August 21, 2008, 9:07 PM — Malware, like real-world epidemics, has the strange property that it does not only matter to your health how well protected you are, but also, how well average people "out there" are. The more machines that are infected, the higher is your risk of also becoming infected. But that is not all: You are at risk even if you are well protected!
Unlike real-world epidemics, malware can hurt you even ifyou are not susceptible to infection. A botnet is a good example of that. A botnet is a large collection of infected or corrupted machines that will do as they are told -- by the person who remotely controls them. The bot-herder. Botnets are used to send spam and to perform denial-of-service attacks. And it is not the owner of the corrupted machines who primarily suffer from this happening -- it is society at large.
Increasingly, researchers believe that botnets will be used to host phishing pages. The reason is simple: If a huge number of machines are used to host phishing pages, and each is referred to by a relatively small number of phishing emails, then it becomes harder for anti-phishing companies to learn the whereabouts of all the hosts to take them down. (Take-down is the term that refers to blocking access to a bad webpage, to stop people from visiting it.) Slower take-down, in turn, means that the phishing attack becomes more long-lived, and that the phisher gets away with more credentials. Thatmeans a greater risk to all potential phishing victims -- whether they have good anti-virus software or not.
Infected machines are also used to distribute malware to others. There is one commonly occurring case of this: when machines used for hosting web services are infected, then their webpages become infected, too. If you visit an "infected webpage", then what happens? You may become infected, too. You may never have been at risk if some stranger were not poorly protected.
Therefore, instead of asking how secure you are against malware, you should ask how secure is the average Internet user? We all need to fight malware, and it is not enough what you do.
For more reading, take a look at my recent book, 'Crimeware'.
