From the floor at RSA: a good-guy rootkit

I began this week doing a radio interview with WCCO-AM radio’s Suzie Jones, a top-rated talk radio talk show host in Minneapolis. Jones expressed astonishment when I described the many ways her PC can get botted, and her personal data put to fraudulent use.

Jones– or any other average person — would have apoplexy if they could hear what’s being discussed here at San Francisco’s Moscone Convention Center. I’m here with 5,000 CTOs, CIOs and tech security company salesmen roaming around the RSA Security Conference, which we write about in Chapter 18 of ZDT. One veteran conference attendee (a female computer science PhD) just described it to me as “spring break for geeks.”

Here are a couple of quick summaries of interviews I’ve had with tech security experts on the front lines battling cyber crime:

Somesh Jha, chief scientist of Novashield and University of Wisconsin computer science professor: The bad guys are refining malicious programs faster than ever. Tools to obfuscate a particular attack by rapidly morphing it into multiple variants are “amazingly well engineered.” Traditional “signature” anti-virus programs that identify and block new strains “can’t keep up with this new stuff.”

Novashield is fine tuning a new type of defense that looks and isolates any unusual instructions from code that tries to communicate with the Windows registry as the user starts up the computer. “I call it a good-guy root kit,” Jha told me.

Novashield’s program is lightweight and designed to run on individual PCs. The company is hoping a big antivirus supplier–think Symantec, McAfee, TrendMicro—decides to bundle Novashield in with signature-based its programs.

Jha says Google banner ads are proving to be a big problem. Crooks use Google’s online services to buy banner ads to get posted on popular web sites. The ads, of course, are tainted; once they appear in your browser, you’re owned.

Sunbelt Software CEO Alex Eckelberry showed me multiple ways bad guys today are manipulating Google search results so that tainted web links slip past email spam filters. The end game is to obfuscate the corrupted web link so nothing tries to stop it from opening a back door and loading up a keystroke logger or banking Trojan (that slickly steals from online accounts) on the unlucky recipient’s hard drive.

One of the main ways crooks are infecting computers is by spreading tainted video files that carry “fake codec.” This attack began by focusing on porn video but is spreading to videos on MySpace, such as the Alicia Keys exploit.