Slashdot Mirror
Ask Slashdot: Who's Going To Win the Malware Arms Race?
An anonymous reader writes: We've been in a malware arms race since the 1990s. Malicious hackers keep building new viruses, worms, and trojan horses, while security vendors keep building better detection and removal algorithms to stop them. Botnets are becoming more powerful, and phishing techniques are always improving — but so are the mitigation strategies. There's been some back and forth, but it seems like the arms race has been pretty balanced, so far. My question: will the balance continue, or is one side likely to take the upper hand over the next decade or two? Which side is going to win? Do you imagine an internet, 20 years from now, where we don't have to worry about what links we click or what attachments we open? Or is it the other way around, with threats so hard to block and DDoS attacks so rampant that the internet of the future is not as useful as it is now?
No-one will "win", and it's not helpful to represent the issue as if it's "winnable" by either side.
Malware, viruses, trojans and other malicious behaviour of yet unheard methods will always be around, and we'll always be inventing new ways of counteracting them. Which will in turn be circumvented, and so it goes on.
you, me, and everybody else. As opposed to conventional warfare cyberwarfare is all but guaranteed to catch civilians in the crossfire.
No need to type that "over the internet" part.
It is bad enough as it is with most software being insecure. Sabotage only makes things a lot worse. And for what? A zero-success track-record against terrorism? Industrial espionage? Having dirt on any possible future and present President, Congress Man, Senator?
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Which side is going to win?
What makes you think it'll ever be over?
Here's a sports analogy, if you need one.
(the radio version was better but I couldn't find it)
systemd is Roko's Basilisk.
You can already see the shape of that future in Google's Chrome OS. This is a very much "locked down" combination of operating system, browser, cloud applications, and storage. Security updates are automatic and (eventually) involuntary. You are limited to running the software that Google allows you to run, most of which is executed on Google servers. No website Java programs are allowed at all.
Such an architecture provides for maximum security and has the advantage of minimum hardware requirements for ram memory and on-machine storage. It allows for encryption of all communications between your computer and the outside world with mimimum involvement or decison making by the user. And from Google's point of view it represents the perfect vehicle for advertizing in a controlled enviornment. In a sense, your computer has already been hacked (by Google) when you buy it. And they will make sure it stays hacked to their preferences.
The next step will be integration of the computer operating system with the phone operating environment. The two will merge with more software coming from "app stores" and not from the wild. At the same time, the services on the computer will become more integrated with each other so that social media, calendar, voice calls, texting, and social media work togerther and don't work at all with outside software. It becomes a secure walled garden with enough internal features and flexibility to be tolerable to the mass users who are not or can not be responsible for their own security.
"He took a duck in the face at 250 knots." -- William Gibson, Pattern Recognition
Since the NSA seems to be the most heavily capitalized producer of both malware and mitigationware, I think the question of which side is going to win is a bit irrelevant. Yes, they will win.
Right with you on the javascript thing. I use noscript passively everywhere. The internet is just a nicer place when random javascript has to have permission to run at all.
I only run what I have to run.
I do the same thing with cookies. If a site doesn't need cookies then I don't let it store them on my machine. And third party cookies? ha. Basically never. I go through most of the internet like a ghost. They can track my IP I guess but that is a far cry from loading me up with tracking cookies or insane amounts of nested javascripts.
Have you ever seen how they're set up? They put one inside another inside another inside another. They're like those fucking russian dolls only worse. You'll have five or six nested inside of one script and then each of those could have two or three scripts inside of it and so on. It is insane. There needs to be some sort of passive standard that limits scripts to the host domain. I don't understand why you'd run foreign scripts. There's no reason for it. ANd if you REALLY need to, then fine... let people right click something to add an exception but if most people don't do that the web admins will craft less retarded sites... and hopefully the ad people will be less obnoxious.
I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
You mean like browsers and Javascript? In that case 99% of the population has lost already. The pwn2own competition results are rather miserable. The part that /. probably doesn't want to hear is that the primary effect is centralization and gatekeepers.
Take Usenet for example, it got overrun by spammers and trolls because there was no real way to block them and the few moderated groups basically meant a few people were in control of the discussion. Instead we moved to forums, where you could use CAPTCHAs and various other tricks to block mass sign-ups, moderation, flagging of abusive users and so on. They're not perfect, but they work okay.
