Slashdot Mirror
Ask Slashdot: Who's Going To Win the Malware Arms Race?
An anonymous reader writes: We've been in a malware arms race since the 1990s. Malicious hackers keep building new viruses, worms, and trojan horses, while security vendors keep building better detection and removal algorithms to stop them. Botnets are becoming more powerful, and phishing techniques are always improving — but so are the mitigation strategies. There's been some back and forth, but it seems like the arms race has been pretty balanced, so far. My question: will the balance continue, or is one side likely to take the upper hand over the next decade or two? Which side is going to win? Do you imagine an internet, 20 years from now, where we don't have to worry about what links we click or what attachments we open? Or is it the other way around, with threats so hard to block and DDoS attacks so rampant that the internet of the future is not as useful as it is now?
No-one will "win", and it's not helpful to represent the issue as if it's "winnable" by either side.
Malware, viruses, trojans and other malicious behaviour of yet unheard methods will always be around, and we'll always be inventing new ways of counteracting them. Which will in turn be circumvented, and so it goes on.
It is bad enough as it is with most software being insecure. Sabotage only makes things a lot worse. And for what? A zero-success track-record against terrorism? Industrial espionage? Having dirt on any possible future and present President, Congress Man, Senator?
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
You can already see the shape of that future in Google's Chrome OS. This is a very much "locked down" combination of operating system, browser, cloud applications, and storage. Security updates are automatic and (eventually) involuntary. You are limited to running the software that Google allows you to run, most of which is executed on Google servers. No website Java programs are allowed at all.
Such an architecture provides for maximum security and has the advantage of minimum hardware requirements for ram memory and on-machine storage. It allows for encryption of all communications between your computer and the outside world with mimimum involvement or decison making by the user. And from Google's point of view it represents the perfect vehicle for advertizing in a controlled enviornment. In a sense, your computer has already been hacked (by Google) when you buy it. And they will make sure it stays hacked to their preferences.
The next step will be integration of the computer operating system with the phone operating environment. The two will merge with more software coming from "app stores" and not from the wild. At the same time, the services on the computer will become more integrated with each other so that social media, calendar, voice calls, texting, and social media work togerther and don't work at all with outside software. It becomes a secure walled garden with enough internal features and flexibility to be tolerable to the mass users who are not or can not be responsible for their own security.
"He took a duck in the face at 250 knots." -- William Gibson, Pattern Recognition
Since the NSA seems to be the most heavily capitalized producer of both malware and mitigationware, I think the question of which side is going to win is a bit irrelevant. Yes, they will win.
You mean like browsers and Javascript? In that case 99% of the population has lost already. The pwn2own competition results are rather miserable. The part that /. probably doesn't want to hear is that the primary effect is centralization and gatekeepers.
Take Usenet for example, it got overrun by spammers and trolls because there was no real way to block them and the few moderated groups basically meant a few people were in control of the discussion. Instead we moved to forums, where you could use CAPTCHAs and various other tricks to block mass sign-ups, moderation, flagging of abusive users and so on. They're not perfect, but they work okay.
Why do so many people use Facebook instead of email? Same thing, much less SPAM. For the longest time, Linux users hailed the repository model over the Windows "download random exe from the Internet" model. Then Apple took it to the extreme with the "one store to rule them all" and suddenly it was a problem. Even on Android you have to pass by huge warning lights to enable third party repositories and Windows Phone has as far as I know joined Apple in the "one store" model.
My guess is that they'll push it to the cloud so all the application code runs on a server and they just need to lock down the browser, more per user&app sandboxes, more difficult time running unsigned software and more users with computers that need Apple's, Microsoft's or Google's sign-off to run an application. The average user simply doesn't understand the micromanagement involved, same way users won't use NoScript when browsing the web. They'll "outsource" it.
Live today, because you never know what tomorrow brings
The open source software world will win in the long term through sustained application of the continual improvement process. There are millions of "us" and only thousands of "them". The most vulnerable in five years time will be closed systems.
I'm inclined to think the opposite.
All of the companies who want to sell us products care only about that. They don't give a damn about the security of those products.
Until consumers wise up and insist on security, or corporations carry some liability for failing to do that, then corporations will just push stuff out the door with half assed security.
It can't just be a war on hacker. It has to also be a war on products with utterly crap security which never gets fixed. Because this Internet of Stuff is shaping up to be some of the biggest security holes imaginable.
Most consumer products do terrible stuff like transmitting passwords in the clear. Chasing down hackers who exploit incompetently/lazily written products can never overcome that.
Lost at C:>. Found at C.