Blog Attack Prediction Comes True

Last week, in a series of blog entries and interviews, Ray Dickenson and I called attention to the possibility that blogs and RSS feed aggregators would soon become a new and powerful vector for malware.

Unfortunately, this week, that prediction came true - in the form of a new variant of the Storm Worm.

No one - not even the CEO of a security software company - likes to be right when it comes to predicting doom, but blogs and forums and RSS feeds were a disaster waiting to happen. Now, the cleanup must begin - and it will not be pretty: Not enough people will get the message in the short term, and because the effects will only be felt by end users, it is likely many blog operators will keep those open channels open - which may end up enabling a new form of malware syndication on an unprecedented scale.

Why is it important to act? As several people have recently commented, blogs are extremely important tools that enable the proliferation of free speech and political freedom, and the sharing of opinions from all over the world, and all sides of the political spectrum. The fourth-largest blogging population by language is Iranian, and much of what is discussed there involves the creation of a state representative of its young, progressive thinkers. We cannot allowing blogging to become untrusted - it is too valuable.

So what are the next steps? At this moment, it is unclear what examples of best practices exist with respect to blogging and forum sites, and RSS aggregation (gator) sites (I'd love to hear your opinions on what sites you think do represent good examples of best practices). Many of the sites that I visit seem to allow comments by default and load those comments right into the feeds - one of the main vectors by which other aggregating and distributing sites can be attacked.

One approach that we have been working on is going to be moved up the product roadmap for earlier release. Right now we have an RSS aggregator and blog creation widget in beta that has been hardened for this form of attack - it is code-named (and trademarked) SpinStream, and filters all streams in and out of the widget for malware.

This approach will work for delivery of RSS feeds and blogs to and from the desktop. Sorry for the inclusion of the commercial pitch (it isn't really that commercial because we're planning on making this app completely free) but we've been thinking about this for some time, and it might just be useful for someone.

In the absense of end point solutions and up to date malware protection (and kick-ass heuristics-based analysis, which is the only thing you can really rely on in these situations), owners of web-based forums and blogs should consider putting heuristics-based anti-malware engines on their servers, in-line with their feeds.

Bottom line: we need to protect our blogs. Community isn't just a buzzword, folks - for some populations (i.e. the Iranian student population), the blog *is* the community.

RunLegacyCPLElevated.exe

Some excellent detective work by Symantec's Ollie Whitehouse has uncovered a way that hackers can force Vista's User Account Control (UAC) to show an untrusted application as "trusted".

He has shown that a program core to the Vista legacy software support system - RunLegacyCPLElevated.exe - can be manipulated to display, within the UAC, the "trusted" color normally associated with a digitally-signed program - even when that program is clearly malware.

This is yet another reason why Microsoft should consider certifying Authentium's VirtualATM technology for Vista 64 bit. The only approach to solving the problem of trust is to "create trust" in a very focused and enforceable way within an essentially non-trustworthy environment, and protect all links in the chain.

I haven't got time to blog about the specifics of Symantec's discover now - but eWeek continues its excellent reporting on all things security and Vista-related with an article by Lisa Vaas on this vulnerability.

A Unique Voice

I'm sitting at home watching the Oscars. I'm thrilled that Ennio Morricone has been given an Oscar at long last. He has written some gorgeous music over the years.

Once upon a time, almost two decades ago, I worked in a quite different industry - as an arranger and composer of orchestral and big-band music. My heroes were the great band leaders - Nelson Riddle, Henry Mancini and Russell Garcia (leader of the NBC Orchestra for many years) - and of course 20th century American composers Gershwin, Copeland, Glass (and virtually every major composer for American film).

Like Ennio Morricone, Mancini and Riddle (Frank Sinatra's conductor and arranger for several decades) were primarily known for their ability to create what we call in the trade "voicings" - essentially unique inversions of chords, and their ability to combine these "voicings" with even more unique combinations of instruments.

Think of Mancini's theme from "The Pink Panther" - have you ever heard anything close to that unusual combination of baritone sax, big band brass, woodwinds and strings since? Mancini did his employers a great service.

Not everyone thinks timbre/voicing is important. Years after I started arranging, I was accepted into the ABC Young Composers program in Adelaide. I was amazed one day to find my mentor placed timbre at the bottom of the list of things he felt most important - for those interested, timbre was listed after rhythm, melody and harmony - in that order.

I'm glad Morricone never took that course. Listening to Morricone's unique score for "A Fistful of Dollars", you are transported to one movie, one time, one place. It is unique. His music will be remembered - and will remain capable of transporting us out into the desert with Clint Eastwood - for many decades to come.

Note: speaking of Oscars and award-ceremonies, I enjoyed a great "movie moment" once many years ago. I had just arrived in my hotel room in Singapore after a long flight, and as I dropped onto my bed and flipped on the TV, the Emmy Awards came on and a voice announced "... and the award goes to... " and the name that followed was that of my old friend from Sydney (and a hell of a great composer/arranger), Ashley Irwin.

Turns out Ashley won his Emmy award for - you guessed it - his work arranging and rehearsing the Oscars. He was back at it tonight.

The (Criminal) Singularity is Near

Most of my recent weekends and plane flights have been spent reading "The Singularity is Near", Ray Kurzweil's excellent book on the exponential rise of technological progress. I have very much enjoyed the ride, and I believe that he is correct with respect to his predictions about where many of the world's engineering efforts are headed.

However, like too many visionaries and engineers, Kurzweil falls victim to the fallacy that "the good will outweigh the bad", and dismisses the idea that criminals will make use of technology in ways that may or may not be controllable. Take this quote from page 413:

"The fact that computer viruses are not usually deadly to humans only means that more people are willing to create and release them. The vast majority of software-virus authors would not release viruses if they thought they would kill people."

This is naive. Fifteen years ago, your typical virus writer was a student time-sharing on some university computer somewhere. While it is probably true that this kind of person can probably be assumed to be uninterested in causing physical harm, this view (and the view that all criminal efforts may ultimately be controllable) is years out-of-date.

Today, virus-writing is firmly under the influence of criminal gangs motivated by potentially massive financial gains (and, probably real soon now, by potentially massive military or political gains). And while many current threats may seem relatively benign, it is only a matter of time before the scales tip and criminals start regularly aiming hostageware and similar technologies at medical and military equipment, SCADA systems, and other critical pieces of infrastructure, in return for financial and military gains.

