Last week I held and on-demand seminar out at a company in Stockholm, Sweden.
This is my retelling of that seminar and I wrote this down mostly for my own sake, for learning and seeing the areas in which I had to improve in order to be more clear to non-technical people that is on the other end of my message being transmitted.
The CTO of the company had asked us to help him educate his users on their responsibilities when it comes to keeping a network secure, and what potential harm they could cause themselves and the company if not doing so.
This is the neverending problem. Educating users. So how did I go about re-inventing the wheel?
I started out by presenting six simple questions and statements:
- Do you think that the information in your home computer is valuable?
- Do you think that your home computer is adequately protected from viruses and other kinds of malware?
- Do you think that the information in your work computer is valuable?
- Do you think that your work computer is adequately protected from viruses and other kinds of malware?
- Is the statement “There is less malware today than two years ago” true or false?
- Is the statement “There is less risk for getting infected now than two years ago” true or false?
I asked the participants to consider the questions and statements and keep their answers in their head. Of course, they might have understood that a person from an anti-malware vendor might have a hidden agenda in these questions 
After this I presented some of the results from an internal study that concludes that most users of our anti-malware solutions think that the two last statements are true. That is, they think that there are less malware in the world and that there is less risk to get infected now than two years ago.
I then continued on to talk on how this is fundamentaly wrong and backed that up with the statistics from PandaLabs and the recent “InfectedOrNot”-survey of home users computers. I did not mention the corporate study, but if you are interested you can find both of these at Panda Security’s Research blog.
This study (of home users) are based on 1,5 million PC’s that were scanned with the online service www.infectedornot.com between May and July 2007. Among other things it concludes that out of all scanned computers with running and up-to-date antiviruses, almost 23% have active malware on their system. That is almost 1 in 4.
Why is this? Well, one thing that is largely responsible for this situation is the change of objective and goal of the malware today. Just a couple of years ago there were no banking or creditcard logging trojans, no spam-enabling botnets etc. Back then it was all about fame for the author, and that made it very easy for us antivirus guys. Today we are seeing a lot of new malware pop-up and a large amount of these are created with only one goal in mind, and that is financial gain for the creators. And as we all know, where there is money coming in there is money spent and what we are seeing today are professional malware writers making a business out of it. They have business plans and a whole development cycles and spends a lot of resources on pumping out variations on their goods to avoid the anti-malware radar. The “Storm worm” is a good and quite obvious example of this.
Of course this variation flood of the same malware creates a lot of strain on our (Panda Security’s) and other vendors virus-labs and forces us to either become selective, or to have a huge backlog of malware. Up until recently this was the situation for us.
We have had to adapt to this situation more and more during the last couple of years and we are finally catching up thanks to different things. First, we have increased the amount of automated processes and minimized the human factor in malware analysis and second we have created and implemented new technology that helps us to proactively detect and report potential threats (TruPrevent). Other new technology such as our “Collective Intelligence” also helps in detecting new malware family’s at an early stage.
Anyways, the end result of this massive onslaught of new modifications is that we (all security vendors) are bound to miss at least one which in many cases leads to a user being compromised in one way or another.
Now I turned the focus to where the real impact is and that is; Who is the Target and who is the Victim?
As the motivation behind the malware has changed, it is more than ever the actual user behind the keyboard that is the target. It is her information, her payment cards, her banking info and it is her computer that the malware authors want to use in DDoS attacks and other criminal activities.
This is very important for the average user to understand because if they do not, they will not think before they act and fall prey for the criminal gangs of the digital world (OMG, that sounded like a SecurityFocus line hehe).
OK, so what can the user do to secure his computer against these different kinds of threats? Well, as a start you (the user) should make sure that the following four bases are covered:
- Check that your computer is up to date
- Check that you have an anti-malware solution installed
- And turn on all protection modules, they are there for a reason
- Check that your anti-malware solution up to date
- If it’s not, it is almost useless
- Check that you have a firewall installed
- If not included in your anti-malware, use XP/Vista’s builtin firewall
However, as I mentioned in the start of this article, there will be things that can slip through. So what do we do next? How do we protect ourselves from threats that even the largest companies that offer protection cannot touch? Many times this is just a matter of:
Sound reason & Knowledge
I then continued on to illustrate what sound reason is when you browse the internet, use your e-mail and use community’s or instant messaging. In this section I talked about issues such as attached files or filetransfers from unknown users or senders, why you should not just click Yes/I Accept/Next without reading and seriously considering why you are asked. I also discussed the social issues and identity security issues posed by sites like MySpace and in particular Facebook. You know, the real essentials of this whole seminar. What you really really should not do when being asked to do something, to use your sound reason.
And then we have the “Knowledge” part. How do you teach a user to behave in a secure way and recognise indicators of foul-play in 10-15 minutes? Quite hard wouldn’t you say? I reasoned like this; Knowledge is part experience and part theory. If you have seen someone get their machine infected in some way or another then it is highly unlikely that you will repeat the same mistake (or… hopefully it’s “highly unlikely”). So I decided that the best way to learn users what to avoid was to actually show them some of the warnings they should pay special attention to and also demonstrate some social engineering tricks used by malware today.
One of those examples that worked the best was a login page for a large swedish bank which I had modified to “ring alarm bells” by faking an invalid SSL certificate. I then named that slide to “The internet banking service - Find the error”.
No one was able to spot the error.
And I was even using Vista which showed the whole adress bar in red with a big “Certificate Error”-shield at the end. Anyhow, I went on to tell them why this was a bad thing and from now on they are probably going to pay more attention to these kinds of errors.
Another example that seemed to make some people move around a bit in their chairs was the Storm worm’s halloween spreading mechanism with the dancing skeleton. Specially after I explained what storm was designed to be able to be used for (creditcard gathering, spam, ddos, well… everything). As I saw their reaction I even threw out an old classic a colleague of mine told me to say, “They can even turn on your webcam and see what you do in the room”. Heh.. yeah.. i know, a bit evil but it fit perfectly into my talk and they seemed to get the point now.
Now there was not very much time left for me to spend so I finished of with a recap of the questions in the beginning and also took a short slide on the corporate aspects. If they as private persons could suffer such financial loss and make it easier for others to conduct criminal activities, what could happen if their work-computers or computers that they connected to their workplace with got compromised? I asked them to consider the following possible implications of this kind of intrusion:
- Money. Large amounts of money. Either through direct loss or industrial espionage.
- Money. In the form of work-hours needed to clean up a widescale infection (including specialist help)
- Brand and Reputation. The damage caused by their network spreading malicious software or distributing confidential client information.
- Their personal freedom as in the restrictions put on their browsing, messaging and other aspects. Probably there is some checks on this today, but how will that change after an intrusion? Upper-management will want to restrict as much as possible to prevent this from happening again.
Yes, I know the last one is kind of a moot-point (as everything should already be locked down) but I needed to give them a personal connection to the trouble that could be caused, and -oh my god- if they cannot access their hotmail one day
And then i finished of with the “The End - Questions?” slide and took some of them. What was interesting about the questions was that a lot of them was regarding the Codec-fakes that I had discussed in my “Sound Reason” section. I did not expect this to be as prominent as most issues we recieve through the supportline with infections has entered through the web-browser with the help of security vulnerability’s or other means, we almost never hear anything about the fake codec angle (good thing?/bad thing? :)). But I guess that Sunbelt Software is really doing a good thing drumming on about the sites that are advertising those.
Ok, that was it. I would really like any comments that you might have, so please drop me a line at: daniel(dot)nystrom ( a ) icmpecho(dot)com!
Self-extracting RAR, no encryption and no sandbox detection.
