<<< Date Index >>>     <<< Thread Index >>>

the heart of the problem [was: RE: mac trojan in-the-wild]



On Thu, 1 Nov 2007, Thor (Hammer of God) wrote:
But more importantly, let's look at things from the other side.  Let's
say I'm wrong, and that Gadi is right on target with his "hit hard"

I'd say we are both right.
You look at it from a security researcher stand-point. There is nothing interesting about user-interaction, and it is even kind of lame.

From a reasonable perspective, we refuse to believe people will act so ..
silly.

prediction and that we should be very concerned with this.  Given the

Not predicting, assessing.

Criminal elements have a very clear cost/benefit calculation. For example, they won't release a 0day such as WMF or ANI as long as their revenue goals are met with published ones. They collect statistics on OS, browser, language, which exploit got how many, etc.

They have thousands on thousands of sites infecting users who surf (some of them ad-based on real sites, or defaced sites such as forums that remain with the same content only now infect people). Then there is also spam directing people to these sites.

Now, a criminal gang (could be the mob could be one guy) targets the mac. So much so that they serve different malware by OS-type.

As a security researcher looking at code, bits and bytes, you are simply not usually following what's going on in operational security where things are bleak.

From an operational security standpoint, this equates to what happened in
the world of the Internet back when Windows 98 was around. Not what security features it had.

requirements here, that again being flagrant ignorance where all the
above steps are executed (including the explicit admin part)-- what
exactly are we supposed to do?  If people are willing and able to go
through the motions above what can we as security people do to prevent
it?  Far too many people in this industry are far too quick to point out
how desperate the situation is at all turns, but I don't see many people
offering real solutions.  But you know, I have to say...  If we are

Things are in fact FUBAR. We need new ideas and new solutions as honestly, although we want to feel we make a difference by taking care of this or that malware or this and that C&C we are powerless and have not made a real difference in the past 6 years while things got worse.

We need new solutions and new ideas, and would be more than happy to have new people exploring operational security.

The current state of Internet security is you get slapped -- BAM! -- and you write an analysis about it. (when speaking at ISOI I actually slapped myself -- HARD -- when I said it on stage, not a good idea for future reference).

really going to consider this "serious," and we are really going to
define part of our jobs as being responsible for stopping people who
have absolutely no concerns for what they do and are willing to enter
their admin credentials into any box that asks for it, then I'd say that
there is a *serious* misunderstanding about what security is, and what
can be done about it-- either that, or I'm just in the wrong business.

t

Well, we can't choose the risks. They choose us. Sometimes they are cool, sometimes they're not.

I often start emails by saying "first off, this is not the end of the world, the Sun will rise tomorrow and the Internet won't die today". I tire of it. Of course the Internet won't die today, but it is Mac season.

Apple is very much correct by not investing in security first until now -- from a BUSINESS standpoint, however much we as security people in our niche can't get behind it. Things are different now and unfortunately they have a backlog to deal with.

        Gadi.