What new threats do you see in 2004?
I think we’ll see even faster viruses–ones that can infect every known computer address in two or three minutes instead of 15. Also, we haven’t seen a really destructive virus in a while–the ones being created a few years ago used to do things like overwrite your entire hard drive. If Blaster or So Big had done that, it would have been a disaster. We’re also seeing some changes in where viruses come from. The U.S. is declining as a point of origin. After 9/11, I think some American virus writers either stopped or went underground, fearful of what authorities might do if they found them. On the other hand, China is one of the strongest growing sources of new viruses.
How will the rise of the wireless Internet affect security?
So far, we’ve only seen killer SMS [short message service] that can crash a phone. I can imagine scenarios in which profit-seeking hackers take control of networks of phones and use them to make calls to 900 numbers. You could also record private phone calls and play them back over the Internet on streaming audio. Or, you could turn on a phone’s recorder and use it to tape everything someone is saying, all the time.
How has the computer-virus landscape changed?
The term “virus” was coined in 1983, and the first outbreaks were around 1986, 1987. Back then, viruses were transmitted via floppy disks. They required humans to actually carry them from one computer to another. Then, in the mid-1990s, people began sending documents via e-mail attachments. We started seeing macro viruses that spread over networks, and those could spread globally within a month or so. The third stage began in 1999, with the first e-mail worms, like Love Letter, which infected 15 million computers in a day.
We’re now in the fourth stage, the era of autonomous network viruses like Slammer, which hit in January last year and infected every single public e-mail address in the world–about 4 billion addresses–within 13 minutes. These viruses don’t need humans to open their e-mail in order to spread–they can infect any computer that’s plugged into electricity, via connections like on DSL or cable modems.
Are these fast viruses also more damaging?
These viruses travel so fast, and are so good at finding holes in systems, that they can end up in some really surprising places. They don’t just affect Microsoft systems–they can affect systems that use UNIX, or closed systems. The Blaster virus resulted in breakdowns of ATMs and air-traffic-control systems. It affected nuclear power systems and electricity grids. Rail operators in America had trains stopped on their tracks. I don’t believe that the hackers that wrote Blaster were trying to do this sort of damage. But these viruses just spread so well that they end up in places you might not think they can go.
If a hacker can do all that without trying, what might a tech- savvy terrorist do?
I’m less worried about cyberterror from Al Qaeda than the sort of damage that might be caused by activists or anarchists. The sort of people who were in Genoa or Seattle, throwing bricks through the windows of McDonald’s, are not that far removed from the stereotypical hacker. I can easily imagine some smart kids working under a charismatic leader doing a lot more damage to global multinationals via the Internet. I think the motivation for groups like Al Qaeda is still primarily the fear and panic caused by killing people rather than disabling computers.
