully you'd be out of luck - they don't just have different technology (each anti-virus scanner has slightly different technology), they implement entirely different techniques and literally represent different paradigms... comparing an application whitelist to a behaviour blocker or exploit scanner is like comparing apples to oranges, but such distinctions aren't transparent when everything gets called an HIPS...
maybe HIPS was the buzzword bingo that all the vendors wanted in on, but the big losers are average folks who don't know the difference and are mislead by this meaningless umbrella term that implies all those technologies are equal - they aren't and folks are being done a disservice when they aren't told up front what's what... they can't compare them, they can't combine them intelligently, all they can do pay their money and say thank you sir, may i have some more...
There are numerous techniques for providing host-based intrusion prevention capabilities, but eWeek Labs believes there are two that will best complement enterprises' current strategies: vulnerability inspection and application and process vetting.no, i'm not about to criticize eweek's choice in technologies - i'm about to point out the fact that the term HIPS (host-based intrusion prevention systems) has basically come to mean nothing...
what do i mean? i mean that everything short of virus (or spyware) scanners and simplistic firewalls get lumped into the HIPS pile... just look at this example, scanning network traffic for exploits (vulnerability inspection) couldn't be more different than application whitelisting (application/process vetting)... then there are the HIPS' that use behaviour blocking, or the ones that try to implement application-centric access control lists, or even known-exploit scanners (which are apparently different/more specific than vulnerability inspectors)...
if you were a consumer looking to compare different HIPS products meaningfully you'd be out of luck - they don't just have different technology (each anti-virus scanner has slightly different technology), they implement entirely different techniques and literally represent different paradigms... comparing an application whitelist to a behaviour blocker or exploit scanner is like comparing apples to oranges, but such distinctions aren't transparent when everything gets called an HIPS...
maybe HIPS was the buzzword bingo that all the vendors wanted in on, but the big losers are average folks who don't know the difference and are mislead by this meaningless umbrella term that implies all those technologies are equal - they aren't and folks are being done a disservice when they aren't told up front what's what... they can't compare them, they can't combine them intelligently, all they can do pay their money and say thank you sir, may i have some more...
Wednesday, September 20, 2006
symantec and the poor man's 'rootkit'
can't we stop calling everything a rootkit? please?
i grow weary of pointing out terminology misuse over and over again - from stealth digital rights malware, to protected recycle bins, to anti-virus products, to alternate data streams (yes, ADS all by itself has been likened to a 'rootkit') - but if someone sinks to a new low, well the full range of this terminology abuse needs to be documented in order to underscore how idiotic it is...
the latest 'new low' comes from symantec where the 'rootkit' label is being (loosely) applied to a trojan that scans through the registry for programs that get run and then replaces one (or more?) of them with a copy of itself while saving a backup of the original to execute after the trojan gets executed...
so apparently now trojans that employ the non-viral equivalent of companion file infection are 'rootkits'... well gee, at that rate just about any kind of program paracitism (i hesitate to call it file infection as i reserve infection for self-replicators) is a 'rootkit' technique since just about all of them hide changes as well as or even better than companion infectors (overwriting infectors are about the only kind that does a worse job)... so nearly all file infecting viruses and other forms of paracitic malware are 'rootkits' - yeah, that's a wonderful message to be sending people who look to you for expert analysis, symantec... thanks a lot...
things weren't bad enough when virus was treated as an umbrella term, or when spyware became the new umbrella term, now it's going to be 'rootkit'... let's take this absurd "if it hides things it's a rootkit" business to it's logical conclusion, shall we? file permissions are a 'rootkit' technique, attrib is a 'rootkit', popups are 'rootkits', the cursor is a micro-'rootkit' - my trousers are a 'rootkit'...
i grow weary of pointing out terminology misuse over and over again - from stealth digital rights malware, to protected recycle bins, to anti-virus products, to alternate data streams (yes, ADS all by itself has been likened to a 'rootkit') - but if someone sinks to a new low, well the full range of this terminology abuse needs to be documented in order to underscore how idiotic it is...
the latest 'new low' comes from symantec where the 'rootkit' label is being (loosely) applied to a trojan that scans through the registry for programs that get run and then replaces one (or more?) of them with a copy of itself while saving a backup of the original to execute after the trojan gets executed...
so apparently now trojans that employ the non-viral equivalent of companion file infection are 'rootkits'... well gee, at that rate just about any kind of program paracitism (i hesitate to call it file infection as i reserve infection for self-replicators) is a 'rootkit' technique since just about all of them hide changes as well as or even better than companion infectors (overwriting infectors are about the only kind that does a worse job)... so nearly all file infecting viruses and other forms of paracitic malware are 'rootkits' - yeah, that's a wonderful message to be sending people who look to you for expert analysis, symantec... thanks a lot...
things weren't bad enough when virus was treated as an umbrella term, or when spyware became the new umbrella term, now it's going to be 'rootkit'... let's take this absurd "if it hides things it's a rootkit" business to it's logical conclusion, shall we? file permissions are a 'rootkit' technique, attrib is a 'rootkit', popups are 'rootkits', the cursor is a micro-'rootkit' - my trousers are a 'rootkit'...
