Alan Paller Quotations

There is a wave of people looking for infected machines. We are getting into the second wave of infections. We haven't figured what they are doing. But we are seeing a very big wave of scanning.

Of course it's the government. Governments will pay anything for control of other governments' computers. All governments will pay anything. It's so much better than tapping a phone.

Fundamentally, it's an organization that is behind in making security part of its regular operations. It's very dangerous for health care data.

If an early infectee had an e-mail list with reporters at all the major news services, that would start the cascade. News organizations do not have radical e-mail attachment limits (like a rule banning all picture attachments) because they get legitimate pictures.

It gives anyone on the Internet who comes in as a browsing user the ability to take control of your site. Instead of looking at Web pages, they can make your computer do whatever they want.

It is a situation where MCSEs had no idea that there is a fundamental vulnerability in IIS and ISAPI mapping and so had no way to protect their systems other than after-the-fact patching,

That could be a real wave of traffic that the Internet has not dealt with.

Most of them, ... appear to be just plain thieves.

Most large organizations have a big investment in Symantec tools and wouldn't normally consider switching. This year, however, Symantec's products have repeatedly shown up on the list of the software with critical new security vulnerabilities. Many corporate IT managers are angry and frustrated that their security vendor is as careless as the operating system vendors in writing bad code. And Microsoft has succeeded in persuading many of them that they are far ahead of other software vendors in improving the situation for new products.

Microsoft's delay is inexcusable. There's no excuse other than incompetence and negligence.

We have made enormous progress over the past five years by forcing the vendors to deliver automated patching. Now the bad guys are saying: 'You did that, now we're going after the applications.' Now we have to start all over again.

It would have been terrible (without the widespread patching). That got a lot of systems fixed.

The bottom line is that security has been set back nearly six years in the past 18 months. Six years ago, attackers targeted operating systems and the operating system vendors didn't do automated patching. In the intervening years, automated patching protected everyone from government to grandma. Now the attackers are targeting popular applications, and the vendors of those applications do not do automated patching.

This illustrates that even technologically savvy people have a hard time fighting off denial of service attacks.

American corporations are being riddled by (computer) attacks ? they are being defended very badly.

It wasn't just a bunch of paid consultants.

Data I have says that 20% of the Internet is vulnerable to this, and that's a huge, huge percentage of the BIND servers, ... no reason why it won't skip to other Unix versions.

It's something we call collateral damage, but I don't mean that lightly. This thing creates traffic inside a subnet, creates traffic in addition to what comes in from the outside.

Systems integrators pick and choose the parts of the FAR they pay attention to,

In the past 12 to 15 months, attackers have made a massive shift to attack applications. Automated patching started making it harder to find new vulnerable systems, so they went after applications that users are just not patching.

The mature model at CDC could offer some wonderful guidelines for long-term planning at NIPC,