Malware on the Rise... China and US to Blame

Apologies, if we seem to be over-using material from IT security firm, Sophos, but they really do have the best stuff most of the time. We have no formal or monetary connections with them. We just find a gold-mine of articles and stats at their site that are updated frequently.

Sophos is also much more international in its coverage and product distribution network, so we're not faced with articles and surveys that imply that no one lives outside the US borders.

The latest Q1 2007 Sophos research on malware shows a marked increase year-over-year for that quarter... roughly 24,000 new threats in Q1 2007 vs 9,500 in the same quarter of 2006.

The good news, though, is that the levels of infected email have fallen... 1 in 256 now vs 1 in 77 a year ago.

The source of malware hosting countries hasn't changed much. China hosts 41% and its partner in crime, the US, hosts 29%. No other country in the world comes close (#3 Russia is at 4.6% and all others are lower).

You Can Run, but You Can't Hide

Like James Bond, with his license to kill, a lot of hackers feel that they are immune to the legal system if they feel that their cause is just. In the past we've commented on one just hacker who vigilante-style tracks down computers that have alleged child porn files on them.

We neither encourage nor condemn such behaviours... preferring to let the prevailing legal system decide.

Another form of "immunity" is hacking into computers in another country, on the assumption that the laws in one country won't affect someone in another country. But, then there's that magic word "extradition" that hackers are inclined to ignore. After all it takes deep pockets and significant cooperation between countries to pull that off.

All the same, Gary McKinnon, the alleged NASA Hacker, learned the hard way that the US could yank him out of his north London, England home and put him on trial on US soil.

Here's an excerpt from an article prepared my Internet security company, Sophos...

McKinnon, a self-confessed computer enthusiast from north London, was defending himself against the order in the UK Court of Appeal, after Home Secretary John Reid determined in 2006 that the extradition should go ahead. McKinnon will now be tried in the US against charges of breaking into and damaging US Government computers.

McKinnon is alleged to have hacked into computers belonging to the US Army, US Navy, US Air Force, Department of Defense and NASA. He claims that he broke into the networks only to uncover confidential information about anti-gravity propulsion systems and extraterrestrial technology which he believed the authorities were hiding from the public. He has led a high profile campaign to avoid extradition, supported by many other computer hackers.

"The US Government is taking a hard line towards cybercrime, and certainly won't tolerate anyone trying to compromise its own computers - McKinnon really should have considered this before he went UFO-hunting," said Graham Cluley, senior technology consultant at Sophos. "This decision will doubtless send shockwaves through the hacking community, but irrespective of McKinnon's motivations, computer hacking is illegal both in the UK and the US, and it's high time people started thinking twice before engaging in such activities."

McKinnon's beliefs in extraterrestrials suggests to us that therapy, not extradition is called for.

Aside from that, this is not a black-and-white issue. In 2006 Sophos polled polled over 500 IT professionals on this issue, and 52% felt that McKinnon should not be extradited. The community is clearly split on this issue. What do you think?