Wednesday, April 05, 2006
rob slade on rootkits
read it here... the one and only rob slade, doting grandpa of a gradually increasing number of people... wow, that takes me back... i remember when -
mr. peabody: please step out of the wayback machine
ok, ok... well, it's nice to see i'm not the only one who thinks the current redefinition of 'rootkit' is a step in the wrong direction... see, all that ranting i've been doing about it isn't just my own personal imbalance...
anyways, that there is a blog that includes contributions from the rob slade so it's definitely going on my blogroll...
mr. peabody: please step out of the wayback machine
ok, ok... well, it's nice to see i'm not the only one who thinks the current redefinition of 'rootkit' is a step in the wrong direction... see, all that ranting i've been doing about it isn't just my own personal imbalance...
anyways, that there is a blog that includes contributions from the rob slade so it's definitely going on my blogroll...
Saturday, March 25, 2006
magic at sunbeltblog.blogspot.com
so there appears to be some vanishing act going on at the sunbelt blog... in a recent article there talking about how pamela parker got it wrong i made a comment about how alex eck wasn't exactly on the money himself...
now the original url points nowhere and the original comments link has been replaced with a new one that was showing no comments...
i suspect this is nothing more than the consequences of editing the original article to remove a paragraph defending aim against being called adware (sorry, i could find no cache of the original article, you'll just have to take my word for it that said paragraph existed) combined with the vagaries of how blogspot handles edits and how haloscan (the comment service provider there) handles changes to the article's permalink... i haven't checked to see if blogspot really changes the url when you edit an already published article, but i do have some articles where the permalink has a number at the end like the new link for the sunbelt article in question...
just in case the original comment link goes on walkabout as well, here's a quote of what i posted to it:
as i said before, i don't think there was any funny business going on here, i think it was probably just an edit to correct an already published article which in turn had some interesting side effects...
and now you know why i don't provide for comments on this blog - if i should happen to edit something (and there are some things i can see myself modifying on occasion, like adding citations to my definition posts) i wouldn't want to have to deal with the consequences...
now the original url points nowhere and the original comments link has been replaced with a new one that was showing no comments...
i suspect this is nothing more than the consequences of editing the original article to remove a paragraph defending aim against being called adware (sorry, i could find no cache of the original article, you'll just have to take my word for it that said paragraph existed) combined with the vagaries of how blogspot handles edits and how haloscan (the comment service provider there) handles changes to the article's permalink... i haven't checked to see if blogspot really changes the url when you edit an already published article, but i do have some articles where the permalink has a number at the end like the new link for the sunbelt article in question...
just in case the original comment link goes on walkabout as well, here's a quote of what i posted to it:
i'm going to both agree and disagree...
i agree that pam's got it all wrong - adware is more than just ad-supported software... it's got to actually DISPLAY ads, not just be supported by them... there are plenty of ad supported programs out there that leave the ad serving up to a completely different program...
i disagree about aim (and others) not being adware, however... the qualifier you use to justify that distinction is that the 'primary purpose' of adware is to display ads, but i contend that trying to determine the 'primary purpose' of an application is a subjective property... it's a bad defining quality and ruins what could otherwise be a perfectly good *functional* definition...
for example, say someone comes along and makes an instant messaging service that's functionally identical to aim, but they do it not to provide the world with yet another instant messaging application but rather to deploy a platform which not only serves ads but baits users into looking at the ad serving window by putting useful functionality on it... this is still all functionally identical to aim, but it's purpose is to display ads and the instant messaging is just to keep people looking in the direction of those ads... something doesn't stop being adware just because you shoe-horn useful functionality into the ad serving client, and there's really no way to know if the functionality is there to help the ads or if the ads are there to pay for the functionality...
of course, it's not necessary to go through that convolution... aim, like most of the mainstream instant messaging clients, has at various times erected barriers to interroperability both with other im services and with 3rd party clients... the only purpose interroperability barriers serve is to guard a captive audience, which are themselves only good practicing various types of persuasion (like advertising)... so the idea that aim's primary purpose is not providing advertising is questionable at best...
