Monthly Archives: November 2011

What is the difference between a nuclear missile and malware?

It’s not a trick question – malware can seize control of a missile, but a missile can’t be used to destroy malware. With the right tools a missile can be diverted by malware, but no amount of firepower can divert rogue software once it is active.

Unlike traditional weaponry, malware can replicate itself ad infinitum. And while a missile can often be controlled in some way, malware tends to attack indiscriminately: nobody knows who it will harm, which corners it will worm its way into. On the inscrutable trajectories of the web, as soon as some black hat launches a malicious program to make some quick cash anything can happen. It’s impossible to calculate what effect it will have, what might be affected by accident and how it could even boomerang back to harm its creators. People tend to make mistakes in everything they do – and writing code, malicious or otherwise, is no exception. There are numerous examples of this kind of “collateral damage” – read my previous post about the fortunes of the Internet .

At least we are now seeing some joint efforts to combat cybercriminals.

The security industry is tightening the screws on them, and the big boys like Microsoft are getting involved. Other different non-commercial and intergovernmental organizations are joining in as well. Governments are beginning to understand that the Internet can be a highway to hell, and are waking up to the need to do something about it. So we are seeing some progress.

However, I’m more concerned about another side of Internet security. The tricks of a cybercriminal will seem trifling compared to a large-scale cyberwar on the web. Yes, you read it correctly – a web cyberwar! This is where things start getting much more complicated and murky.

These are the facts.

More > The military is gradually turning the Internet into one big minefield

Hi everyone,

I’m back again, this time delivering you an experience from Zhuhai, China (literally “Pearl Sea”, 珠海) – one of the seven tracks of the recently launched Intercontinental La Mans Cup series. As luck would have it I was invited to the race on my way to a business meeting (and didn’t regret it one bit!).

Although the Zhuhai race carries the proud Le Mans 24 name, it is more of a cover version of the real thing. It’s not that much of an endurance race – it runs for just six hours – but it still has the same teams, drivers, cars, rules etc. But not quite the same crowds of enthusiastic spectators…yet. Numbers were low, compared with both Le Mans events and with Chinese motorsports in general, but I think it’s only a matter of time before China, as it already has in many other fields, overtakes the established leaders. And this particular event has something else going for it: in Chinese there are plenty of hieroglyphs for “Le Mans” :)

More > 6 hours in 7 pictures (and a link)

Hi everyone,

You won’t believe it, but I’m in Dubai… again!

This time we held our annual European Partner Conference at the Jumeirah Zabeel Saray hotel, on the beach of the iconic Palm Jumeirah. More than 100 partners from all over Europe worked hard for two days – and played hard at Ferrari World in neighboring Abu-Dhabi.

“I was supposed to travel to a small Muslim country, but here I see no less than Manhattan!” said one guy in the party, blinking in amazement. “Dubaihattan,” I corrected him.

More > Dubaihattan views. And sunrise too.

Hi everybody!

Time to tell you about a bunch of really exciting events I’ve been to over the past few weeks. It’s been a fairly crazy mini-tour covering Geneva, Dublin and London non-stop. Two or three days in each city and each time talking to some very interesting people on all sorts of hot topics.

It all started with the United Nation’s International Telecommunication Unit (ITU) meetings in Switzerland. The organization is showing great progress towards developing a common approach to fighting cybercrime on an international level. However, I’m afraid I can’t tell you any further details. It was a very hush-hush private meeting behind closed doors where we discussed some issues I can’t share with you at the moment. Nevertheless – stay tuned and soon I’ll be able to uncover some details…

Next up was Dublin and the F.ounders 2011 conference, which we’ve already mentioned here.

Last stop – the London Conference on Cyberspace. This was quite something – in fact, it unexpectedly turned out to be this year’s best event I was involved in!

The conference, organized by the British Foreign Office, took place on November 1-2 in the Borough of Westminster. I would like to thank the British Foreign Secretary and First Secretary of State William Hague for his personal invitation to me to take part in the event. I must say it was a surprise to find myself as the only “boss” from the IT security industry to address the audience. But then on the other hand I think the Foreign Office made the right choice – big-wigs from competitors would only have given the audience the same old BBB (Boring Business Blah blah blah) and spoiled the event!

More > Saving the Internet in London …

As you might guess from the title, today we’ll be talking about rootkits. At heart this is an interesting topic, but often that ‘heart’ is out of sight: in the press rootkits are rarely covered at all, and if they are the articles are filled with nothing but horror stories that have nothing in common with reality. There are of course many technical articles, but these don’t help the wider audience – the general public.

But the problem exists.

The majority of anti-virus software is making great strides towards protection from rootkits. But this isn’t necessarily a good thing, since not all of it does it properly. The ability to fight them first depends on, and is indicative of, the technological progressiveness and overall level of anti-malware expertise of the developer. And not all ‘developers’ are technologically progressive – so their so-called anti-rookit technologies aren’t up to scratch, leaving overall protection against rootkits around the world  lower than it could and should be. And let’s not forget that many botnets use rootkit technologies, and the ability to draw out this contagion is the best protection there is from cybercriminals.

So let’s go through all the salient points about rootkits in order.

More > The basics, the threat and the remedy …

Windows 8 is coming! In line with its tendency to introduce high-profile security features in each new version of its operating system, Microsoft is unleashing some pretty interesting new protection technologies with its next OS release. In fact, some of them may dramatically change the cyber threat landscape and bring the security industry a set of very handy tools for protecting users against sophisticated threats like rootkits.

Today my “in the Spotlight” guest is Alexey Polyakov, the Head of KL’s Global Emergency Response Team, our consulting service that assists enterprises in investigating security incidents, and auditing and improving corporate security policy.

Ever since graduating from Moscow State University with an M.Sc. in Physics, Alexey’s been working in the IT security industry – now for 15 years – with a résumé featuring positions at McAfee, IBM, Symantec and Microsoft.

Prior to joining us at KL Alexey worked as a senior security program manager at Microsoft, where he became the proud founder of the Microsoft Security Response Team and was one of the key members of the company’s security development. He’s authored and co-authored security technologies protected by 12 patents, and one such technology was Secure Boot – perhaps the most ambitious advance in Windows 8 in terms of security.

So, let’s see what our man can tell us about what to expect from Windows 8 from the security standpoint, and how this might change the security market.

Microsoft’s recent ‘Build’ conference made rather a splash in the industry by announcing many useful features in its upcoming Windows 8. While mostly addressing the new user interface, performance issues and multi-platform support, the company also presented a number of security innovations.

What do you think about Microsoft’s products’ security in general?

More > Some nice tools to make cyber criminals’ life harder…

Hi everybody,

Last week I was lucky enough to have been enjoying true Irish hospitality at the oh-so-special-yet-informal F.ounders 2011 conference.

It was a great experience, even for me – a person whom it’s quite difficult to surprise with an event. Some people call F.ounders the “Davos for Geeks”, and frankly speaking I would in some ways agree with this description! But “geek” I think has some negative connotation, if only jokingly. Here though – there was only positivity – tons thereof. Unique!

The recipe for the event was quite simple.

You mix together renowned IT-entrepreneurs, high-profile press, investors and promising start-uppers; then pour the mixture into a beautiful city, add lashings of real draft Guinness (the sort that takes aeons to settle before a top-up – only found in Ireland, (sadly)), then heat up with personal attendances of national leaders and local celebrities, and you’re done! What you get is the delicious F.ounders cocktail!

More > Bono leads the way on a Dublin pub crawl!

I’m very excited about today’s guest. Very few industry experts know him by name, even though he’s the guy who first discovered the notorious Stuxnet worm in 2010. His name is Sergey Ulasen.

First, a few background words about Sergey. I’m happy to say that he joined the company in August 2011, immediately starting to contribute to the ever growing expertise of our malware analysis team, which now consists of more than 100 experts around the world. He’s a very professional and high spirited man, possessing the expert knowledge and experience for tackling even the most sophisticated threats.

Sergey graduated in 2006 from the Belorussian State Technical University with a B.Sc. in software development. He began his professional career with local anti-virus vendor VirusBlokAda as a programmer. Later Sergey joined the team that engineered the company’s anti-virus engine, and in 2008 he became the team leader. He was also involved in developing anti-rootkit and system rescue technologies, and helped with solving the most sophisticated malware incidents.

Then he joined KL. Me very happy.

Sergey, let’s go back to the moment when your team first discovered the Stuxnet sample. How did it all come about?

See more > Ten questions casting light on Stuxnet’s discovery …