Let me argue by extension for a moment here. In the late nineteenth century, well-meaning scientists in Germany produced two promising new drugs. The first, cocaine, was first isolated (and named) by Albert Niemann at the University of Gottingen in 1859 (and later made famous by Sigmund Freud, among other medical practitioners). The second, heroin, first discovered in London, was commercialized by Bayer in 1898 ("heroin" was Bayer's trademarked brand name for the drug).

Both technology advances were predicted to advance civilization. The world applauded the arrival of cocaine and heroin - and, as with so many scientific advances, only good was predicted to come from these engineered developments.

However, mention either drug today and the feelings generated are almost universally negative. In both cases, criminals co-opted the technology and went on to create industries based entirely on criminal activity that generate untold billions today - industries that kill or maim an extraordinary number of human beings each year, and continue to prosper in the face of all attempts to eradicate them.

Maybe this is an unfair analogy. But at the close of writing my recent blog detailing the myriad ways in which malware creators make money, I drew a deep breath. With so much at stake financially and politically and militarily, it is becoming clear to me that we are just at the very beginning, not the end, of the malware-creation cycle.

The criminals are just getting started. As they become better educated, and better at engineering and targeting and distributing their creations - and we move towards the world of implanted software in our homes, our bodies, and even our minds, that Kurzweil describes - the financial stakes are going to become astronomical - on both sides.

Though-bubble: it isn't terribly hard to imagine that within a few years we will see a scenario involving a major world-leader being kept alive by a medical device running on software that receives updates via a network of some kind. What would a terrorist pay to upload their code to that device? Who, with access to that device, could be corrupted?

Let's not fool ourselves that software-based criminals will care anymore about human life than the crime lords involved in the drug trade do - at the end of the day, criminals care only about their own ends (money, power), not about the greater human good.

And it's not just the crime lords we need to keep in mind - let's not forget that many "good" citizens - pillars of the community; doctors, policemen, politicians, soldiers, lawyers among them - have been co-opted into drug-related criminal activities that cause human suffering and death, all because of money.

On page 107, Kurzweil quotes US Department of Commerce, Economics and Statistics Administration data that shows IT now accounts for 10% of domestic GDP spending. Let's hope that the "good citizens" of this fast-growing IT industry do better that the "old economy" industries when it comes to preventing assets from being co-opted by criminals.

65 Online Banks Attacked

The latest account hijacking scam to hit online banks was sophisticated and well thought-out. And, according to WebSense, quite effective - over 65 banks and transaction platforms were targeted in the scheme, including American Express, Barclays, eBay and Discover Card.

The scam involved an email promoting the news that John Howard, the Australian Prime Minister, was fighting for his lfie after suffering a heart attack. Clicking on the links in the piece led users to sites running code designed to deliver key-loggers and other credential-stealing technologies, fine-tuned to watch for credentials from over sixty financial institutions.

Our VirtualATM product would have protected every one of these customers from this attack - it was designed with these kinds of pharming/account hijacking attacks in mind and is capable of providing good protection, even if the user clicks through to the hacker site, and downloads the bad code.

By the way, I've met Australia's Prime Minister in person, and he's a nice guy, and extremely healthy. There are very few sixty-plus guys that are as fit as he is. I doubt we'll be hearing about him having a heart attack anytime soon.

400,000 Malware Definitions and Counting

Our malware database just crossed the 400,000 mark. As proud as I am of our team and their hard work in this area, knowing that there are now more than 400,000 identifiable instances of malware is not exactly something any of us should celebrate.

Think about it. Let's assume the database contains a large amounts of "variants on a theme". At a twenty to one ratio (which is about right), our malware analysis engines, and the engines of other leading malware hunters, are facing the collective output of a football stadium's worth of criminal programmers. That's a lot of programing power.

I know what you're thinking: why do these programmers do this? How do they justify moving their considerable talents over to "the dark side"? The answer is, of course, "money." We all need to pay the rent and feed the kids. And maybe, just maybe, buy a big boat. Here's just six ways malware creators get paid:

1. Botnet creation. Old-fashioned spam.

2. Hostageware. Hostageware hackers focus on creating targeted forms of malware that enable them to slow down or interrupt the commerce infrastructure of an online auction house, casino, stock trading company, or retailer. Most of these hacks focus on denial of service attacks against published IP addresses - or if that fails, the IP addresses of their ISP - and it usually starts with a demonstration of capability. Once the capability has been demonstrated, the hacker calls the casino and asks for cash in exchange for uninterrupted service. Casinos and online trading houses must weigh the advantages of paying the hacker versus losing network access.

3. Phidgeting. Phidget (PHIshing using wiDGETs) attacks haven't yet entered the mainstream, but in a year or two, "phidgeting" could well become the number one form of attack. Why? Because nothing is more effective that a crime that goes undetected in plain sight. Phidgeting hackers have numerous tools available, including several desktop application-creation software engines that enable the creation and rendering of pretty-looking, branded widgets/gadgets that interoperate right in front of you, on the desktop, rather than deep in the operating system. When hackers combine a tasty widget with a fake banking URL and the trusted brand of a financial institution, the potential for stealing credentials is great.

4. Phishing. Has anyone on the planet not yet received an email from the deposed ex-Attorney General of a third world nation offering them thirty million dollars in return for their kindness, a vow of secrecy, and a few thousand bucks in "legal fees"?

5. VOIP-Based Caller-ID Spoofing. Criminals are starting to make use of IP phones programmed to display trustworthy references - the brand of your bank or your trading company - to call unsuspecting consumers to "verify" account details. The better scammers combine this capability with email phishing attacks that tell consumers *not* to trust their email because of the potential for abuse. These emails recommend calling the bank instead to "verify" their accounts have not been touched. According to some of the folks I spoke with at the RSA conference last week, these phone lines typically take you to automated IVR (Interactive Voice Response) recordings that answer in your bank's name and ask you to please enter your account number and PIN in order to speak to a customer service agent. Try to guess what happens while the music plays...

6. Account Hijacking (Zombie Trading). In November, both eTrade and TD Waterhouse reported that their clients had suffered $22m in losses suffered due to "zombie trading". For this hack, criminals hijacked a hundred trading accounts on the platforms and used these stolen credentials to drive up the price of several targeted stocks held by the criminals. Once the stocks reached their target price, the criminals purchased the stock using the hijacked accounts from their own accounts, at a massive profit. It has been widely reported that they made $22m on the trade. Was this a test for a bigger scam, involving tens or hundreds of millions? Let's hope these guys don't head over to the derivative counter anytime soon.

The most worrying stuff to me involves the criminal use of real accounts, "call center staff", real-sounding IVR recordings, and "in your face" branded desktop applications. Regardless of what has happened in recent years, consumers still trust brands - and human voices. I sense there is a ton of money still to be scammed via these vectors.

Brand Owners Need to Do More to Stop Spam

Spam, like cigarette smoke, is annoying. Lawmakers and lawyers have the power to reduce it, permanently, using similar methods.

Laws work best when the ultimate perpetrators of a crime are easily identifiable, the law is clear, and the penalties are heavy. We know who the assumed perpetrators of spam are - the shady distributors of products sold under major brands - products that may or may not be the advertised item. We know these spammers are criminals. But what about the role of the brand owners in all this? Are they the "ultimate perpetrators", or the victims?

In my view, spam persists because current laws target spam network operators directly, not third party spending by brand owners. I believe lawmakers need to step in and incentivize the brands owners to act against third party spending on spam networks, and unauthorized use of their brands - because brand owners are not exactly setting the world on fire when it comes to aggressive prosecution of spammers. Spam isn't exactly slowing down.

Why are brand owners not fighting spam more aggressively? The owners of the brands that show up in our inboxes oftentimes profit from the spam game, via increased brand recognition and the sale of their products. Is there really an incentive for brand owners to step in and stop all this advertising?

One way lawmakers could instantly reduce spam is to extend the CanSpam initiatives to all third party spamming actions involving brand marketing and require brand owners to "follow the money" and audit their sales and marketing channels for compliance. That's the first action that needs to take place - have brand owners account for not just their own marketing activities, but all third-party activity related to their brand, and the spamming of consumers.

The second thing that needs to happen is that shareholders need to start holding executives accountable for brand management - because one of these days, the patience of the consumer is going to run out, and these brands may suffer an extreme, or even fatal, loss of equity. Shareholders with an ability to think long-term may want to consider the negative effects of a rampant spamming campaign featuring their brand - and the current temperature of the public - and start asking questions of senior executives at their annual meetings.

Currently, brand owners don't do enough to protect these shareholder assets - few even attempt to stop spammers from using their trademarks - even spammers that use their brands to sell other products continue to abuse brands with impunity. And although some brand owners have filed law suits against known spam perpetrators, such actions are few and far between.

If brand owners don't act, I predict things will get even more interesting on the legal front. It isn't hard to imagine an increasing number of class actions against brand owners by consumers sick of spam. When the first lawyers were hired by people made ill from cigarettes, the lawyers didn't waste time suing their place of employment, or their doctor - they went "upstream" to the cigarette manufacturers, and as a result of those efforts, profits are now being redistributed from the tobacco companies back to those affected by their products.

It's a proven strategy. It has enabled the world to get rid of tobacco smoke in interior environments. The mere threat of this tactic worked to rid New York City fast-food places of transfats. This approach may even work to rid us consumers of spam. Stay tuned.

Brand owners, if you have not already done so, you need to start aggressively fighting the unauthorized use of your brands using the courts, and international copyright laws and trade agreements (need an example of best practices? Disney is great at fighting unauthorized use of their brands, worldwide.) Then you need to follow the money funding the spam campaigns that feature your brands, audit your marketing partners and distributors, put an injunction in place against non-compliant parties, and tell the world about what you've just done.

Become part of the solution - your brand will become more valuable as a result.

Really Simple Malware Syndication

Computerworld picked up on my latest blog about how RSS feeds are increasingly being used as malware vectors. They interviewed Ray Dickenson, our head of products, yesterday. Ray's answers, and Jaikumar Vijayan's excellent article, can be found here.

Blog Droppers & Gator Spam: RSS as a Vector

RSS (Really Simple Syndication) cross-scripting hacks have been around a while - but until quite recently, RSS feed readers were not on enough desktops, and "gators" (RSS feed-aggregating web sites) were not well-visited enough to make either destination an appealing target for criminals. That is changing fast.

How fast? At the last Black Hat conference last October, Bob Auger of SPI Dynamics presented on how RSS feed hacking could potentially become more ubiquitous than spam - and potentially more harmful, because RSS feeds made up of blogs and "spiced comments" (i.e. comments laced with malicious script) can quite easily be used to deliver malware and other problems right to the desktop, especially when blogs or gators are created and managed by non-sophisticated admins.

Think for a moment about how many blogs enable unmoderated comments to be posted by their readers. Think about how many RSS readers are being downloaded every day, in the form of desktop widgets, or browser tool bars. Think about how many web sites there are out there that aggregate and publish every RSS feed they come across. The answer is: millions. How many of these sites and desktop technologies are wired to filter out scripts from these comments using human intervention or anti-malware engines before they reach the reader base?

Like many bloggers, when I see something I want to quote in someone else's blog, or in their RSS feed, or their comments, I copy and paste it, and write around it. Regardless if there are links or tags or images involved, or just text, I always make it a habit to take a peek into the html source before sending it on. But how many other bloggers check these web objects and links before they publish?

Inserting malicious code into the blogosphere is *way* easy if you're a hacker. Here's one way we're seeing it done - let's say I have Comments enabled on my blog site, and my RSS feed is set up to deliver those comments to you via a popular feed mechanism and a reader widget.

Now, let's assume that someone wants to use this feed to deliver a piece of malicious piece of script designed to download a keylogger or some other piece of malware onto my reader's PCs. All the person inserting the comments needs to do is to write a comment, drop some script in it behind an innoculous-looking URL, and voila - out goes the malicious script with my feed to every desktop reader and gator signed up for it.

Now, if your anti-malware engine is up to date, and your browser settings are well-tuned, you might catch it before it does any harm - assuming you choose the right button on the alert. But most likely, this is going to be a brand-new threat, not a repurposed piece of malware. In which case you'd better hope your zero day malware filtering technology is working, otherwise, you're going to end up hosed - probably by a dropper or a keylogger if you're a desktop user, or, if you're a gator, by a half-ton of pharmaspam.

Although some developers appear to be making strides in this direction (Bloglines is one of them), most RSS feeders and readers were not built with security foremost in mind - they were built to achieve ubiquity with one eye on style and efficiency. Many desktop readers are little more than extremely simple XML parsers wrapped in widget (or phidget) clothing, and many aggregation sites are worse - they use literally hundreds of technologies, many home-cooked.

This cannot stand - developers of RSS feeders, aggregators and readers need to start thinking seriously about establishing a certification standard for security, and feed injection prevention. In the meantime, popular feeders should consider pushing their RSS feeds through antimalware engines - the same way Yahoo and Hotmail started checking mail for viruses and spam post the tipping point of email adoption. This is not an expensive proposition - and would provide at least a starting point for protecting folks downstream.

Don't Ask, Don't Tell

And speaking of Fox News, this statement from the Kelly Middle School Principal, Scott Fain, has him admitting that Amero reported the popups as a problem:

"Principal Scott Fain... said Amero was the only one to report such a problem. 'We've never had a problem with pop-ups before or since,' he said."

So Amero was "the only one" to report such a problem - and before that, there was no problem, and there hasn't been one since, as in "zero" pop-ups or porn. That must be a helluva filtering program they have installed up there.

Teachers, take heed. Reporting problems such as porn-inducing popups to the school principal could be hazardous to your career, your family, and your liberty. Best to say nothing - that's the lesson here.

"Popup Porn" Teacher Loses, Prosecutor Wins

Several weeks ago, we were alerted to the story of Julie Amero, the substitute teacher due to be sentenced on March 2nd in Norwich, Connecticut, for four counts of endangering a minor. Julie faces forty years in jail because hyperlinks embedded inside images on a web page she visited took her to a Russian sex site and then locked her classroom PC in a cycle of popups and new browser windows in the presence of seventh-graders.

As reported earlier, I have seen the javascript from the original web page and others we trust in the industry have studied the computer she used. We contacted Fox News and gave them this information and they have been diligent in reporting the story - yet one more story involving an ambitious prosecutor, a non-caring judge, and a less than diligent lawyer. Fingers are also being pointed now at the school IT administrator, who has admitted that the computers were not protected at the time.

At the trial, David Smith, the ambitious local Norwich prosecutor who brought the base, argued that it was possible to tell the mouse clicks leading to the URLs were made by a human with the intention of visiting a site. This is absolutely false. The javascript shows otherwise - there is no way of telling the images at new-hair-styles.com would take you to a Russian sex site - short of right-clicking on the page, selecting "view source" and sorting through the code.

While Amero sits at home awaiting whatever amount of the forty year sentence she gets, the Norwich, CT prosecutor, David Smith, is now rumored to have been promoted. What's next, a shot at a House seat? We can only hope that the local newspaper and the more informed citizens of Norwich wake up sometime soon and start picketing this guy's house for a retrial.

Amero's career as a teacher is over - she has been convicted of four counts of endangering a minor. Smith's career as a prosecutor is on the rise. Does anyone think this is a just result?

January Rocked

Our financial year starts Jan 1, so January is always a closely-watched month for us. Last month, we beat our January sales target handily, and development delivered everything on the list. It was a great month for both the sales team, and the developers.

I expect this upward trend to continue. Our fulfillment team conducted twice the number of installs of ESP Enterprise last month than in either of the previous two months, and evaluations are up 4x over December. If this trend continues, ESPE will become our largest-selling product this year.

Our ESP Small Business product is going great and the British Telecom rollout in particular is getting off to a great start. Our other large consumer ISPs are also trending upwards. And after a successful RSA, it looks like we will meet our SDK targets for 2007, based on the rising success of our OEM, gateway appliance and MSSP customers, including Astaro, IronKey, Microsoft, MX Logic, Postini and Secure Computing.

I'm also very pleased at the number of applications coming online now, for both ESP Enterprise, and Elements, the new consumer platform. This quarter will see the release of Kaspersky Labs, SurfControl, Authentium Firewall, Microsoft Exchange, and IBM SAAS application modules for the ESPE platform. That's a great collection of technologies to be releasing in one quarter.

Zero Day Analysis & Antivirus Rankings

One of the conversation threads prevalent right now is malware detection. Specifically, what methods should be relied upon to determine the success of an anti-malware product? Does it really make sense to rank AV products using signatures and years-old samples any more?

Clearly, the answer is "no". We need a better approach - one that purchasers can rely on to protect their systems from the threats of tomorrow. From a purchasing standpoint, ranking systems need to be truly informative. Most of the people that I talked to at RSA this week were not concerned about detection rates of viruses from five years ago - what they are looking for is a ranking system that can show them how the various antimalware companies deal with real-time detection of brand-new threats.

The guys who work on tuning the Authentium Antimalware heuristics engine understand this, and they are doing an incredible job. According to Robert Sandilands, our head virus researcher, our heuristics-based malware detection methods are stopping an increasing amount of malware on the fly - including 90% of everything we encountered in the wild on Jan 29th. See Robert's blog for the graph.

Signature-only systems are working overtime, locked in hand-to-hand combat with Warezov and Storm, the two worst pieces of malware currently circulating. Our guys are spending their time tuning the engine, with far better results, both in terms of detection and speed to market of protection.

Certifying authorities - it's time for a "zero day detection" bake-off. Let's see who's really got the goods when it comes to detecting malware.

RSA Highlights

I really enjoyed the RSA Conference this year. It was crazy.

Tuesday was packed, but Wednesday was even busier - Doug and I had 12 meetings in eight hours, followed by a series of ten minute "power dating" sessions and demos at the show - during which I finally got to see some security technology.

Tim Shull of Crossbeam gave me a great overview of what the company is doing, and I finally got to see some of the boxes (us software guys ship stuff to the box guys all the time but rarely get to see them for real). Crossbeam and Authentium really do much the same thing - both companies enable choice, while focusing on quality of service: the difference is Crossbeam ships hardware packed with integrated technologies from multiple vendors to data centers, while Authentium ships integrated technologies from multiple vendors to end points.

Down the hall from Crossbeam, I met with Mike Lloyd, Chief Scientist of RedSeal. SC Magazine recently lauded RedSeal as "the only company that truly understands IT risks". The system is designed to enable discovery of potential vulnerabilities across the network, and view the impact of them from the standpoint of pathways through the entire system. It displays in detail where the vulnerabilities exist, and what devices could potentially be targeted or abused, and in what manner. It appeared to me to be an excellent tool for security consultants and auditors.

Scott Montgomery of Secure Computing pointed me over to Tarari, a company that focuses on accelerating the processing of data such as virus definition files. I can see why Symantec and our appliance and service providers partners are signing up up for this - the optimization rate differential shown in the demo was tremendous. Although our engine is already highly optimized, we will definitely be taking a look at joining Kaspersky on this platform.

At the CA booth, I took a tour through their new antivirus and antispyware enterprise management system and came away with a big smile. The Authentium system is light years better than CA's. Not only did the CA solution have a smaller feature set relative to our own ESP Enterprise Manager, but the CA solution manages just two end point applications - EZTrust Vet, and CA PestPatrol. Our system is capable of managing these, plus an unlimited number of additional soft blades from multiple vendors.

Finally, we met with analysts from several of the investment banking and business intelligence units. These guys seemed to be most interested in VirtualATM - and in our demo of "phidgeting" (PHIshing using wiDGETs - see my January post entitled "The Birth of Phidgeting).

Companies to watch? Authentium, of course. You could pick any aisle at the conference and walk down it and find an Authentium ESP partner. Ambiron Trustwave - what a great business model. SignaCert could be interesting - their approach to enabling trusted computing is elegant and timely. And of course Prevx, which has a very interesting behavioral analysis approach that I will personally keeping an eye on over the next year, as will Helmuth Freericks, our CTO.

Of course the real highlight was getting to hang out with Doug and Kirk and Ann and our partners after hours and get relaxed and get caught up. Following drinks with the guys from OPSWAT, we had a great night out on Tuesday with the guys from Microsoft, SurfControl and Sunbelt - and Brian Krebs, who writes a terrific blog on security for the Washington Post.

There was a great moment when the guys from Sunbelt Software won an award for Ninja - the product our AV engine sits inside. Drinks were on them for the rest of the night.

Note: Brian Krebs story on the public computer kiosks at the show running in full administrator mode (and the attendant risks) will be talked about for years - you can check out his story (and the picture) here.

Managing IT Budgeting Decisions

Very few organizations are able to fund "the perfect IT security budget."

The majority of IT purchasers usually end up having to make some pretty tough choices - on one hand they need to satisfy all mandatory requirements, but they also need to ensure performance levels don't dip, and there are enough brands on display to satisfy non-IT guys that the IT organization is making sound choices. It's a tough, and often frustrating challenge.

We recently did a survey of our customer base and found that the top choice in the category of end point security remains "antivirus", but antispyware is catching up fast. Also high on the list were client VPN technologies, URL filtering, and image restore technologies. SSO, tokens, etc rounded out the list.

The buyers I know would love to be able to approach a single vendor with a purchase order for all of these technologies, however many branded solutions fall down in at least one or more areas of performance, putting the buyer into the situation of requiring at least two, and possibly more vendors, in order to get the mix of brands, performance and price that they require.

Of course you already know where I'm going with this - our ESP Enterprise end point security procurement and management platform includes a built-in multi-vendor store that enables IT buyers to "mix and match" software choices and make choices in each category based on brand, performance and price. These choices are guaranteed to be conflict-free, which frees buyers from the hassle of having to QA their choices prior to deployment.

A couple of years back, when we were just launching our ESP (Extensible Service Platform) solution, I went up to pitch for a large customer account (that we later won), and found a very gloomy bunch of people waiting for my pitch. It turned out no other vendors had offered them any choices, and this had negated the research they had spent months doing.

Thanks to ESP, we left the room with the deal, because we were able to enable each of their choices and allow them to manage their chosen combination of brands and great-performing, best-of-breed technologies using the ESP unified management infrastructure.

Brand, Price, Performance

Mike Rothman insinuated in his Security Incite blog yesterday that OEM AV vendors other than the "big brands" are licensing their engines entirely on price. That is just not the case - if it were, MSSPs would all be running Clam, or freeware.

There are three reasons why IT buyers choose technology: price, brand and performance. The appliance manufacturers and managed security service providers (MSSPs) that we work for are the industry leaders and they make their decisions based on performance. They are more than willing to pay for highly-optimized, heuristics-based engines, and superior malware databases (like those owned by Kaspersky and Authentium, the two largest in the world).

Why? Because there are significant cost-savings to be gained from implementing better technology approaches that are unrelated to the base cost per unit, or cost per event of the OEM license. These companies, many of whom run thousands of square feet of Linux or freeBSD boxes, run very extensive technology bake-offs and often pay more to license in a particular engine because their TCO analysis shows it makes sense.

In most situations we're deployed in, our AV engine sits alongside many better-known "brands". In every one of these situations, our engine has consistently outperformed the branded offering in every one of four key respects: 1) size of memory footprint, 2) size of database, 3) event throughput, and 4) malware detection rate.

Recently, the Authentium engine not only stopped all major variants of the Warezov worm, but we stopped the Storm virus heuristically as well - without requiring an update. At a though-put rate of nearly four billion emails a week, that's a lot of money saved, and a lot of customer email sorted and delivered without delay. The big "brands" sitting right alongside our engine did not fare nearly as well - which is why they continue to pour money into branding, while we pour money into R&D.

The Shoeshine Guy Codes in C

Raleigh-Durham, home of Duke University, and the world's largest research facility, North Carolina's Research Triangle Park, has an enviable reputation for intellectual activity. I figured out why within five minutes of arriving: the shoeshine guy at the RDU airport codes in C.

As I took my seat up atop the shoeshine stand at RDU airport this week, with the objective of getting my shoes into presentable shape for a high-level meeting, I got into a conversation with the stall operator. The dialog went something like this:

Him: "So where'd you come in from?"

Me: "Palm Beach. Florida"

Him: "Florida. What line of business are you in?"

Me. "Software."

The guy nodded in a knowing kind of way.

Me. "You got a computer?"

Him: "Not right now. Used to have though. I used to program in Pascal."

"You were a programmer?"

"That's right. I started in Pascal, then I moved to C."

"C++?"

"Nah, I never was that attracted by that object-oriented stuff. Never appealed to me. Only got five pages into the manual."

"You should take it up again. Or take up C# - that stuff is drag and drop - you'd pick it up in a heartbeat".

He smiled and shrugged and kept on shining. "Maybe - got to get me a computer first". His smile said he was pretty content. He went back to work.

His friend arrived. His badge said he worked on the same stand. He was reading a newspaper. He frowned and tut-tutted and commented on what a terrible world it is when a four year old in the Middle East can hate her neighbors. I said something from my high chair along the lines of "the tragedy is, there's probably another four year old across the border that feels the same way about her."

"Which is ridiculous", I added, "because all religions come from the same father - Abraham."

The second shoeshine guy put down the paper and looked at me like I was from Mars. "I got a good heart", he said, poking himself in the chest. "You got a good heart", he said, pointing to my heart. "Two thousand years and where are we? Religions, they just want to control the Truth. We should just treat each other *nice*. That's what matters."

His friend nodded, and tapped the bottom of my shoes - the shine was done. Pascal, C, object-oriented programming, four thousand years of religion, and the Control of Truth: just another day at the RDU shoeshine stand.

Securing Wifi-Based Social Networks

WHISHER, a startup out of Spain, announced its launch today. It plans on creating the first wifi-based social network, based on what sounds to me like peer-to-peer connections that share a single connection with a hot spot.

To get this right, WHISHER is going to have to be *very* focused on security - because the kind of social connections currently advertising themselves to wireless users in public places are the kind of peers you should actively avoid. Changing the mindset from "never trust" to "always trust" is going to be a challenge.

We recently published the results of several studies of airport wireless networks conducted at Atlanta Hartsfield, New York's La Guardia, and O'Hare in Chicago that show wireless networks often advertise themselves as being something other than what they are. Google "Authentium" and "wireless" and "airports" and you'll find the news stories.

Example: Yesterday, I was sitting at Legal Seafoods at Reagan National in DC, trying to find a wireless network, when a computer-to-computer network connection advertised itself to me as "Verizon Wireless". Verizon Wireless, it wasn't. But I'm not sure the lawyer sitting next to me would have caught that.

No other environment is as hard for the average consumer to navigate as wireless right now. The interfaces of home networking devices remain difficult to use and way too technical for the average user, and, if my neighborhood is anything to go by, securing these home networks remains far too tough a task for the average home user to easily implement.

Not that it's impossible - all it takes it good communication. There are a number of companies starting to play in the space of "making wifi easy". We've started working with one Texas-based company, Affinegy, and plan on incorporating their easy home network setup apps into the next generation of Authentium ESP and ESP Elements. The play? Wide distribution to our ISP subscriber base, combined with a reduction in support calls for our provider partners, combined with a great set of security tools. Ease of use meets understanding meets happy customers = reduced costs and longer customer lifetimes.

I personally think the hierarchical social networking wifi idea that WHISHER plans on implementing is very cool. If they can pull this off, and keep me secure and well-informed as to the legitimacy of potential peer device connection points when I'm scouting for connections, I'll give it a try.

IT Spending at Kelly Middle School

Mary Landesman of About.com sent me a summary yesterday of the Conn. law regarding endangerment of minors that formed the basis of the instructions given to the jury in State vs. Amero. Moral and physical injury to a child are viewed equally under this law. With both prosecutor and judge supporting its applicability in the case, questions should be asked regarding who was actually responsible for the URLs getting in front of the kids.

There is no shortage of terrific content filtering and antispyware technologies out there. As the largest licensee of Internet content filtering and antispyware technology in the world, we get to see just about every filtering methodology there is. Bottom line: if you want to lock down a school computer and analyze and log every event, and re-image PC's automatically, you can. However, many schools face bottom-line challenges in bringing this about.

We do a lot of business with schools. Our Command/F-Prot, ESP and Foolproof Security technologies reside on millions of school desktops. I know a lot of the procurement and IT folks personally, and I can tell you the biggest issues these teams face when it comes to deploying end point or perimeter security software are "budget" and "availability of personnel/expertise". Often, school IT departments are provided with no money, no training, no personnel.

On a plane last year coming back to Palm Beach from California last year, I sat next to a teacher who was doing double-time as his school's IT guy, because "no one was doing it" and the school had no dedicated IT manager. He told me a story of a shipment of brand new Dells sitting under plastic in a school storeroom because no one had the time or expertise to set them up. Turns out that his school committee has a history of budgeting a lot of money for hardware, and virtually *zero* for software and service personnel. Budgeters, this is bad strategy.

I know parents are pretty upset at what happened at Kelly Middle School. But perhaps they should consider moving their inquiries upstream, and start asking why the right level of technology wasn't deployed on the computer used by Ms. Amero and her students. Parents, start with the IT manager, then move on to the principal and school budget committee, then move onto the district, then up to the State. Follow the money. See if any proposals were submitted for this kind of software, then rejected. Ask why.

Incidentally, Kelly seems to have much more IT money available (and end point security software installed) today versus December 2004. Parents, what caused this change? Why didn't Kelly Middle School's IT department deploy more protection back then?

If Julie Amero does end up in jail, it will have at least one positive effect: school teachers and IT personnel around the country are going to start demanding more money be spent on content filtering and end point protection, lest they face the same fate. And children will be better protected as a result.

Connecticut's Pursuit of Folly

Fox News just did a live report on the Julie Amero story and they did an excellent job.

Some of the details that are now emerging - that Julie was four months pregnant at the time of her arrest, that another teacher was actually logged in at the time of the downloaded files, and that the computer in question was "totally in the clear" (i.e. not running any updated security software) are disturbing to say the least.

Since my last blog I have had a chance to look at the javascript and html at the heart of the case, courtesy of pages retrieved from archive.org dated November 2004.

Upon examining both new and old code for www.hair-styles.org and www.new-hair-styles.com, the sites visited by Julie Amero back in 2004, several things are immediately obvious: neither site is a "hair design site". Both sites are obvious fronts for Russian and Ukrainian porn, hair-loss and penis-enlargement sites. Browsing these sites, it is clear that what we're looking at are the types of landing pages typically associated with malicious spyware and bot-nets.

Sure, they *look* like hair style web sites, but the style sheet is named "images/sex_style.css" and the background image lives at "http://sex.sweetmeet.ru/" and if you scroll down the page far enough you get to a penis enlargement ad that is a fixed component of the page. Want more proof this is a fake site? The ">>>" images beside the links on the left of the page link to - you guessed it - "sweetmeat.ru".

None of this is visible by the way. It only becomes visible when you click on it. Are you guilt of malicious intent when you click on a link that has an invisible destination?

Looking inside the "body" tag, I find a javascript onload request that tries to initiate a popup. Luckily, most later-version browsers have popup filters built in. Unfortunately for Julie Amero, she was working on a Windows 98 computer that appears to have been very badly maintained by the IT staff at the school (I spoke to someone who has examined this computer first-hand on Friday, and read the Norwich Town Hall meeting minutes last week. I think it is about time someone starting asking the IT manager at Kelly High some harder questions. Contrary to some reports, there was an almost total absence of end point protection on this computer.)

I could go on, but it should be clear to anyone now that the judge in this two-day case didn't want to listen to technical "hocus-pocus", the defense lawyer wasn't "on the case" (literally), and the prosecutor on this case just wanted to get a conviction and move up in life. Sound familiar? Prediction: This will end up being Connecticut's "Duke Lacrosse Team" case.

Barbara Tuchman, one of the best historians ever in my book, once wrote a great book that encompassed Troy, Vietnam, the Renaiisance Popes, and the loss of America by the British called "The March of Folly". In the book, she defines folly as "the pursuit of policy contrary to self-interest". Advisers to the Connecticut Governor should advise quick action now, because the folks Fox News had on tonight are smart people, and the "folly ranking" of what is happening in Norwich is headed for the red zone - fast.

Note: Javascript, for the non-technical, is simply a set of instructions usually written in plain text that get fed into your Internet browser as a web page loads. These instructions tell the browser what to display, whether or not to pop up a window above the page you are looking at upon loading the page, what to do upon submitting a form button and other behaviors. It's pretty hard to design a working web site without javascript, and sites can look pretty ugly if you decide to turn it off.

Optional non-javascript approaches exist, but they can be hard work. Javascript simplifies the job of building web sites and helps maintain consistency of behavior across the site. The problems start when javascript and html are used in simple, but bad ways, to do stuff that is invisible upon loading a typical web page.

Free Julie Amero!

A substitute teacher in Norwich, CT is facing a sentence of *40 years in jail* because pornography appeared on a computer screen used by her and some of her students.

She says “the spyware did it”. You know what? She’s probably right.

From all the available evidence, including an excellent piece of reporting by Sunbelt Software chief and Authentium partner Alex Eckelberry, the recent conviction of Julie Amero is an appalling travesty of justice. If she gets sentenced, I’m going to sit outside and picket the jail until she’s released.

I’m tired of reading stories about misguided prosecutions like this - what’s next - reintroduction of burning at the stake? My opinion: this is misguided, politically-motivated, witch-hunting at its worst.

Fact 1: Spyware is more prevalent on school computers than any other computer systems. Why? Because they are used by large numbers of younger users, many of whom like clicking on things that adults wouldn’t find appealing - including spyware-riddled pop-ups.

Fact 2: Malware works best when it copies or co-opts user behavior. Most of the easter-egg malware is *designed* to cause the kind of behavior described. What better way to induce a user to come to a gambling or porn site than to pop up a graphic invitation based on a command to do something else? Spyware guys have used this technique for years.

Fact 3: There isn’t a prosecutor alive that can show with absolute certainty that this action was caused by a person, rather than a piece of javascript.

Did the court hear testimony to this effect? “We analyzed the activity log and noted that there were spyware/adware programs installed on the hard drive,” computer expert W. Herbert Horner told the court. He then went on to say that he wasn’t allowed to provide full testimony.

David Smith, the prosecutor, says that he has proof that Amero visited the site. He says that she had to “physically click” through to the page. Obviously this guy doesn’t exactly have a computer science degree.

Mr. Smith: I hereby challenge you to tell between a past click action caused by installed spyware, and a click action caused by a human being, using the exact same methods you used to convict Ms. Amero. If you are able to do this consistently, I will personally donate $1000 to a charity of your choosing. If you are not able to do this, you will drop all charges? Deal?

Note: In olden days, there was a quaint legal concept that used to apply called “reasonable doubt”. If two computer experts - Alex Eckelberry and Herbert Horner - were able to ascertain that spyware a) is capable of doing this, and b) was installed on Ms. Amero’s computer, wouldn’t it be *reasonable* to assume that the pornagraphic images that popped up on the school computer *might* have appeared by accident?

Prior to this incident, I’m sure Ms. Amero had a nice, normal life. I really hope she gets it back.

PIE Cycles and Venture Investment

Many stock market investors make investments on the basis of a single Planning, Investment and Execution (PIE) cycle. They plan their investment (i.e. study a stock, or financial instrument), then buy it, then sell it.

Venture investing is different. Information technology (IT) or biotech startups usually require multiple rounds of venture investment - usually designated in alphabetical order in reverse order of seniority of equity (i.e. Series A, Series B, Series C, and so on) - prior to a value realization event, such as a trade sale, or an IPO.

Only a very small percentage of companies exit on the basis of a single PIE cycle - even Silicon Valley darlings YouTube went through three PIE cycles (i.e. an angel round, followed by a Series A round, followed by a Series B round) before being bought by Google.

If you count all angel rounds as one, Google went through five PIE cycles - its last equity offering was Series D preferred stock before exiting. PayPal’s last round was also Series D, prior to its sale to eBay.

A single-PIE-cycle entrepreneurial “hit” is extremely rare. The most common scenario? Three to four PIE cycles, prior to exit. What is the maximum number of PIE cycles prior to value realization? US-based VOIP technology company Vonage made it through their Series E round prior to jumping onto NASDAQ (which makes six PIE cycles if you group their angel rounds into one, or seven PIE cycles if you count the funds raised through their IPO).

For first-time angel investors used to the stock market, sitting through multiple PIE cycles while waiting for an exit can be frustrating. However, most VC’s understand the “multiple PIE Cycle” paradigm, and structure deals to enable them to have preferential rights when future offerings are made.

Once an investment has been made, the firms usually keep capital in reserve to apply to these future rounds of funding - because in virtually all cases, the problem the entrepreneur set the company up to solve turns out to be much harder to solve than it first appeared (hint to first-time angel investors: virtually all technical problems turn out to be harder to solve than they first appear - structure in some warrants with your angel cash.)

The take-away lesson from this for first-in angel investors is: there are no overnight hits. Venture investment requires patience, and a tolerance of long incubation periods. The benefit is, when the entrepreneur finally solves that problem, the rewards can be great.

RSS: From Killer Technology to Killer App

RSS is not yet being adopted by mainstream marketers. A new report from JupiterResearch shows just 5% of marketers use RSS in their campaigns - and just 6% of consumers have adopted it at home.

In other words, while RSS is potentially a great technology and communications medium, it has not yet taken off. To gain adoption, it will needs to be “rewrapped” as a great *product* in order for the technology to really blossom. We’ve seen this movie before: the Internet, pre-www.

JupiterRearch says the challenge for marketers is that RSS is not well suited to promotional-offer-oriented content because it doesn’t offer the targeting and personalization capabilities of e-mail. Plus, over 40% of respondents said they lack the resources and experience to deploy RSS.

So what do RSS backers need to do to start turning this technology into the next killer app? Amanda Watlington’s blog offers up four bullet points for success:

* Demystify the technology so non-technical marketers can grasp the power
* Identify or develop tools that are friendly to the non-technical user
* Develop easy-to-implement solutions for use in pilot projects that will demonstrate the value
* Work with vendors for better tracking solutions — a long range project.

Okay, I’ll fess up: the impetus for this blog is a couple of our Elements guys are working on a secure RSS-based Element that achieves all four of the top bullet points. It’s pretty mindblowing, and does a great job of making RSS simple to use. I’ll blog again once we’ve shown it to a few folks.

Computer Malware Doubling Every 18 Months

One of my favorite press articles on Authentium came out in August 2005, on the heels of a press release announcing that our computer virus definition database had passed the 200,000 unique entry mark.

In that press release, we predicted that computer virus databases would continue to double every year, and that based on the growth of detected threats, our malware database would pass the million unique definition mark by the end of 2008.

One of the journalists at TheRegister.com took our math and extrapolated it to show that by the year 2020, there would be more computer viruses than humans. It was a great piece. At the time, we all had a good laugh - it is always nice to be noticed by The Register, and the thought that there may one day be more computer viruses than humans was certainly a little absurd.

However, since August 2005, the rate of malware production has indeed continued unabated, and is showing for the first time the influence of automated variant creation. It isn’t growing at quite the rate predicted in 2005 - rather than doubling, we are seeing a 66% per year increase - but it is also showing no signs of slowing down.

Authentium Malware Database Growth

Currently, as of 2030 EST Saturday Jan 13th 2006, the database stands at 368,700 identified examples of malware and variants. Assuming current trends continue, within two months we will hit the 400,000 mark - which means that the number of unique computer viruses is propagating at almost exactly the same rate as Moore’s Law - i.e. every eighteen months.

Back in 1991, the Authentium/Frisk F-Prot Professional malware database stood at all of 200 identified threats, most of which were highly visible, but did nothing particularly malicious. It’s a different story today.

Terrorism + Phishing + MI5

I recently reviewed the online video of Guy Kawasaki’s 2006 youth forum - the one that brought together college kids and… well, people considerably older than college kids.

There were some priceless moments during the Q&A. Several times, the camera caught the kids looking at some of the older audience members like they were looking at aliens from another planet. The expressions on the audience member faces were equally enjoyable to watch, as they tried to figure out the thoughts moving inside the brains of the seven young people lined up in front of them.

One of the most interesting responses to one of Guy’s questions involved the forum’s use of email. Guy asked each of the young panel members how much time they spent on the medium. Not everyone struggled with the answer, but one guy clearly did. In the end, he admitted that he only used email for “formal communications… like applying for a job or something.”

The audience laughed, then fell into an uneasy silence. But the deed was done: at that moment, email’s future was sealed - for me, at least. In the eyes of this young man, email was barely better than a letter with a stamp on it. In his mind, email was suited only for the *most formal* of communications.

Which brings me to the announcement today from the UK: according to the Washington Post, Britain’s second-most secret spy agency, MI5, has announced that it intends to start issuing terrorism alerts on a subscription basis, via email.

Email terrorism alerts from MI5. Upon hearing this, a kind of sad feeling seeped through my body. MI5? Email? Aren’t these guys supposed to be fitting mini-defibulators into the glove compartments of Aston Martins? Aren’t these guys supposed to be twenty/thirty years ahead of us, when it comes to technology?

Who is going to receive these alerts - my 68 year old auntie? Is her perimeter spam filtering appliance set to allow this to come through, or will it delete the alert because there has been too many false positives, or too many hoaxes? How will my auntie know that the alert that tells her to seal up every crack in her house with duct tape is real, or a college prank? Is she at all aware of how incredibly easily email can be faked?

MI5 guys - terrorist activity email alerts are a *really bad idea*. Not only can they be easily faked by every prankster on the planet, they fail every basic test of security and reliability:

1. The originator cannot be authenticated
2. The message content cannot be authenticated
3. The time and size/content length of the alert cannot be trusted
4. The terrorism alert transmission infrastructure relies on power grid and communication grid survival
5. If the terrorist’s intent is to create terror, what if someone combines phishing + the MI5 brand?

Let’s imagine for a moment that all the terrorist wants to do is “create terror” (cheap), rather than “cause actual mayhem” (expensive).

What better medium could they choose than an email branded by MI5? Email is probably the most ubiquitous and trusted communications system on the planet. Most people remain unaware that not only can the sender’s domain be faked, but literally everything within an email can be faked.

Look at the phishing stats - increasing amounts of people are being fooled by logos and real-looking HTML-based emails. And now, in addition to the banks, we have the MI5 brand: By announcing that their brand has “weight”, MI5 has created a potential terrorism problem, not a potential solution.

Falsely creating and/or manipulating content in the name of MI5 is now easily within the reach of terrorists: creating a message designed to induce panic under an MI5 letterhead, creating a fake originating MI5 domain, creating a fake sender, creating an official-sounding message, and pushing “Send” - all of this could take less than five minutes.

Britain’s MI5 should rethink this approach. By giving their endorsement to email alerts, they are creating an uncontrollable opportunity for misuse of email by pranksters - or worse.