moreover, if the anti-adware/anti-spyware industry persists in using such a definition (yes, i noticed that the anti-spyware coalition's definition shares the same 'feature') the adware industry could easily just port their technology into dlls and activex controls that are bundled by way of integrating them into the 3rd party's application... they'd still be capable of doing all the bad things that people hate about adware but they'd no longer be separate from the programs they're bundled with and the 'primary purpose' of the main app would then exclude such a hybrid from the adware set...
as i said before, i don't think there was any funny business going on here, i think it was probably just an edit to correct an already published article which in turn had some interesting side effects...
and now you know why i don't provide for comments on this blog - if i should happen to edit something (and there are some things i can see myself modifying on occasion, like adding citations to my definition posts) i wouldn't want to have to deal with the consequences...
Wednesday, March 22, 2006
stopbadware.org should check their own sources
in the recently released report on kazaa, stopbadware.org states:
unfortunately, if they'd actually read the anti-spyware coalition's glossary they'd know that in technical settings the anti-spyware coalition uses a definition not unlike sharman networks' definition...
this isn't a deal-killer... at least some of the adware bundled with kazaa is also spyware (even by narrow definitions like my own or the anti-spyware coalition's narrow spyware definition), so sharman networks' claim of no spyware is false...
the problem is what is being communicated to the reader... stopbadware.org is using wikipedia's entry alone as their definition and in my experience wikipedia is not a good authoritative source (a fine informative source, mind you) on much of anything malware related... as the anti-spyware coalition's glossary clearly states, that is not the industry agreed upon definition for spyware - it is a colloquialism that they are forced to recognize in popular usage...
so what? well think about this: with the people backing stopbadware.org, they are invariably going to be regarded by most as authorities in the field - so their use of colloquial definitions rather than formal technical definitions will only serve to reinforce the misconceptions those colloquial definitions represent and lead astray those members of the public who are actually trying to distill meaning out of the various souces in this field...
part of me is tempted to say oh well... after all, what do you expect from people who invented the term "badware" (apparently not aware that the "mal" in malware comes from latin and means "bad") to describe "malicious software that tracks your moves online and feeds that information back to shady marketing groups", which basically boils down to advertising-related spyware (which is a much more descriptive term, come to think of it)... but you know what, misinformation coming from a source this high profile and seemingly authoritative is just not a good thing...
Sharman Networks claims that Kazaa has "NO SPYWARE", based on a highly restricted definition of spyware (namely, that no personally identifiable information is sent by the program). However, Kazaa's installation includes several bundled programs that are considered spyware under the common definition of spyware as software that subverts the computer's operation for the benefit of a third party (see Anti-Spyware Coalition and Wikipedia's article on "Spyware").
unfortunately, if they'd actually read the anti-spyware coalition's glossary they'd know that in technical settings the anti-spyware coalition uses a definition not unlike sharman networks' definition...
this isn't a deal-killer... at least some of the adware bundled with kazaa is also spyware (even by narrow definitions like my own or the anti-spyware coalition's narrow spyware definition), so sharman networks' claim of no spyware is false...
the problem is what is being communicated to the reader... stopbadware.org is using wikipedia's entry alone as their definition and in my experience wikipedia is not a good authoritative source (a fine informative source, mind you) on much of anything malware related... as the anti-spyware coalition's glossary clearly states, that is not the industry agreed upon definition for spyware - it is a colloquialism that they are forced to recognize in popular usage...
so what? well think about this: with the people backing stopbadware.org, they are invariably going to be regarded by most as authorities in the field - so their use of colloquial definitions rather than formal technical definitions will only serve to reinforce the misconceptions those colloquial definitions represent and lead astray those members of the public who are actually trying to distill meaning out of the various souces in this field...
part of me is tempted to say oh well... after all, what do you expect from people who invented the term "badware" (apparently not aware that the "mal" in malware comes from latin and means "bad") to describe "malicious software that tracks your moves online and feeds that information back to shady marketing groups", which basically boils down to advertising-related spyware (which is a much more descriptive term, come to think of it)... but you know what, misinformation coming from a source this high profile and seemingly authoritative is just not a good thing...