Why do so many people use Facebook instead of email? Same thing, much less SPAM. For the longest time, Linux users hailed the repository model over the Windows "download random exe from the Internet" model. Then Apple took it to the extreme with the "one store to rule them all" and suddenly it was a problem. Even on Android you have to pass by huge warning lights to enable third party repositories and Windows Phone has as far as I know joined Apple in the "one store" model.
My guess is that they'll push it to the cloud so all the application code runs on a server and they just need to lock down the browser, more per user&app sandboxes, more difficult time running unsigned software and more users with computers that need Apple's, Microsoft's or Google's sign-off to run an application. The average user simply doesn't understand the micromanagement involved, same way users won't use NoScript when browsing the web. They'll "outsource" it.
Live today, because you never know what tomorrow brings
The open source software world will win in the long term through sustained application of the continual improvement process. There are millions of "us" and only thousands of "them". The most vulnerable in five years time will be closed systems.
Minor infections will become less common, as the attack surface area is reduced and mitigated over time. New APIs and interfaces will be created, creating N+1 standards, but they'll be more secure than the older ones they supersede. For example, Flash and ActiveX are slowly going away in favor of more secure alternatives. How many critical html5 vulnerabilities are found in your browser of choice compared to critical Flash/Java Web Client vulnerabilities? Open source is a big part of it, but security being baked into the design rather than being tacked-on after thousands of vulnerabilities have been written into legacy code is bigger.
On the downside, when you DO catch an infection, it'll be nasty. New methods for hiding in firmwares will require removing chips and re-flashing them, and unless open firmware takes off in a big way, in practice this will mean replacing hardware very carefully so it doesn't infect the new hardware. It will be virtually undetectable, and have countless methods for defeating airgapping, virtual machines, decompiling, reverse engineering, and antivirus software. So once your machine is owned, it'll really be owned.
The best thing that can be done is to systematically eliminate every motivation to deploy malware: make spam unprofitable, harden SCADA to eliminate sabotage, mature altcoins to not benefit from stolen processing cycles, and regulate online advertising so ad injection is pointless. Also, rework the protocols that allow DDOSing, and require actual two-factor authentication for financial websites/transactions. Eventually, I think malware will be rare/invisible enough that only computer scientists will know about it, ordinary users won't worry about it.
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
Whos going to win the arms race? easy. Maalwarkstrodon. Its a mythical beast that speaks in pornographic subplots and maintains direct communication with your girlfriends every wants and desires so as better to inform you on how to best please her. It has the feet of bonzi buddy, the torso of that man who uses 1 weird trick to perfect his abs, and the arms of the scientists that hate her. Most impressively, Maalwarkstrodon has a skull made from a Viagra, Levitra, Cialis, and Propecia alloy. This beast of malware belches sexy singles from former east-bloc soviet satellite states and is cloaked in the finest fashions from paris and milan, imported directly from Fujian china.
Maalwarkstrodon is incapable of offering any less than the best deals at 80% to 90% off, and will not rest until your 2 million dollar per month work-at-home career comes to fruition and the spoils of all true nigerian royalty are delivered unto those most deserving of a kings riches.
Good people go to bed earlier.
A malware arms race is like Alien vs Predator: no matter who wins, we lose. Or so I've been led to believe.
Neither. The malware war, like tic-tac-toe and global thermonuclear war, is unwinnable.
Slow down, cowboy! It has been 4 hours since you last posted. You must wait another few hours.
I'm inclined to think the opposite.
All of the companies who want to sell us products care only about that. They don't give a damn about the security of those products.
Until consumers wise up and insist on security, or corporations carry some liability for failing to do that, then corporations will just push stuff out the door with half assed security.
It can't just be a war on hacker. It has to also be a war on products with utterly crap security which never gets fixed. Because this Internet of Stuff is shaping up to be some of the biggest security holes imaginable.
Most consumer products do terrible stuff like transmitting passwords in the clear. Chasing down hackers who exploit incompetently/lazily written products can never overcome that.
Lost at C:>. Found at C.