Ken Dunham Quotations

There are plenty of ways to get around all of those things.

We did reverse engineering on the variants, and found this date in the code. The way this works is that at a pre-determined time, computers already infected with Sober will connect with specified servers and download a new payload, which will likely be spammed out in the millions, as was the last version.

The reality is that there could have been hundreds of thousands of computers with overwritten files today. Instead, we only have a handful of reports, and that is a hands-down victory for the collaborative effort of the security community.

If someone starts capitalizing on the crossover worm, and we start to see increased activity, then we can talk about a global threat. It's a little premature at this time.

Historically, risk is much higher with Windows operating systems than Unix/Linux. How can I say that, look at all the major attacks. Which ones had the greatest likelihood and impact for 2005? Windows hands down.

It actually appears to be a pretty good design.

It is already underway and will be activated unless people get removal tools. If you have opened an e-mail and your computer froze up, you should be very concerned.

Pay for one commercial package and add one or more free programs. Set the primary package to scan all the time and use the second ary programs only when you need them, so they don't conflict. It's like getting a second opinion from a doctor.

We don't know if it's fraud-related or whatever. Clearly, they're being silently and illegally installed, at a minimum, for personal profit and they may also involve fraud or exploitation. I think the next week is going be the most telling and the most significant in terms of risk.

WMF exploitation has taken off in the past twelve hours. It's likely that WMF exploitation will be very successful in the near term.

There's no way for you to know whether a site is dangerous for a WMF exploit.

The threat level for this vulnerability may be dramatically increased if more automated methods of distribution are found to be successful, such as e-mail or IM or file shares. The impact of attacks may also increase, with more sinister codes being installed as new hackers attempt to leverage the vulnerability to their advantage.

Anti-virus companies when they get a sample need to act on that quickly. They don't have time in their competitive environment to be able to go out and coordinate and have a nice little talk about naming.

A new, upgraded WMF exploit was posted to the public today and is highly functional.

You should boot from a clean disk before removing a virus. Some viruses can't be cleaned any other way.

This is a social engineering worm written in Russian. It is interesting when you look at it. This is a Java-based type of threat and it has been proven to be successful. We need to look at this and see what is going to be the threat down the road.

This is not something I would expect to yield very high profits for criminals as compared to other types of financial fraud and extortion that might take place. Many people have backups of their files, and now the code has been cracked.

This is one of those big, under-the-radar threats that we've been concerned about. There has been a trend away from big-bang attacks to very targeted and sophisticated attacks that take place right under your nose. This is one of them.

This could serve as a springboard for more attacks on the Macintosh because it might spawn copycats.

This increases the likelihood of exploitation, but widespread exploitation has not been identified to date.

They're bloodsucking mosquitoes. You just can't get them all.

It's all about hiding it so you can maintain extended control over a computer because then you can profile it and steal more. In today's world, with identity theft running rampant, they need more than just your credit card. They need to get your date of birth and your social to get maximum profit on your computer. So it's about remaining stealthy.

It shows increased activity and viability for future Macintosh-based threats on the Mac OS X platform.

It's primarily a media term. It's something people are going to read about.

Then, we thought maybe the police had gotten inside the group that made Sober and might be close to an arrest. But now it's likely that they found a date coded inside an earlier version of the worm.

It's such a small population. Other assets are available to attack.

The attack, if it comes, could come anytime after the afternoon and the evening of the 5th.

Slowly evolving threats like Grew.A often lead to increased fear, uncertainty and doubt without the help of an intelligence provider. It makes it almost impossible for some to get qualified research data on a worm when there is so much misinformation, aliases, and other data available on the Internet.

In August, 2004, we predicted we'd see exponential growth, and that's exactly what we saw.