Tuesday, March 14, 2006
why virtual machine based 'rootkits' won't be the next big problem
ok, ignoring the issue of what rootkits really are for the moment, let's examine this idea of rootkits that are so low level they're even below the OS...
first, as greg hoglund points out you're pretty much guaranteed to notice the performance hit when your entire OS gets dropped into a virtual machine...
second, as pointed out on the f-secure blog it's actually been done before over a decade ago, back when stealth was still called stealth...
but really, i think i'm going to go them both one better (at least) and say that we solved the full stealth problem over a decade ago... that solution was called booting from a known clean bootable floppy disk and scanning with a known virus scanner...
"but kurt, how are we supposed to use our generic rootkit detection technology if the rootkit isn't active?" - simple, you aren't... those sorts of generics require the malware to be active, which gives it a tactical advantage (it's able to actively defend itself then)... it also allows the malware to know more about the security application than the security application knows about the malware, which is another tactical advantage for the malware... if you're unfamiliar with what sun tsu had to say about engaging the enemy when you're at a disadvantage then i suggest you go do your homework right now... you can't rely solely on generics that way - known-malware techniques (know your enemy) must be employed in an environment and under conditions of your choosing in order to maximize your tactical advantage, and the generics are then used in a supporting role to partially cover what that strategy can't...
now, those of you who've been following things for a few years now you probably know that microsoft screwed that option up with the advent of NTFS... no version of MSDOS is capable of parsing an NTFS partition natively and microsoft seems unwilling to do much about that - probably because so far there really hasn't been that great a need these days... however, should the need arise a fair amount of effort has gone into correcting microsoft's oversight... things like bart's pe disk, NTFS4DOS, or any one of the many recovery oriented live-cd linux distributions can give you access to an NTFS partition after booting from a known clean bootable medium...
all in all, the majority of what's being said out there about microsoft's subvirt and the technology it represents is just hype... in the very unlikely event that anyone ever actually bothers trying to deploy it in the wild, it's an old problem that we've had a solution for for some time now...
[obligatory terminology rant]
of course all of this is one of the consequences of the rootkit redefinition... it clouds the issues in both the rootkit problem-space and the stealth problem-space... we wouldn't be forgetting this history if stealth was still called stealth, and then maybe the brain-trust at microsoft wouldn't have to spend untold millions reinventing the wheel that we already know how to deal with...
[/obligatory terminology rant]
first, as greg hoglund points out you're pretty much guaranteed to notice the performance hit when your entire OS gets dropped into a virtual machine...
second, as pointed out on the f-secure blog it's actually been done before over a decade ago, back when stealth was still called stealth...
but really, i think i'm going to go them both one better (at least) and say that we solved the full stealth problem over a decade ago... that solution was called booting from a known clean bootable floppy disk and scanning with a known virus scanner...
"but kurt, how are we supposed to use our generic rootkit detection technology if the rootkit isn't active?" - simple, you aren't... those sorts of generics require the malware to be active, which gives it a tactical advantage (it's able to actively defend itself then)... it also allows the malware to know more about the security application than the security application knows about the malware, which is another tactical advantage for the malware... if you're unfamiliar with what sun tsu had to say about engaging the enemy when you're at a disadvantage then i suggest you go do your homework right now... you can't rely solely on generics that way - known-malware techniques (know your enemy) must be employed in an environment and under conditions of your choosing in order to maximize your tactical advantage, and the generics are then used in a supporting role to partially cover what that strategy can't...
now, those of you who've been following things for a few years now you probably know that microsoft screwed that option up with the advent of NTFS... no version of MSDOS is capable of parsing an NTFS partition natively and microsoft seems unwilling to do much about that - probably because so far there really hasn't been that great a need these days... however, should the need arise a fair amount of effort has gone into correcting microsoft's oversight... things like bart's pe disk, NTFS4DOS, or any one of the many recovery oriented live-cd linux distributions can give you access to an NTFS partition after booting from a known clean bootable medium...
all in all, the majority of what's being said out there about microsoft's subvirt and the technology it represents is just hype... in the very unlikely event that anyone ever actually bothers trying to deploy it in the wild, it's an old problem that we've had a solution for for some time now...
[obligatory terminology rant]
of course all of this is one of the consequences of the rootkit redefinition... it clouds the issues in both the rootkit problem-space and the stealth problem-space... we wouldn't be forgetting this history if stealth was still called stealth, and then maybe the brain-trust at microsoft wouldn't have to spend untold millions reinventing the wheel that we already know how to deal with...
[/obligatory terminology rant]
Monday, February 20, 2006
the descent of rootkits
i think it's about time to get to the root of the rootkit terminology shift...
i've blogged before about what i think a rootkit is, and about how the anti-spyware coalition's definition is basically in line with my own...
and yet somehow the definition currently in use is all about hiding processes and/or activities from the user rather than about root/administrative privileges...
as i observed before; f-secure, despite acknowledging that the original unix meaning was basically in line with the one i use in this little blurb:
but my first clue about where this new definition came from was in mark russinovich's blog entry where he gives his definition:
a rootkit developer community? well, a community of developers of cloaking technology at any rate... but lets think about this for a sec... by and large, these developers are not going to be a malicious bunch (there are far more good people in the world than there are bad) so when they look at rootkits, even the original unix-style rootkits, they aren't going to really be all that interested in the more blatantly malware type features - the thing that's going to interest them is the cloaking because it has applications outside of malware...
it has been suggested that terminology changes with frequent misuse and that is most likely what happened here... the developer community in question, lacking any significant influence from malware experts (since malware issues were outside the scope of their interests, and because malware expertise is a lot harder to come by than you might think), used and reused the term rootkit (since rootkits represented examples of the kinds of sophisticated stealth techniques they were interested in) so much outside of it's original meaning that they gave it a new meaning...
so what? you might well think that language changes in just this way so there's nothing wrong here, but consider this:
while upcoming concepts like 'stealth by design' indicate that the current terminological misstep may be in the process of correcting itself, there will be purists who will resist the change in terminology on the basis that the proposed new definition of rootkit is not what a rootkit was supposed to be... they'll simply have to be reminded that their rootkit definition was not the original one either and if the correction does take place it will simply be a reversion to the original state of things...
i've blogged before about what i think a rootkit is, and about how the anti-spyware coalition's definition is basically in line with my own...
and yet somehow the definition currently in use is all about hiding processes and/or activities from the user rather than about root/administrative privileges...
as i observed before; f-secure, despite acknowledging that the original unix meaning was basically in line with the one i use in this little blurb:
The term rootkit is very old and is dated back to the days when UNIX ruled the world. Rootkits for the UNIX operating system were typically used to elevate the privileges of a user to the root level (=administrator). This explains the name of this category of tools.still insists on using the new hiding-related definition...
but my first clue about where this new definition came from was in mark russinovich's blog entry where he gives his definition:
Software that hides itself or other objects, such as files, processes, and Registry keys, from view of standard diagnostic, administrative, and security software.which he says he derived from what the rootkit developer community was using as a definition and which happens to basically mirror the definition proposed by greg hoglund, founder of rootkit.com (a hub of the aforementioned developer community) and author of a book on these so-called rootkits (not that registering a domain and/or writing a book actually makes anyone a credible authority, but for the sake of argument lets say he is one), which states:
A rootkit is a tool that is designed to hide itself and other processes, data, and/or activity on a system.
a rootkit developer community? well, a community of developers of cloaking technology at any rate... but lets think about this for a sec... by and large, these developers are not going to be a malicious bunch (there are far more good people in the world than there are bad) so when they look at rootkits, even the original unix-style rootkits, they aren't going to really be all that interested in the more blatantly malware type features - the thing that's going to interest them is the cloaking because it has applications outside of malware...
it has been suggested that terminology changes with frequent misuse and that is most likely what happened here... the developer community in question, lacking any significant influence from malware experts (since malware issues were outside the scope of their interests, and because malware expertise is a lot harder to come by than you might think), used and reused the term rootkit (since rootkits represented examples of the kinds of sophisticated stealth techniques they were interested in) so much outside of it's original meaning that they gave it a new meaning...
so what? you might well think that language changes in just this way so there's nothing wrong here, but consider this:
- technical jargon does not evolve the same way that conversational language does... imagine if people started using the term 'telescope' to refer to something completely different...
- hoglund's definition describes what is more properly known as stealth in the malware field... the concept of stealth has enjoyed wide use in the malware field for at least the past 20 years (back in 1986, the brain virus wasn't just the first pc virus in the wild, it was the first stealth virus) and has been applied to virtually all forms of malware, not just rootkits
- stealth is actually a more natural and intuitive label for what hoglund's definition describes; so much so that the term is creeping back into the vocabulary of the rootkit community at rootkit.com to cover new types of cloaking that 'rootkit' is no longer felt to encompass
- under hoglund's definition, the term 'rootkit' has no etymological basis - that is the word doesn't appear to come from anywhere or be rooted in any underlying details... by comparison, a collection of programs (-> a collection of software tools -> a toolkit -> a kit) that aids in gaining or maintaining root/administator (administrator is called 'root' in unix) access is fairly clear about where the term 'rootkit' comes from
while upcoming concepts like 'stealth by design' indicate that the current terminological misstep may be in the process of correcting itself, there will be purists who will resist the change in terminology on the basis that the proposed new definition of rootkit is not what a rootkit was supposed to be... they'll simply have to be reminded that their rootkit definition was not the original one either and if the correction does take place it will simply be a reversion to the original state of things...
