Comments on: It’s Getting Worse All The Time?

By: kurt wismer

kurt wismer — Fri, 28 Jul 2006 20:01:07 +0000

the more nodes a botnet has, the more likely it is to be detected and shut down – so even for botnets it doesn’t pay to have really large outbreaks…

By: David Brodbeck

David Brodbeck — Fri, 28 Jul 2006 13:21:19 +0000

It’s not entirely true that there’s no profit in widespread outbreaks. It depends on the goal. I recall a case a while back where someone created a huge network of zombie PCs, which they then rented out for spam runs.

By: Iain Wilkinson

Iain Wilkinson — Fri, 28 Jul 2006 05:44:41 +0000

The F-Secure comment needs to be seen in the context of what they are seeing in their research labs. Looking at the figures shows that the number of individual pieces of Malware is increasing as is the capabilities it has – think keyloggers and rootkit functionality.
The simple truth is that there is no profit in widespread outbreaks, but there is in small attacks that slip under the radar. Of course, once money is involved people will spend more time writing better code because creating new Malware becomes their day job.
So F-Secure are very probably right in this situation, less outbreaks does mean a bigger problem.

By: Richard Veryard

Richard Veryard — Fri, 28 Jul 2006 05:05:33 +0000

I have now found and read F-Secure's original post http://www.f-secure.com/weblog/archives/archive-072006.html#00000922. F-Secure does seem to have some evidence for the growing sophistication of the attacks, and a plausible explanation for the fact that these attacks are less visible. But explanation is not evidence, and I stand by my earlier point.

By: Joseph Ashwood

Joseph Ashwood — Thu, 27 Jul 2006 22:27:41 +0000

I think there is certainly an argument to be made that either side is correct. To extend a bit of a metaphore (perhaps too far) the indiscriminate attacks are akin to a mosquitos, annoying but it takes a huge number of them to cause any real damage. The targetted attacks are more akin to a javelin, a single strike is enough to kill. Depending on your view each one is worse. For the common person the mosquitos are worse simply because no one will be throwing a javelin at you. For the tempting target the mosquitoes are functionally irrelevant, but since they are a target for javelins, the javelin-esque attacks are a major threat.
The other problem is that this represents an advancement in the state of the art of weaponry, and if this process continues it is only a matter of time before the pike, sword, musket, gatling gun, handgun, rifle, machine gun, …, nuclear warhead appear on the landscape. The escalation options are worrisome, so I guess I do agree with F-Secure on that this is a problematic trend.

By: David Brodbeck

David Brodbeck — Thu, 27 Jul 2006 18:12:12 +0000

Funny, I was just reading this comment today, in an article in the Christian Science Monitor about border enforcement:
“…the border patrol plays it both ways, claiming to be an effective deterrent when apprehensions are down and an effective law enforcer when apprehensions are up.”

By: Richard Veryard

Richard Veryard — Thu, 27 Jul 2006 13:27:53 +0000

Evidence that some people don't understand evidence. Or logic. I agree that even if visible attacks are decreasing, this doesn't provide conclusive evidence that invisible attacks are decreasing. And the lack of evidence that invisible attacks are decreasing does not imply any evidence that invisible attacks are increasing. But that's not quite what F-Secure says. F-Secure avers that the reduction in visible attacks provides evidence that invisible attacks could be increasing. But this is rubbush. We don't need evidence for the possibility of increased attack; it's not something that requires evidence. What we want to know, which F-Secure avoids telling us (at least in the extract Adam provides here), is actually what is going on.

By: kurt wismer

kurt wismer — Thu, 27 Jul 2006 12:53:34 +0000

big outbreaks are more suggestive of a hobbyist malware author rather than a determined criminal, but i’m not sure that’s necessarily better…
the only thing i can think of that would unambiguously suggest things are getting better is if the rate of malware production decreased… however that doesn’t seem likely to happen…