Wednesday, September 29, 2004

An End to Computer Viruses and Spyware?

Dru Nelson has written an essay that posits that an end to computer viruses and spyware is near. It's an interesting read. Dru believes that two fundamental changes can make this happen: 1. Hardware and OS-level integrity enforcement (e.g. page-level execute permission bits) and 2. All code that is run on a system is signed.

The execute permission stuff is interesting. For Win32, this takes advantage of the No-Execute (NX) feature of AMD64 processors. As long as the OS itself implements the page execute bits properly, this should substantially reduce code injection exploits.

I'm more skeptical of signed code. There are a number of issues:
  1. Certificate authorities are businesses. Their main interest is taking your money for generating certs. Can you really trust who is behind the certs that they issue? For example, a few years ago VeriSign issued two certificates to someone posing as a Microsoft employee.
  2. The average user doesn't understand the implications of security trust alerts (e.g. "Do you want to trust John Doe Software or not?"). And even if they did, human nature being what it is, users quickly get used to clicking "Yes". The case where they shouldn't trust signed code will be missed.
  3. If adequately trusted certs are expensive or onerous to acquire then small vendors, freeware, shareware, etc. will dry up.
  4. What do we do with all of the useful unsigned code that exists today? In many cases, it's impractical to retroactively sign the code. Disallowing unsigned code to run is likewise impractical. And once you let some untrusted code run, how do you avoid exploits?
I'm not saying that signed code is worthless. It's a very useful concept but it's no panacea. Other technologies such as sandboxed or "managed" code will help eliminate exploits as well. In the meantime, use a firewall, keep virus definitions up-to-date, scan for viruses and run malware checkers frequently. That's the price we pay for our "always connected" world.
posted by Bob at 9/29/2004 04:30:00 AM  | | digg | del.icio.us | reddit