Tuesday, February 14, 2006
what is DRM?
digital rights malware (or digital rights management software if you prefer) is any program bundled with media (text, graphics, audio, video, or some combination thereof) that takes some measure of control over the user's electronic device(s) in order to limit what the user can do with the media, often in contradiction to some extent with what applicable laws say the user should be allowed to do with it...
the user is often unaware of the presence of the digital rights malware his/her media purchase has been crippled with or how it invariably works against his/her interests, so it therefore qualifies as a kind of trojan...
in recent months there has been a trend to label any form of digital rights malware that uses stealth to hide itself (and in order to be effective against any user with half a brain they have to use stealth) as a rootkit... this is part of a larger and rather misguided trend to call anything that uses stealth a rootkit... while DRM is malware, it is not necessarily a rootkit...
there is an older trend (and some well known examples of success) of trying to get protection of digital rights malware enshrined in the law... this moves the creation and maintenance of copyright policy out of the hands of the government and into the hands of various corporate interests and has sometimes been called paracopyright... in places where this has taken place many of those corporate interests have proven themselves uninterested in the user's rights many times over...
(see my previous posting on digital rights malware here)
back to index
the user is often unaware of the presence of the digital rights malware his/her media purchase has been crippled with or how it invariably works against his/her interests, so it therefore qualifies as a kind of trojan...
in recent months there has been a trend to label any form of digital rights malware that uses stealth to hide itself (and in order to be effective against any user with half a brain they have to use stealth) as a rootkit... this is part of a larger and rather misguided trend to call anything that uses stealth a rootkit... while DRM is malware, it is not necessarily a rootkit...
there is an older trend (and some well known examples of success) of trying to get protection of digital rights malware enshrined in the law... this moves the creation and maintenance of copyright policy out of the hands of the government and into the hands of various corporate interests and has sometimes been called paracopyright... in places where this has taken place many of those corporate interests have proven themselves uninterested in the user's rights many times over...
(see my previous posting on digital rights malware here)
back to index
Saturday, January 28, 2006
what is infection?
infection is the process or state whereby a viral program attaches itself to a host program in such a way that when an attempt is made to run/execute/interpret the host program the viral program can be run/executed/interpreted in addition to or instead of the host program...
this attachment can be in the form of inserting the viral program in the host program, inserting the host program in the viral program, replacing the host program with the viral program, placing/naming the viral program in such a way that the operating environment finds/calls the viral program before the host program, inserting a call or reference to the viral program in the host program, linking the viral and host programs through manipulation of filesystem structures, etc...
many people today use the term 'infect' to refer to putting any kind of malware into something else (such as 'infecting' audio CD's with DRM)... this is a product of the public's high level of awareness of viruses and viral concepts compared to other forms of malware (viruses have been in the wild and in the public eye for 20 years or more now) and not a correct usage of the technical term...
back to index
this attachment can be in the form of inserting the viral program in the host program, inserting the host program in the viral program, replacing the host program with the viral program, placing/naming the viral program in such a way that the operating environment finds/calls the viral program before the host program, inserting a call or reference to the viral program in the host program, linking the viral and host programs through manipulation of filesystem structures, etc...
many people today use the term 'infect' to refer to putting any kind of malware into something else (such as 'infecting' audio CD's with DRM)... this is a product of the public's high level of awareness of viruses and viral concepts compared to other forms of malware (viruses have been in the wild and in the public eye for 20 years or more now) and not a correct usage of the technical term...
back to index
Friday, November 18, 2005
what's that so-called real story again?
bruce schneier spins a yarn quite well in his recent article on the sony DRM scandal so i'm not goint to bother making any kind of 'story' here...
read it... see if you can see what i see...
no, no, not the terminology misuse (that his own readers picked up on - in the industry it's that pesky cloaking business that makes something a rootkit, regardless of how bizarre that sounds)... no, he blames anti-virus companies for not detecting the rootkit sooner...
hello?!?! where was bruce almighty during that period, hmm?? where was his company counterpane and their managed security solution? didn't they detect anything??? we're talking managed security here, with actual people at the helm rather than the automatons that anti-virus software represents... i don't recall bruce raising the initial alarm, do you?
anti-virus software detects what it knows... how does it get to know something? by the people who make it being given samples or at least pointed in the right general direction as f-secure was...
