Interview with Nick
FitzGerald, Emerging Threats Researcher, AVG Technologies and Impulse Gamer
working AVG, tell our readers a little about your history?
I worked in
the computer centre at the University of Canterbury, in Christchurch, New
Zealand for about ten years as a consultant. I mainly covered PC support issues
and was responsible for overseeing the Help Desk the last couple of years I was
there. During this time I became quite interested in computer virus and
antivirus issues and belonged to several online discussion groups and mailing
lists sharing information on related issues.
1997 to 1999 I
was editor of The Virus Bulletin, a UK-based journal that specializes in
computer virus and antivirus issues at a fairly technical level. Reflecting
changes in the threat landscape, it now also covers broader malicious software
(malware) and spam issues. VB also runs and publishes industry-leading antivirus
Between VB and
AVG, I worked on contract mainly for the antivirus team at Computer Associates.
What is the
best aspect of working with AVG?
I mainly work
with the LinkScanner team who are great to work with, and include some long-time
professional friends. Oh, and I get to work from home!
has the threat landscape changed?
that much, other than the sheer increase in volume of malicious sites. But
they're mainly doing "more of the same". In the slightly longer-term, over the
last year or so say, we've seen a otable up-tick in the use of social networking
sites. This reflects the obvious popularity of these sites and the bad guys'
recognition of them as increasingly valuable (and lucrative) targets.
What is the
biggest threat or "uh-oh" moment in your career working with Internet Security?
While at VB I
commissioned the first detailed analysis of the CIH virus, which initially
seemed very interesting for purely "virus geek" reasons. As a result we were
the first to recognize the full scope of its destructive payload -- it would
"fry" the victim PC's BIOS making the machine entirely unbootable (leading to
its later nickname "Chernobyl"). We finally uncovered the full effects of this
just a few days before one of the trigger dates for this payload.
the challenges in this industry?
challenge is actually effecting change. We see the results of the labour of a
lot of organized crime groups, their minions and affiliate marketing schemes.
We can generally share a lot of data about these activities with relevant local
and international law enforcement agencies and the like. Much of this activity
does not even require new law to criminalize it -- for example, fraud is pretty
much fraud regardless of whether the action takes place by real world letters
and documents, phone calls, email, instant messaging or whatever. The trouble
we commonly run into in trying to bring the culprits to account is the lack of
inter-jurisdictional co-operation between law enforcement groups, which often
stems from different policing priorities in the different jurisdictions and/or
differing evidential requirements.
If you want a
family life, the 24/7 nature of this business may be seen as a downside...
frustration of seeing the same thing over and over again. Well-informed
computer security folk are probably the heaviest users of the Santayana phrase
"Those who cannot learn from history are doomed to repeat it", but I often
wonder why Marx' "History repeats itself, first as tragedy, second as farce" is
not more widely used in these same circles.
your top ten tips for ensuring PC security for our users?
Aside from the
usual advice such as run good antivirus software and keep it updated, enable
auto-updating in your operating system to keep it patched, ditto for your
applications like Office (MS or Open), Adobe Reader, Shockwave Flash, etc, etc
I've recently been telling people to always remember the following...
Africa wants to GIVE anyone their money or gold.
Microsoft/Google/a Russian oil magnate/VW/BMW/etc certainly does not want to
GIVE anyone money/a car/etc.
Russian blonde DOES NOT want to marry you.
win a lottery you did not enter.
sounds too good to be true, IT IS.
site, Email message, IM or tweet that tells you you need to install security
software IS LYING.
because it's in a Google search result or an "ad by Google" does NOT mean it
options seem to be "Click OK/Run/Install" or "turn off the computer", TURN
OFF THE COMPUTER.
friend REALLY send you that message? In the age of Facebook, etc can you
ever really tell?
friend really as smart about computer security as you think?
B. Not at all
C. Well and truly not
D. ALL THE ABOVE
time in the industry, what are some of the worst stories that you have heard or
scammed by the Nigerian 419'ers deciding to go to Lagos to seal the deal once
and for all, getting kidnapped when they arrive and then their family face
having to pay the ransom demands. There are reports of people eventually being
murdered in these situations.
pornography, particularly child-porn, on the victim computer and this being
found, reported to employers and/or law enforcement. The PC owner/user is
subsequently fired, convicted of child-porn charges and so on, when their only
"crime" is not being particularly careful in their use of the computer.
Amero case where a substitute teacher was left in charge of a classroom with
poorly maintained and secured computers. It transpired that the PCs had spyware
or adware installed on them, spawning a stream of pornographic site pop-up ads.
Between the pornographic images being displayed and the existence of the malware
being uncovered following expert forensic examination after her initial trial,
her life was ruined and arguably she miscarried due to the stress of living
through all this.
internet ever be safe?
If all the
computers are turned off or disconnected from it, then maybe... -)
security is a process rather than an endpoint. As computer security guru Spaf
[Prof Eugene [Gene] Spafford] once said "The only truly secure system is one
that is powered off, cast in a block of concrete and sealed in a lead-lined room
with armed guards - and even then I have my doubts." [This is often misquoted
with titanium and nerve gas featuring -- see Spaf's page on this and other
notable quotes of his
The point is
that "securing your computer" is an exercise in risk management. What level of
risk are you prepared to face? How much is achieving that (or a better) level
worth to you in terms of money, time and effort, possibly reduced ease of use,
these threats generally originate from?
There are two
main sources of Internet threats at the moment. First is poorly configured and
secured web servers, often due to the use or misuse of popular but badly written
"web applications". Second is a large user-base that understands neither that
they are each system administrators, nor why it matters that they should
understand this in the first place. Both these causes are due to massive
over-selling of the notion that popular IT system components are "Internet
A third major
issue which is beyond the control of typical Internet users is that the
mechanisms that, ummmm "govern" the Internet are as laughable as they are
the government or governments stop them?
I can only
answer this with my personal opinion which almost certainly does not reflect any
official position of anyone else...
protecting mostly little-understood vested interests.
That is, the
main reasons politicians seldom get anything major right first, second or even
third time around. For now, I'm just hoping that they start working on their
your time Nick and all the best with AVG