IT-Analysis.com
IT-Analysis.com Logo
Enterprise SME Business Issues Technology Services Channels
Module Header
David TebbuttTeblog
David Tebbutt
19th November - Collaboration: the old way. Why not?
Martin BanksBanks Statement
Martin Banks
18th November - This Cloud has a silver lining
Peter AbrahamsAbrahams Accessibility
Peter Abrahams
18th November - Major new accessibility features in Firefox 3.0.4
Martin BanksBanks Statement
Martin Banks
17th November - Psychology of data ownership may be changing at last
Tony LockFreeform Comment
Tony Lock
16th November - Clouds yet to fill the IT skies
Module Header
Q. What topics do you want covered on this site?
 
  • addtomyyahoo4
  • Subscribe in NewsGator Online
  • Add to My AOL
  • Subscribe with Bloglines
  • Add to netvibes
  • Add to Google
Blogs > Robin Bloor
AVID Special: The Track Record; P4 on the Road to Cairo
Robin Bloor By: Robin Bloor
Published: 17th July 2006
Copyright © 2006

AVID Special: The Track Record.

AntiVirus software is truly disturbing, so this week AVID, which really stands for AntiVirus Is Dead, also stands for AntiVirus Is Disturbing. And it really is. Allow me to introduce you to some pestilent viral logic bombs (it's life Jim, but not as we know it).

First, take a bow, the Morris Worm. Well what can I say? The Morris Worm stopped 10% of computers connected to the Internet. An awesome achievement for a worm that may never be equalled again. But that was in 1998, in the days before everyone had AV software, right?

And if Helen of Troy was beautiful (Is this the face that launched a thousand ships?) then how about the gorgeous Melissa. Is she the virus that stopped a million chips at a cost of $1.5 billion. Yes she is. She was easily the most appealing female virus of 1999. She's feisty and she's pricey.

Three little words, eight little letters and everyone but everyone longs to hear it. It's “I Love You”. And we certainly got the message in the year 2000 from the I Love You virus. But, in the end, don't you know it; love hurts. I Love You certainly did. The cost was $8.75 billion.

By then we were getting the message. Right. Go down to your local software shop and get some AV. Hey that'll stop the pain.

In 2001 (A Space Odyssey), HAL, the computer, can read lips. Indeed, it is so intelligent that it recognizes bad acting and tries to prevent a wooden “actronaut” from getting back into the mothership. “I'm afraid I can't allow that Dave” etc. In the real 2001, non-Apple computers are so dumb that they let just about anything onto the motherboard. In 2001 millions of computers had visits from Sircam (cost $1.25 billion) Code Red (cost $2.75 billion) and Nimda (cost $1.5 billion).

Come on. Be fair. It takes a while for people to get the AV message. But eventually they take the pills and cure the ills. I mean what about 2002; Klez only $750 million impact, BugBear $500 million impact and Badtrands $400 million impact. What kind of dumb analyst are you that can't spot a trend?

But then came 2003; Slammer Worm—$1.5 billion impact. SoBig.F—$2.5 billion impact. This was not a bear market for viruses.

By 2004 nearly all computers at home and in businesses had AV software. We're talking 99+% penetration. I mean the AV vendors were wittering on about viruses on mobile phones. They were out hunting for new devices to fail to protect. Enter MyDoom, with the impact of a giant asteroid. $4 billion damages—none of it to mobile phones.

Yes indeed AV is disturbing, and one of its aspects that is disturbing is that with every one of these viruses there's always been some AV spokesman happily doing interviews with the press and television, getting free publicity for the AV software that failed to stop the outbreak. You know the kind of comments they make...

“Yes the AlienSexPills virus is an entirely new virus, although it bears some resemblance to MeanBastard.C virus of June 2003. If your PC gets infected, the virus takes control, trashes your data, melts your keyboard into a plastic lump and rapes your teenage daughter. If you're infected, our advice is to go to our web site where there's a detailed description of how to rectify the situation. We'll probably be able to save most of your data and our experts are working on solutions for getting your daughter's virginity back.”

So if you're a journalist reading this, then next time there's another newsworthy virus outbreak, don't call them, call me—and I'll tell you that signature-based AV software is not part of the solution but part of the problem. It is horribly flawed and should be abandoned now that there are software products from the likes of Bit9, AppSense and SecureWave that do the job as it should be done and give you complete protection against all viruses. And, dear journalist, I'll also explain why, technically, their approach is so much better.

We're not done here. Not even close. It ain't over until the fat lady stops buying AV software and sings about it.