how exactly were they going to get that information sooner than they did? ('chance' is the only way i can see that happening) and without that how were they supposed to detect it? are anti-virus companies supposed to sift through and analyze every line of code on the planet, and if so are we to believe audio CDs should have been high on their priority list?
and then, to go on and make the disingenious statement that that kind of protection is exactly what we pay anti-virus companies for when he knows damn well (writes about it, talks about it, made a business model out of it) that real security isn't as simple as installing software and expecting it to protect you, that it's a process, that it requires real people making intelligent and informed security decisions - i'm sure that made for good copy but it's still hipocrisy... people protect computers, the software is just a tool to help them do the job... and of course no security, no matter how good, is perfect...
anti-virus software cannot protect you from everything all the time... many of them have no anti-rootkit technology yet, and detection of phoning home is generally relegated to the software firewalls...
bruce appears to be too far removed from the anti-virus community (note, i'm not specifying the industry) to get it... i've been part of the community for well over a decade and the only person i know who even mentions his name is me... i suspect the security guru simply considers viruses to be a small niche in the overall security landscape, and that may be true but the devil's in the details and those are something he isn't displaying a firm grasp of here...
i'm no anti-virus apologist here, though... he did get one thing right, any av company that wasn't all over this when the new broke deserves a swift boot in the ass... f-secure shouldn't have been the only av company denouncing sony's move from the get-go...
read it... see if you can see what i see...
no, no, not the terminology misuse (that his own readers picked up on - in the industry it's that pesky cloaking business that makes something a rootkit, regardless of how bizarre that sounds)... no, he blames anti-virus companies for not detecting the rootkit sooner...
hello?!?! where was bruce almighty during that period, hmm?? where was his company counterpane and their managed security solution? didn't they detect anything??? we're talking managed security here, with actual people at the helm rather than the automatons that anti-virus software represents... i don't recall bruce raising the initial alarm, do you?
anti-virus software detects what it knows... how does it get to know something? by the people who make it being given samples or at least pointed in the right general direction as f-secure was...
how exactly were they going to get that information sooner than they did? ('chance' is the only way i can see that happening) and without that how were they supposed to detect it? are anti-virus companies supposed to sift through and analyze every line of code on the planet, and if so are we to believe audio CDs should have been high on their priority list?
and then, to go on and make the disingenious statement that that kind of protection is exactly what we pay anti-virus companies for when he knows damn well (writes about it, talks about it, made a business model out of it) that real security isn't as simple as installing software and expecting it to protect you, that it's a process, that it requires real people making intelligent and informed security decisions - i'm sure that made for good copy but it's still hipocrisy... people protect computers, the software is just a tool to help them do the job... and of course no security, no matter how good, is perfect...
anti-virus software cannot protect you from everything all the time... many of them have no anti-rootkit technology yet, and detection of phoning home is generally relegated to the software firewalls...
bruce appears to be too far removed from the anti-virus community (note, i'm not specifying the industry) to get it... i've been part of the community for well over a decade and the only person i know who even mentions his name is me... i suspect the security guru simply considers viruses to be a small niche in the overall security landscape, and that may be true but the devil's in the details and those are something he isn't displaying a firm grasp of here...
i'm no anti-virus apologist here, though... he did get one thing right, any av company that wasn't all over this when the new broke deserves a swift boot in the ass... f-secure shouldn't have been the only av company denouncing sony's move from the get-go...
Tuesday, July 12, 2005
the importance of good definitions
Techdirt has an article on the recent attempts by a group of organizations to come up with an agreed upon set of definitions for spyware and adware... predictably, Techdirt gets it all horribly, horribly wrong...
the author feels that what the software does or doesn't do is immaterial - that any unwanted application that got on one's machine by unknown means should be classified as spyware... he's not the only one who feels that way but there's a BIG problem with this line of reasoning...
the problem is that classifying instances of software on the basis of how they make some nebulous real world group of users feel (which is essentially what the author's position boils down to) is ridiculously difficult on a number of levels... not only will countless millions be spent on navel-gazing exercises trying to divine whether a particular instance of software in a particular software bundle is going to be unwanted and unnoticed at install time by some fictional average computer user or one if his/her 3.2 kids, but countless millions more will be spent defending against a deluge of specious lawsuits on the grounds that each classification was arbitrary and prejudicial - ultimately leading to a system where the courts, rather than the industry decide which program is spyware and which isn't..
