magazine

STRAIGHT TALKING
from the ESET experts
Shutterstock © auremar
Fiction: Children are too open on
the Internet
Fact: It’s often the parents
By David Harley,
Senior Research Fellow, ESET
Many parents regularly post
photographs and potentially sensitive
information about their children to
social networking sites. But what are
the privacy implications when those
children become adults?
There are at least two related
problems with a digital footprint, as
compared to the non-virtual world:
(1) Physical photographs and other
documents are in some sense unique
objects. Put it on the Web/social media
and you lose control over it.
(2) The digital world may seem
transient but digital data is actually
extraordinarily persistent.
Given these issues, it is worth
considering if it’s a parent’s ethical – or
even moral – responsibility to think
about the difference between the online
and offline contexts and act accordingly.
There are clearly lines to be drawn, of
course, between digital data which can
be damaging, and that which cannot.
My own daughter’s reaction to
the publishing of photos was this:
“Ultrasounds, baby photos, etc, I think
could be considered acceptable – at the
end of the day a child is a child.
“The photos do not have the same
long-term problems as, for instance,
employers getting to see embarrassing
teenage photos, posted by parents, or,
more likely, friends.”
Fiction: Advanced persistent threats
are the most dangerous malware
Fact: Many such attacks are
simplistic – B-grade malware,
if you will
By Olivier Bilodeau,
Malware Researcher, ESET
We analyzed four targeted attack
tools and the reasons why they
shouldn’t be called ‘advanced’.
Some features we observed:
● An attacker interacts with
an infected machine.
● Bad criminals: typos in
configuration, naive
cryptographic implementation,
weak code practices.
● Sophistication variability: from
no obfuscation to hidden position
independent code, XOR encryption,
XTEA encryption, stand-alone
re-usable components.
● The malicious software uses spearphishing
campaigns – targeted
emails carry an executable
which displays the icon of a Word
document (the dropper). This
drops the main malicious binary
and then a Word document into
the user’s temporary folder.
As long as these less
sophisticated attacks are still
successful they’ll continue.
32 welivesecurity.com