Peter Christy

A Bad Month for the Good Guys

For years I've been railing about the lack of real joint industry progress on Spam control and saying we're "fiddling while Rome burns." I'm starting to wonder if that was an understatement. It's been an interesting month or so for security. First a San Jose (CA) hoster was shut down because of investigative reporting by the Washington Post and the result was a dramatic drop in Spam (more than 50%) apparently because this site hosted much of the payment system used by the bad guys (the infrastructure under renting a bot net for example). The good news was the unexpected magnitude of the impact; the bad news was the fact that a newspaper was the driver. Then a couple of weeks later John Markoff wrote a pessimistic piece in the NYT suggesting that economics of malware were now so robust that the bad guys were outspending the good guys (follow the money!). And then this week Microsoft went to heroic overtime after an attack was found in the wild that was used for "drive by" infection (just visit a bad site) that was able to do anything the unfortunate browser user could do (ANYTHING). Within just a couple of days Microsoft had patched the problem. Before you start dumping on Microsoft read the Secure Development Lifecycle (SDL) blog entry Michael Howard just posted. SDL is generally accepted by experts as the state-of-the-art in trying to develop secure software; Michael's entry explains why it wasn't enough in this case. Sure feels like we're fiddling while Rome burns (we never really do much to mitigate bot attacks because that requires complex industry technical and financial cooperation). This is all very scary!

Fiddling While Rome Burns (one more time)

For years I have railed about the inadequate industry cooperation when it came to the mitigation of spam (or failure to do so). I know that it's not a simple issue. The industry participants are nearly as callus or evil as the outcome might suggest. Solving the problems requires creating the right economic (carrot or stick) for the parties that have to do the work and that's not necessarily easy. For example, many ISP's have technology in house by which they could mitigate BotNet activity if informed which IP number are Bot's. But doing so would only increase the customer support costs for the ISP so they aren't motivated to do so since they already have trouble making any money. On the other hand, if we don't solve the problem the future looks very scary (the present is scary enough) as this NTY story about Russian organized crime suggests. Still feels like Fiddlin' if you ask me!

How the Spammers Can Win the War

We must be spending too much time with devious people but we had our own devious thought with respect to the spam wars. First of all remember that at most 100 spammers generate the vast majority of the spam we are plagued by and receive the majority of the revenue from spam (it's always important to remember that people spam because they can make money doing so, not just to make us miserable). The second benefactors of spam of course are the spam mitigation companies who get paid to block as much as possible (but clearly not enough to actually drive the spammers out of business). What if the spammers were to take an Intel like approach and decide to tighten the belt for a while to drive their "competition" (the mitigaters) out of business? Suppose these key spammers took a year long holiday (perhaps to a Caspian Sea resort) and during that time the volume and annoyance of spam dwindled largely out of view. How long would it take before customers demanded price reductions because spam wasn't so much of a problem anymore? How long would it take for many of the vendors to go out of business as sales suddenly dropped? And then at some point the power spammers return from holidays and crank it back up with a weakened enemy. Pretty devious huh!

Organizing the Internet Users

We visited an interesting start-up in SF -- QuantCast -- on one of our recent trips to the big city. We knew a little about QC because we're on the house list of their new PR specialist because of actions in previous lives, and they looked interesting because of the backgrounds of the principals and advisors (including some top Stanford statisticians). Grossly over simplified, while Google is going about organizing everything on the Internet, QC wants to organize all the users. Ultimately they think they can make some money by building a better ad delivery network based on their analysis. In the shorter term they are encouraging publishers to add their instrumentation to Web pages (one of them little nil pixel thingees) and then QC is processing the resulting torrent of data to build and refine models of who is visiting what and why. For now what they learn is open available on their Web site and its pretty spooky interesting. Oh and when we showed up at QC it turned out that some of our favorite infrastructure geeks were already working there. Small world we live in.

Cisco / IronPort -- A Spam Inflection Point?

I was going to write a depressed tirade for the newsletter about how little apparent industry cooperation exists against spam. Then, in the middle of my funk, Cisco announced the intention to acquire IronPort. What’s exciting about that (potentially) is Cisco’s dominance in enterprise network (they aren’t allowed to say that but I am) and IronPort’s reputation information. IronPort has exploited reputation information from the beginning and it’s my belief that it provides the most important single factor in practical spam control. What, I ask, would happen if that reputation information was all of a sudden broadly available to Cisco switch and router users? In theory that would be exciting and meaningful, although there are no shortage of reasons why it might not happen, including but not limited to: (1) the acquisition not going through, (2) Cisco really operating IronPort as an autonomous division and not aggressively commingling the technology and (3) the Cisco network guys thinking it’s a bad idea. In the past some of Cisco’s most distinguished engineers have argued eloquently (if wrong) that associating reputation with IP numbers is bad thinking. I guess I’ll just have to wait and see, and keep that depressive tirade fresh and ready to use.

Rootkits, the next Big Thing?

Do you remember the spam investment wave where any new twist on Bayesian filtering could get funded? What about the spyware wave? In both those cases the question was primarily when the big security companies could get adequate solutions to the problem, much less the need for new technology.  We're at the same place with root kits, those nasty infections where the malware clever buggers the operating system so that any detection system that uses the operating system will be fooled. Has the stock of brilliant computer science PhD's just gone up or are we only waiting for the giants to catch up with the threats?  Our rent money is on the latter, but then we're known to be old fogies and may have missed the boat again.