In "Sowing the Seeds for a Safer Internet," a piece for InfoWorld, Roger Grimes calls on the tech industry to work together to create a unified malware warning system:
…I think we all need a warning service built in to the backbone of the Internet. Most antimalware companies and interested parties get lists of all the rogue origination points each day, updated several times a minute. The antimalware companies know where the majority of the bad stuff is coming from far faster than the average consumer or regular business. My idea is that reported rogue information should be shared with the world, immediately, and not just posted in the circle of the few. As I said, more information is usually better.
He concludes with the million-dollar question:
All we need is a few servers and a few groups to agree on how to implement it. After 20 years of waiting for computer security solutions to actually put a dent in computer crime, we stand on the cusp of real solutions. I just wonder: What it will take to make it happen?
When StopBadware started the Badware Website Clearinghouse a few years ago, we envisioned creating a system much like Grimes describes: a shared pool of known badware URLs, updated frequently. We even took it a step further, establishing clear guidelines for badware, and building in mechanisms for transparency (you can search on our website to find out if a URL has been reported as bad, and by whom) and "due process" (our independent review process allows site owners to request manual investigation if they believe a URL is reported in error).
So, what happened? While the Clearinghouse and the work of our data providers (Google, Sunbelt Software, NSFOCUS, and soon Nominum) have been valuable in many ways, the collaborative sharing we've dreamed of has yet to come together. It turns out, companies like Google, the big AV companies, and Grimes's employer, Microsoft, are reluctant to share their data freely. Why? Lots of reasons, many of which are understandable from a business viewpoint:
-
The R&D and operations to detect malware are expensive, and it's hard to justify the investment if the data will then be given away to other industry players for free. (Essentially, this is a tragedy of the commons problem.)
-
Having better data than your competitor may translate to better protecting your customers, which can help differentiate your product/service in the market.
-
Data can be sold/licensed for revenue or shared/traded in exchange for something else of value (other data, public recognition, services that will help the organization).
-
Proprietary data can be used as a basis for academic or commercial research that elevates the researcher or serves as a PR/marketing function for the business.
Note: Google (one of our partners) is better than many companies, in that it offers a free API to query its own URL data. This is not the same as sharing the data into a common pool, but it's a step in the right direction.
Now, to the question "What will it take to make it happen?" Here's what I believe it will take:
-
A shared pool of data, fed by at least three large companies or research organizations (ideally, it would be fed by a much broader set of sources, but a few big ones are needed to start it)
-
A common set of guidelines for what does and doesn't qualify as bad
-
A shared set of protocols, APIs, etc., for feeding data in and pulling data out of the pool
-
A rapid process for updating those URLs/addresses/etc. that have demonstrably cleaned up after being identified as bad
-
A responsive and transparent process for reviewing reports of false positives and quickly removing any that are confirmed
-
A means of educating and supporting the victims whose computers or websites have been infected without their knowledge and have ended up in the "bad" pool
-
An independent, trusted entity to manage all of the above
-
Public and/or private funding to support that entity
Achieving all of this may seem like a tall order, but it's not out of reach. As Grimes pointed out, some of the technical pieces are already in place. StopBadware has implemented, or laid the groundwork for, several of the others. The biggest missing ingredient is the shared pool of data.
The question, then, is simple, if not easily answered: who is going to be the first to break down (or circumvent) the barriers to sharing data via a common pool?
