Black Hat: Hit spyware by punishing purveyors, experts say
Some users want to see them in jail
Computerworld - LAS VEGAS -- With spyware a continuing plague for many computer users, some experts and IT workers are calling for stiffer penalties -- including jail time -- for convicted spyware purveyors.
At a panel discussion yesterday during the Black Hat security conference here, speakers said that antispyware vendors are losing the fight against spyware creators, making more drastic measures necessary.
"It's not technically feasible to stop spyware," said Dan Kaminsky, an independent security consultant. "Think of the millions of PCs that have either been put away for good, sent away for service or replaced because of spyware infections. That is probably hundreds of millions or billions of dollars worth of damage. Yet no one has gone to jail; no one has been sued."
Recent statistics gathered by antispyware vendor Webroot Software Inc. point to spyware's continued growth. Between March and June, more than 100,000 new Web sites hosting spyware were discovered by Webroot. That's in addition to the 427,000 such sites discovered by Webroot since it began searching for them in January 2004 using a specially tuned search engine that Gerhard Eschelbeck, chief technology officer of Webroot, calls a "Google for spyware."
"Viruses are pretty easy to track -- you just stick out the sensor," Eschelbeck said. "Spyware is pretty hard to track down. You've got to actively hunt it down because it changes every day, every hour."
According to Webroot, 31% of all PCs -- including those that are business-owned -- have been infected with Trojan horses, which typically arrive disguised as something innocuous, such as a picture or document. An infected PC at an enterprise is host to an average of 1.3 Trojans, which Webroot considers the worst form of spyware -- although they can be more malicious than that.
Pamela Fusco, an information security manager at an East Coast financial services company, said her team deals with spyware infections every day. The worst incident was spyware that began replicating so quickly that "in 20 seconds it nearly took down our Microsoft Exchange system," she said.
That is despite a comprehensive program Fusco set up for dealing with spyware, including antispyware technology from McAfee Inc. and help from Web application security firm SPI Dynamics Inc.; constant PC audits; a global alert system; restrictions on the use of PCs for employees who don't need full access; and education programs involving live demonstrations or Web video. Another tactic enterprises should adopt includes closely monitoring their Domain Name System logs, said Kaminsky.
And Drew Maness, senior security strategist at The Walt Disney Co., suggested that IT help desk workers be trained to diagnose PCs that are running abnormally slow as possible hosts for spyware.
- Enable secure remote access to 3D data without sacrificing visual perfomance Design and manufacturing companies must adapt quickly to the demands of an increasingly global and competitive economy. To speed time to market for...
- Virtually Delivered High Performance 3D Graphics "A picture is worth a thousand words." That old phrase is as true today as it ever was. Pictures (i.e., those with heavy...
- Best Practices for Securing Hadoop Historically, Apache Hadoop has provided limited security capabilities. To protect sensitive data being stored and analyzed in Hadoop, security architects should use a...
- Top Tips for Securing Big Data Environments: Why Big Data Doesn't Have to Mean Big Security Challenges Organizations must come to terms with the security challenges they introduce. As big data environments ingest more data, organizations will face significant risks...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!