How is Malware like a Movie?
A couple weeks ago, a preview for a new movie by a famous actor playing himself as both the lead man and woman caught my attention. I like this actor and his movies are pretty funny, but it got me thinking…How many of these same movies have there been in the past with just a slight variation? How many people have paid to see, rent or own roughly the same movie with some alterations to make it seem new – either the actors change, the motivation for the characters change, the plot is slightly different? And, if this happens with movies then what about TV, music and books? I continued to ponder this, then it hit me that the same can be said for most of these art forms. We’ve seen countless TV shows about a group of friends living in close proximity to each other sharing life’s events, songs with the same message or similar notes and rhythms, books about spies, double crosses, wizards, vampires, but the stories all have strong commonalities.
Is this just human nature? Is the line from the television program, Futurama, true, “TV audiences don’t want anything original. They wanna see the same thing they’ve seen a thousand times before.” And does it apply to all media forms?
If it does apply, then what about software? I started to think about malware. The research of others, including Symantec, has shown that most malware is a variation of another malware. Even replicating and varying itself without human intervention. Is this just human nature at work again? Are the creators of this malware creative or is it engrained in us that slight variation is good and that the familiar is comfortable. If the writers of the malware get too creative, Stuxnet aside, they set off alarms and sensors and get caught? The people who write the toolkits and those that buy them want slight variations; if you completely change the application you might confuse the buyer and they might go somewhere else for their wares. For the writers, the time and investment in making a significant change is enormous, will they make the money back? Easier to make a slight variation and get enough buyers to spend again? How do you stop this if it is human nature? Does it take great innovation?
The answer is a resounding YES. Technology like Symantec Insight is one example of great innovation. Through testing we have seen that the reputation component of Symantec’s Norton and Endpoint Protection products has amazing success against these varied versions of malware. By analyzing these and generating protection based on many criteria including frequency of installation, Insight can capture a slight variant and prevent it from executing. This is powerful when you consider that the majority of malware is varying at a very high rate and that these threats are targeted at 50 people or less.
Insight is a major step forward in the fight against malware albeit a variation in itself of profiling. Insight’s massive database of identified software and a very large install base coupled with the other technologies within the product makes it the best defense against infection from malware. It’s a single product that provides depth-in-defense.
Maybe variation is a universal law, there is a Universal Law of Economic Variation, our children are slight variations of us, our cars are slight variations of previous models, movies and TV are variations. Maybe we can’t escape it.
Tags: endpoint security, malicious attacks, malware, Symantec
Subscribe to the comments through RSS Feed
Leave a reply