Op-Ed: Quarter of US computers infected with malware, OECD study resorts to baby talk

Buy an ad on DigitalJournal.com

The Sydney Morning Herald wrote:

The report, entitled Malicious Software (malware): a Security Threat to the Internet Economy, gives an impression of two worlds engaged in an uneven war of virus invasion and belated defence.

Cyber crime, to steal data, spy and attack government and business computer systems "is a potentially serious threat to the internet economy," the study, published on Friday, warns.

Organisations involved in "fighting malware offer essentially a fragmented local response to a global threat," the Organisation for Economic Cooperation and Development says.

The OECD has taken the unusual step of spelling out the problem, and calling for international cooperation in dealing with the problem.

What’s scary about this is what the OECD, a peak body in global affairs, has to say to explain its position:
"A botnet is a group of malware-infected computers also called 'zombies' or bots that can be used remotely to carry out attacks against other computer systems," the OECD said.

The report implied that some governments might also use similar techniques, saying: "It can also be assumed that nation states have the same capabilities."

The OECD warns that all forms of hacking have gone far beyond the adolescent disruption of the early days of the personal computer, to become a powerful and growing weapon in the hands of serious criminals.

It is highly profitable, at minimal cost to the criminals but a huge and unknown cost to honest users.

"There is no simple conclusion to the complex problems presented by malware," the report concludes.

This isn’t exactly news to the Internet community, but apparently the OECD feels the need to describe the problem at nursery rhyme level.

So who are they trying to tell? Rip Van Winkle? Goldilocks?

It sounds like it.

Try this as a perspective on the information the OECD report contains:

The report estimates that 59 million U.S. PCs are infected. If one percent of those PCs is infected with a zombie, that’s enough computers to mount a denial-of-service attack on just about any government or financial system on Earth.

If one percent of those computers contains a sleeping virus which is set to respond to an activation signal, same deal.

Nothing’s complete without some politics, either, however simplistic.

Some studies estimate that about 80 per cent of web-based malware was hosted on "innocent but compromised" websites and one report found 53.9 per cent of all malicious sites were hosted in China, followed by the United States with 27.2 percent.

The US invented the net. China has only recently come online.

Even with total suspicion and distrust as the criteria:

1. How is China supposed to acquire the competence to deal with this problem, which the US has never come close to handling, in such volumes?

2. Did 53.9% of all malicious sites just happen to spring up in the last few years?

3. Since when is malware confined to national borders? Even if that report is 100% correct, that doesn't mean the operators of the malware are anywhere near China.

4. If you suddenly get 200+million new users online, why wouldn’t cyber criminals try their luck in a newly rich country? China could be in the process of being robbed blind, and the report suggests that the sites are Chinese, therefore the malware is Chinese.

Then there’s this revelation for the kindergarten kids about crossing the road, complete with misspellings:

"In June 2006, a Trojan horse attacked files in Microsoft Windows users' 'my documents.' The files were then encrypted so users could not access them withut paying a ranson," the OECD report noted.

Kits to mount cyber attacks can even be downloaded easily from the internet and some even come with "service" contracts requiring the buyer to make new versions for the seller. This could cost as little as $US800 .

Gosh, you don’t say?

That $800 is retail, folks, by any standards.

Cost is relative to what you’re trying to do with what you spend.

It’s nice that the OECD has tried to explain to whatever totally insular ignoramuses they’re trying to reach what the problem is, and what needs doing.

My gut feeling, however, is that if they need to be told, and told in this way, there’s a lot of work to be done.