tag:blogger.com,1999:blog-11573761.post4774816473476443297..comments2023-09-23T07:38:46.925-07:00Comments on Chris Quirke's Blog: Malware "War", Lost TerritoryChris Quirkehttp://www.blogger.com/profile/05538828571660803875noreply@blogger.comBlogger2125tag:blogger.com,1999:blog-11573761.post-19384663710953015172008-03-29T02:41:00.000-07:002008-03-29T02:41:00.000-07:00I don't completely agree with you there, as the im...I don't completely agree with you there, as the impact is also on types of business and interaction that initially appeared to be a big benefit of the Internet.<BR/><BR/>I agree with you regarding auto-running scripts in "documents" and "email message text", \Autorun.inf processing, and I predict in future this will apply to "enriched" folder views that enlarge exploit surfaces, and searches that return malware look-alikes. <BR/><BR/>To me, these technologies are obviously better suited to malicious use than anything else, and the first three should never have been created. <BR/><BR/>Content groping to enrich folder views may be safe at the design level of abstraction, but not if you go below that to consider the exploitability of code defects.<BR/><BR/>I predict that search, as a replacement for navigation, is going to become a bugbear for Vista - especially if crucial path and type information is hidden (or malware-spoofed) when the results of the search are returned.<BR/><BR/>But the effects are wider than the predictable (inevitable?) exploitation of ill-considered "features" that allow arbitrary material to unexpectedly run code and thus "oen" the PC.<BR/><BR/>The examples I gave, include online greeting cards and other "send this to my friend as an unsolicited email" business types, which may have harmless or useful in themselves, but result in traffic that cannot be safely differentiated from malware traffic.<BR/><BR/>Also, any sort of online commerce, such as banking, Pay Pal or eBay, is less attractive given the risks of falling for malicious forgery email that purports to be from these sites, but either links somewhere else, or comes with malware. I expect this risk to cause a slowing or die-back in the growth of such business - it's certainly changed my behavior already.<BR/><BR/>But it's a Pandora's box situation. There was a time when writing code viruses was difficult and commercially not worth the effort, until by-design stupidity lowered the barrier to entry and grew the malware scene through years of Office and script malware that travelled in editable form.<BR/><BR/>By now, this large pool of malware coders has evolved into big business, rivalling the size and resources of "legitimate" software, especially if software employment opportunities are viewed on a regional basis.<BR/><BR/>That's why it's too late to simply kill off these dumbo design "features", because by now, malware development resources can fund the investigation and discovery of vulnerabilities and exploits. <BR/><BR/>So even if only Microsoft writes the OS and sees the source code, it's not their platform anymore.<BR/><BR/>Sorry about the delay in moderating your comment, by the way; I missed the "moderate this!" email from the blog site. <BR/><BR/>That in itself is an example of what I mean, as the reason I missed it has to do with spam loads and filtering glitches.Chris Quirkehttps://www.blogger.com/profile/05538828571660803875noreply@blogger.comtag:blogger.com,1999:blog-11573761.post-27474876700568510722008-02-20T05:50:00.000-08:002008-02-20T05:50:00.000-08:00Totally agree. But, those 'technologies' , when th...Totally agree. But, those 'technologies' , when they came into life, didn't serve any useful purpose except to save the lazy user a few clicks here and there. So not really a loss anyway - left tossed at the bottom of dumbland... :)Anonymousnoreply@blogger.com