INTERVIEW: Vincent Weafer, Symantec's chief virus hunter
The Net is now the weakest link
In 1998, when Vincent Weafer became director of Symantec Corp.'s AntiVirus Research Center, about 200 pieces of suspicious code arrived that year for examination.
In March of this year the center received more than 50,000 submissions of malicious code. Its Web site, at www.symantec.com/avcenter, ranks security risks from viruses, provides advisories and updates, and exposes hoaxes.
The rapidly growing threat from viruses, worms and Trojan horses, however, is no hoax. The center evaluates the seriousness of malicious code and helps develop responses for the Cupertino, Calif., company's Norton AntiVirus products.
Weafer, a native of Ireland, joined Symantec in 1994 and helped develop Japanese versions of Norton Desktop and Norton Utilities at the company's Dublin localization group. He also managed the international product engineering and development teams.
Weafer holds a bachelor's degree in electronic engineering from Dublin City University in Ireland. He received an international managerial and technical scholarship to Japan, where he lived from 1984 to 1986.
GCN senior editor William Jackson spoke with Weafer by telephone about the center's work.GCN: How does the Antivirus Research Center collect its examples of malicious code?WEAFER:
We have people around the world who gather virus samples from customers and other researchers, analyze them and look for trends.
We do two types of research. Proactive research examines new vulnerabilities on new platforms. For example, viruses on handheld computers are not a real threat now, although we do have a couple, but over time we know that wireless devices will be a vector for viruses.
Then there is a reactive response to the Code Reds and the Sircams. In the middle of a virus infection you need to get information out rapidly.GCN: How long before wireless devices become significant vectors?WEAFER:
Probably a couple of years, for the technology inside them to get a little more complex. Right now most personal digital assistants are fairly simple. If you have a Trojan in memory, it has open access to the memory in devices you connect to. But it doesn't have the richness of a PC, and it's not quite as connective.GCN: How do you differentiate a virus, a worm and a Trojan horse?WEAFER:
A virus is a piece of malicious code that lives inside a host body. It infects one document and then another on the same machine, or one executable file and another.
A worm typically doesn't need to live inside a host and will spread from system to system. The mass-mailer models we see now are more like worms than viruses. They can
e-mail themselves from machine to machine.
The Trojan horse is exactly like the original Trojan horse'a program designed to look like something while doing something else. A good example would be Happy1999. It appeared as a fireworks display on screen, and in background it was trashing the hard drive.
Another thing we deal with is back-door programs. Back Orifice and SubSeven are probably the most common at the moment. They're Trojan because they come in as friendly executables. Once on the system, they open up holes or ports so that other machines can connect.GCN: How do you gauge the severity of a threat?WEAFER:
We look at the potential for distribution'for example, whether it's a mass mailer that will successfully replicate on all Microsoft Outlook platforms.
We also look at how much of the infection is out there based on scans and third-party accounts. Lastly there is the potential for data destruction, data modification and export.
We put those numbers together and look at how much protection is out there. For most viruses, the safeguard will be zero for the moment. We see about seven viruses a day. Most never have a major impact.GCN: Are the high-profile ones more of a threat than before?WEAFER:
The big difference is speed of attack. In the 1980s and early 1990s we could track virus infections over a matter of months. Now we're looking at global infections literally in hours or minutes. That means you don't have the same time to put up defenses, update your definitions and change your firewall rules.
The good news is, awareness has come up as we've become more connected. People have firewalls, gateway scanners, multitier protection. But users are taking laptops home and bringing them back potentially infected.GCN: Is broadband changing the nature of risks?WEAFER:
Now consumers have got fairly significant pipes to the Internet, they're becoming the weakest link. We saw in May and June a worm that replicated by spreading to systems already compromised by SubSeven. Most were broadband systems with little or no firewall or antivirus protection. So to protect the enterprise space, it is very important to reach out to consumers and make sure they are equally aware and have tools to protect themselves.
People with high-end machines, fairly homogeneous in applications and operating systems and lax in security, are being targeted to spread worms or create zombies, which can serve as launching pads to attack government entities with stronger security.GCN: How does the government rate in protecting itself?WEAFER:
It depends on which segment you're talking about. The military have always been very aware. We've done a lot of work with them.
Looking broadly at governments around the world, they generally have been behind on the IT curve. I think colleges can help by making security a part of computer science courses.GCN: Is there any useful profile of who is creating and releasing malicious code?WEAFER:
The virus writer used to be a male, 14 to 23 years old. Today it is a far more diverse group. We've got females actively involved, and motivation is varied, from people looking for publicity to people who want to be the first to write a virus for a new operating system or application. There are insiders who have fairly deep technical knowledge. And of course there are people doing it for profit, to steal information.GCN: How big a problem is so-called hacktivism, or social and political activism?WEAFER:
Hacktivism has been associated with defacing Web sites. An example is Code Red 1, where part of the payload was defacing a site. Why stand out on the street with a placard if you can send a virus that will get a lot of attention?GCN: What are the latest trends in malicious code?WEAFER:
We're seeing more data export, and that gets into loss of confidentiality and privacy and into liability.
Sircam affected documents that ranged from password files to financial files to personal records. When people think about security, they think about systems being recoverable. Lost confidentiality is something people consider far more serious.
A second trend relates to blending of attacks. Code Red was basically a buffer-overflow exploit, something always associated with hackers. They have now automated that by putting it into a worm that can replicate itself. The trend of using worms and viruses to carry and launch payloads is something we're going to see over and over.GCN: Are software developers doing enough to provide safe products?WEAFER:
In general, yes. They are far more aware than they have ever been, but we've seen time and again that people will sacrifice security for functionality, even when security was built into the products. One example is Microsoft [Windows] pop-up warnings about macros in documents, asking people if they are sure they want to run the macros. And most people say, 'Sure, I'm afraid I might miss something.'GCN: Some hackers maintain that the only way to ensure vulnerabilities are fixed is to publicize and even develop exploits for them. Do you see any merit in that view?WEAFER:
Yes, I do. The white-hat hacker fulfills a real need, which is the disclosure of information that will lead to a security patch'but within reason. We have seen examples where people have publicized vulnerabilities without giving the vendor any reaction time, and that makes the end user the victim.