Egyptian Safari: P4 on the Road to Cairo

Me through jails and bars. I've had it! He unsnapped the straps of the pack—it seemed to be in order. The hill slowly got closer, covering the sun, which was really low. Ah, the hell with it. Does it matter? I went. So here I am. Why?

I'm on my way to give a presentation on wireless technology at a small conference in Cairo. The title of the presentation is “Wireless in Gizah”. I am working on the presentation, sitting in Charles De Gaulle airport, mid journey, when the strange spam message above, entitled P4, arrives in my inbox from Russia. It has no link or anything to sell, so what's going on?

The strange email message seemed perfect at the time. Getting out of Austin ought to have been easy, but it wasn't. If you depart from the US to the Middle East then you are likely to get a serious search of your belongings, and if you're lucky a full body search. It's not racial profiling, it's destination profiling. What am I supposed to be doing—taking bombs and guns to the Middle East? Never mind, I can live with that.

I hadn't allowed for a stuck valve. My Houston-bound airplane had one of these and it never showed up until the plane was on the runway. It's rare. The pilot announced that in 20 years of flying he'd never experienced such a thing. He politely informed us that as he had a wife and five children, he wasn't going to take off with a stuck valve.

If he'd been a bachelor would we all be toast?

Well no. We coast back to the terminal building where an engineer gets his spanners out and takes far too long to take a look at said stuck valve. It didn't want to unstick. The pilot announces that he can either abandon the flight or fly to Houston at a lower altitude, because the stuck valve problem will only affect the air conditioning. So he's gonna fly anyway. Damn the wife and kids.

Truth is that he knows everyone on board has got a connecting flight. He would know that from looking at the passenger list, but he didn't need to—you could feel it in the air. He's gonna get lynched if he doesn't get us to Houston soon. Mr Wife-and-five-children definitely doesn't want to dangle from the jet way. But actually it's too late for almost everyone, because once you return to the terminal building there's about 20 minutes of paper work before they let you loose again, after the man with the spanner has done his inspection.

As we get into Houston, the pilot announces which connections have been missed and hides in the cabin until everyone has left the plane. Nearly all the connections have been missed. I dash across to the appropriate gate and just make it on to the Air France flight.

There's a strange ritual at the gate which I don't understand. They draw a little diagram indicating that, when I get to Charles De Gaulle, I have to go from 2C to 2E. They seem keen that I should understand this. What does this mean? How hard can it be? I find out the following morning when we arrive with red eyes. Harder than you think.

Charles De Gaulle is not a Service Oriented Airport, but it does have lots of service buses. I think they are extending it and the contract for the job is in the hands of the French Bus Driver's Union. So they've organized the whole thing in order to require a massive fleet of buses to drive passengers (crazy) from one place to another. It slows everything down wonderfully because the buses get in each others way as they cross the paths of luggage vans and buses that bring passengers to and from airplanes, buses leaving or arriving at the airport and buses driving around in circles for no reason whatever.

It took me over an hour to get from my arrival gate to my departure gate. Terminal 2 is in 6 parts, all physically connected, because it is one building, but you can only get from one part to another by bus. Makes complete sense ne c'est pas? But if you get off at the wrong stop, well it all takes even longer. And now new buildings are being built elsewhere which are satellites to Terminal 2 and these demand more buses and more bus routes. C'est magnifique, mais ce n'est pas voyage par avion. Vive la France!

Me through jails and bars. I've had it! He unsnapped the straps of the pack—it seemed to be in order. The hill slowly got closer, covering the sun, which was really low. Ah, the hell with it. Does it matter? I went. So here I am. Why?

Reader Comments

We are no longer accepting comments against this item. We suggest contacting the author directly.

21st July 2006: 'bart Simpson' said:

Robin please stop piddling on and get to the point. You tell us history we all know and give us names but no idea of why this might be better. I seem to remember reading about an alternative to signature files on this site about 2 years ago - a system that just recognised 'abnormal' activity and blocked it. I am guessing you didn't read that at the time or perhaps they weren't willing to pay the price required for the plug.

Reply to bart Simpson?

21st July 2006: 'bart Simpson' said:

Found the references on this site. Fran Howarth on 16/jul/2004 and Steve Barrie on 30/Jan/2004 both refer to the failure of signature files and the need for behaviour-based monitoring. Glad to confirm your place pushing the envelope Mr Bloor.

Reply to bart Simpson?

Advertisement



Published by: IT Analysis Communications Ltd.
T: +44 (0)203 051 5760 | F: +44 (0)870 345 9922
Email: