We noticed you're browsing in private or incognito mode.

To continue reading this article, please exit incognito mode or log in.

Not an Insider? Subscribe now for unlimited access to online articles.

Intelligent Machines

How to Get Everyone To Secure Computers

Botnets are a huge problem—one that can’t be solved without persuading recalcitrant owners of millions of infected private computers to take action.

If you want to get your malicious software loaded on 1,000 U.S. computers, it will cost you about $100, or a dime each, on the black market. Getting your malware on 1,000 machines in Asian countries will cost you only $5.

These infected computers—collectively known as botnets—can be used to send spam, steal passwords or other private information, and hack into corporate computer systems. Researchers estimate that five million computers around the world were infected just in the first quarter of 2012.

With infections perennially hard to stop, especially on computers with outdated software or lacking in antivirus protection, one key front in the war against botnets involves enlisting millions of average people—hapless owners of infected computers—to take action by cleaning their machines and keeping them up to date. Even if the government or industry wanted to bypass these users, it couldn’t, because in the United States, and many other places, private machines can’t be touched without a court order.

“There is a fundamental conundrum in the fact that we can identify literally millions of compromised machines that we are not in a position to do much about with regard to cleanup,” says Stefan Savage, a computer security researcher at the University of California, San Diego.

Last week, the White House and major computer and Internet companies that make up the Industry Botnet Group—a partnership formed last year—pledged to step up industry action against botnets. The new effort includes increased coöordination between industry and government, progress toward information sharing between Internet service providers and financial institutions, and a Keep a Clean Machine campaign to step up consumer education. All of this is voluntary.

There is wide acknowledgment, however, that a crucial problem is figuring out how to persuade technologically naïve and apathetic users to protect themselves. Efforts to study what sorts of warnings actually trigger productive action by computer owners is one part of that approach. And ISPs will play a key role, since they are the natural point of contact with computer users.

“Botnets today are where spam was in 2004, when we thought spam would sink the Internet, or at least e-mail,” says Michael O’Reirdan, a Comcast executive who is cochairman of an industry group that, among other anti-abuse efforts, tries to improve how ISPs notify people and help them fix their machines.

ISPs eventually took a leading role in fighting spam by hiring technical staff and creating filters to catch junk messages. But their efforts to combat botnets by notifying computer owners of infections are still primitive—“like DOS 1.0,” as O’Reirdan put it, referring to Microsoft’s original 1980s operating system.

Attempts to understand how consumers might be persuaded to take a more active role in securing their machines have followed law-enforcement agencies’ recent hijackings of major botnets. Last November, the FBI hijacked DNS Changer, a botnet that redirected people to infected websites, and arrested those involved. The FBI no longer allows the redirections, but it can still see the flows of requests coming in to DNS Changer, and therefore how many active infections are still out there—350,000 at last count.

This kind of information will help ISPs determine what kinds of alerts and messages prompt people to take action, says O’Reirdan. The ISPs can see changes at specific times and from specific geographic areas in traffic flowing to DNS Changer. “This will be the first time we’ve had a population where we’ve done some of this correlation and research,” he says. No findings are yet available.

Paradoxically, compounding the problem is that “people have been trained not to click on e-mails or pop-ups they don’t understand because it might be a phishing attack—but how else do you contact your customer? We have to start somewhere,” O’Reirdan says.

It’s also proving difficult for software companies to have an impact. Last year, Microsoft played a leading role in shutting down the command-and-control servers of another botnet, called Rustock, in a civil action. But only 58 percent of machines infected in the United States are thought to have been cleansed of the actual virus.

“All of these operations mean little if you don’t get to the victims,” says Richard Boscovich, senior attorney for Microsoft’s Digital Crimes Unit. “That’s one of the cornerstones—notifying the victims and stopping the continued victimization.”

A surprising number of people have switched off automatic updates for their operating systems and have no antivirus software installed, Boscovich adds. (Software companies cannot change things on people’s computers unless the user gives permission in advance.) Users of Microsoft operating systems can visit this site to learn how to use Windows Update; other security information is available here.

To take Rustock down, Microsoft got court orders to seize botnet-related Web addresses and servers. While efforts like this one are helpful, they do little to change the business model of botnets. And while the tools in the fight against malware have gotten a lot better, Savage says, they have not gotten good enough to change the game.

“The fact of the matter is that compromising large numbers of machines is still easy,” Savage says.

Keep up with the latest in cyber security at EmTech Digital.
Don't be left behind.

March 25-26, 2019
San Francisco, CA

Register now
More from Intelligent Machines

Artificial intelligence and robots are transforming how we work and live.

Want more award-winning journalism? Subscribe to Insider Plus.
  • Insider Plus {! insider.prices.plus !}*

    {! insider.display.menuOptionsLabel !}

    Everything included in Insider Basic, plus the digital magazine, extensive archive, ad-free web experience, and discounts to partner offerings and MIT Technology Review events.

    See details+

    Print + Digital Magazine (6 bi-monthly issues)

    Unlimited online access including all articles, multimedia, and more

    The Download newsletter with top tech stories delivered daily to your inbox

    Technology Review PDF magazine archive, including articles, images, and covers dating back to 1899

    10% Discount to MIT Technology Review events and MIT Press

    Ad-free website experience

You've read of three free articles this month. for unlimited online access. You've read of three free articles this month. for unlimited online access. This is your last free article this month. for unlimited online access. You've read all your free articles this month. for unlimited online access. You've read of three free articles this month. for more, or for unlimited online access. for two more free articles, or for unlimited online access.