we're computer scientists, not mind readers - we don't deal with this eye of the beholder crap unless we absolutely have to - and in this case we don't have to... we already have an umbrella term for all bad software - it's "malware"... if we're going to classify software for anti-whatever purposes we need to do it based on functional definitions (definitions based on what functions the software performs rather than definitions based on guessing how users will react to it)... we already have one malware classification saddled with an eye of the beholder definition, it's known as the "trojan", and that non-functional catch-all definition has been the bane of anti-trojan detection for years and is probably the reason we've had to make so many other classifications because it's proven totally unworkable as a classification that people can agree upon... classification based on eye of the beholder type criteria excludes widespread agreement by definition...
functional definitions, on the other hand, are much more reasonable... no guessing is involved and legal defense is practically a non-issue - define something based on it's function and it becomes much more feasible to demonstrate that a particular thing belongs or doesn't belong in that class...
on reading the actual document that the group of organizations (the anti-spyware coalition) came up with i think that for the most part the definitions are reasonable but a little on the wordy side... adware, for example could be much more simply defined as any software that advertizes a product or service other than itself... likewise spyware can be defined as any software that surreptitiously collects information from the user's system and sends it back to a remote 3rd party...
they did miss the mark on rootkits again, but the most notable problem is their adoption of spyware as an umbrella term for just about all bad software... they justify this by saying that the public at large is calling it that but this is foolish; 2 years ago the public at large was calling all bad software viruses, 2 years in the future they'll be using yet another term... how will this system cope with that? better to ignore the foibles of the unwashed masses and simply strive for internal consistency... trying to accomodate terminology misuse by people who don't know what they're talking about will never work because the people who don't know what they're talking about will not be consistent over time - leaving those of us who do know what we're talking about having to guess what they're talking about regardless of how accomodating we try to be...
EDIT (07/19/2005): i retract what i said about their definition of rootkits - i don't know what i was looking at before but now it looks fine... turning spyware into an umbrella term is still bad though...
the author feels that what the software does or doesn't do is immaterial - that any unwanted application that got on one's machine by unknown means should be classified as spyware... he's not the only one who feels that way but there's a BIG problem with this line of reasoning...
the problem is that classifying instances of software on the basis of how they make some nebulous real world group of users feel (which is essentially what the author's position boils down to) is ridiculously difficult on a number of levels... not only will countless millions be spent on navel-gazing exercises trying to divine whether a particular instance of software in a particular software bundle is going to be unwanted and unnoticed at install time by some fictional average computer user or one if his/her 3.2 kids, but countless millions more will be spent defending against a deluge of specious lawsuits on the grounds that each classification was arbitrary and prejudicial - ultimately leading to a system where the courts, rather than the industry decide which program is spyware and which isn't..
we're computer scientists, not mind readers - we don't deal with this eye of the beholder crap unless we absolutely have to - and in this case we don't have to... we already have an umbrella term for all bad software - it's "malware"... if we're going to classify software for anti-whatever purposes we need to do it based on functional definitions (definitions based on what functions the software performs rather than definitions based on guessing how users will react to it)... we already have one malware classification saddled with an eye of the beholder definition, it's known as the "trojan", and that non-functional catch-all definition has been the bane of anti-trojan detection for years and is probably the reason we've had to make so many other classifications because it's proven totally unworkable as a classification that people can agree upon... classification based on eye of the beholder type criteria excludes widespread agreement by definition...
functional definitions, on the other hand, are much more reasonable... no guessing is involved and legal defense is practically a non-issue - define something based on it's function and it becomes much more feasible to demonstrate that a particular thing belongs or doesn't belong in that class...
on reading the actual document that the group of organizations (the anti-spyware coalition) came up with i think that for the most part the definitions are reasonable but a little on the wordy side... adware, for example could be much more simply defined as any software that advertizes a product or service other than itself... likewise spyware can be defined as any software that surreptitiously collects information from the user's system and sends it back to a remote 3rd party...
they did miss the mark on rootkits again, but the most notable problem is their adoption of spyware as an umbrella term for just about all bad software... they justify this by saying that the public at large is calling it that but this is foolish; 2 years ago the public at large was calling all bad software viruses, 2 years in the future they'll be using yet another term... how will this system cope with that? better to ignore the foibles of the unwashed masses and simply strive for internal consistency... trying to accomodate terminology misuse by people who don't know what they're talking about will never work because the people who don't know what they're talking about will not be consistent over time - leaving those of us who do know what we're talking about having to guess what they're talking about regardless of how accomodating we try to be...
EDIT (07/19/2005): i retract what i said about their definition of rootkits - i don't know what i was looking at before but now it looks fine... turning spyware into an umbrella term is still bad though...
Subscribe to:
Posts (Atom)