INTERVIEW: Vincent Weafer, Symantec's chief virus hunter

We have people around the world who gather virus samples from customers and other researchers, analyze them and look for trends.We do two types of research. Proactive research examines new vulnerabilities on new platforms. For example, viruses on handheld computers are not a real threat now, although we do have a couple, but over time we know that wireless devices will be a vector for viruses.Then there is a reactive response to the Code Reds and the Sircams. In the middle of a virus infection you need to get information out rapidly. Probably a couple of years, for the technology inside them to get a little more complex. Right now most personal digital assistants are fairly simple. If you have a Trojan in memory, it has open access to the memory in devices you connect to. But it doesn't have the richness of a PC, and it's not quite as connective. A virus is a piece of malicious code that lives inside a host body. It infects one document and then another on the same machine, or one executable file and another.A worm typically doesn't need to live inside a host and will spread from system to system. The mass-mailer models we see now are more like worms than viruses. They can e-mail themselves from machine to machine.The Trojan horse is exactly like the original Trojan horse'a program designed to look like something while doing something else. A good example would be Happy1999. It appeared as a fireworks display on screen, and in background it was trashing the hard drive.Another thing we deal with is back-door programs. Back Orifice and SubSeven are probably the most common at the moment. They're Trojan because they come in as friendly executables. Once on the system, they open up holes or ports so that other machines can connect. We look at the potential for distribution'for example, whether it's a mass mailer that will successfully replicate on all Microsoft Outlook platforms.We also look at how much of the infection is out there based on scans and third-party accounts. Lastly there is the potential for data destruction, data modification and export.We put those numbers together and look at how much protection is out there. For most viruses, the safeguard will be zero for the moment. We see about seven viruses a day. Most never have a major impact. The big difference is speed of attack. In the 1980s and early 1990s we could track virus infections over a matter of months. Now we're looking at global infections literally in hours or minutes. That means you don't have the same time to put up defenses, update your definitions and change your firewall rules.The good news is, awareness has come up as we've become more connected. People have firewalls, gateway scanners, multitier protection. But users are taking laptops home and bringing them back potentially infected. Now consumers have got fairly significant pipes to the Internet, they're becoming the weakest link. We saw in May and June a worm that replicated by spreading to systems already compromised by SubSeven. Most were broadband systems with little or no firewall or antivirus protection. So to protect the enterprise space, it is very important to reach out to consumers and make sure they are equally aware and have tools to protect themselves.People with high-end machines, fairly homogeneous in applications and operating systems and lax in security, are being targeted to spread worms or create zombies, which can serve as launching pads to attack government entities with stronger security. It depends on which segment you're talking about. The military have always been very aware. We've done a lot of work with them.Looking broadly at governments around the world, they generally have been behind on the IT curve. I think colleges can help by making security a part of computer science courses. The virus writer used to be a male, 14 to 23 years old. Today it is a far more diverse group. We've got females actively involved, and motivation is varied, from people looking for publicity to people who want to be the first to write a virus for a new operating system or application. There are insiders who have fairly deep technical knowledge. And of course there are people doing it for profit, to steal information. Hacktivism has been associated with defacing Web sites. An example is Code Red 1, where part of the payload was defacing a site. Why stand out on the street with a placard if you can send a virus that will get a lot of attention? We're seeing more data export, and that gets into loss of confidentiality and privacy and into liability.Sircam affected documents that ranged from password files to financial files to personal records. When people think about security, they think about systems being recoverable. Lost confidentiality is something people consider far more serious.A second trend relates to blending of attacks. Code Red was basically a buffer-overflow exploit, something always associated with hackers. They have now automated that by putting it into a worm that can replicate itself. The trend of using worms and viruses to carry and launch payloads is something we're going to see over and over. In general, yes. They are far more aware than they have ever been, but we've seen time and again that people will sacrifice security for functionality, even when security was built into the products. One example is Microsoft [Windows] pop-up warnings about macros in documents, asking people if they are sure they want to run the macros. And most people say, 'Sure, I'm afraid I might miss something.' Yes, I do. The white-hat hacker fulfills a real need, which is the disclosure of information that will lead to a security patch'but within reason. We have seen examples where people have publicized vulnerabilities without giving the vendor any reaction time, and that makes the end user the victim.