SecurityCurve Weblog

More McAfee Benchmarks

I've been reading this book, recommended by a colleague, called Crimes Against Logic - it's a very readable catalog of logical flaws and nonsenical conclusions; I highly recommend the book, by the way. Anyway, I was reminded of this when I came across the recent malware numbers published by McAfee after seeing it in the press. Now, as many of you know, I am de facto critical of industry-wide research put out by AV firms - more often than not because the results are reflective of the methods they use to gather the data rather than anything having to do with the industry at large. And guess what? These are no exception.

In case you haven't read it, the research basically says that in the last two years, the same number of "threats" have been discovered in the last two years than in the previous two decades (you'll see why threats is quoted in a minute). Check out their findings:

It is alarming that we reach this milestone so soon after September 2004 when the count reached 100,000. Eighteen years to reach 100,000. Less than two years to double. Looking ahead, our researchers expect yet another doubling in a similar timeframe. So, 100,000 new threats in the past two years, 200,000 new threats to come in the next two years!

So what's wrong with this? The first problem is in how they define the word "threat"; now, they don't spell out precisely what is or is not a threat in their article. They do, however, refer to motivation by financial gain so clearly they DO mean spyware; perhaps they also mean certain types of spam. Look, Gator is spyware that may or may not collect some aggregated data about me to send back to the mothership while the casino virus deletes my hard disk; are they the same? I would argue not. But guess what? There was spyware before McAfee added the capability to scan for it. So, once again, the growth numbers are reflective of changes to the McAfee software rather than actual growth of malware. Not useful.

The second problem lies in the conclusions drawn from the results:

Another area of concern is the growth of malware targeting mobile telephony... it will grow... When the phone becomes the standard means to transfer money, malware targeting telephony will truly explode, much as bots and other means to steal money over the Internet have consumed our energies these past two years.

"When the phone is the standard means to transfer money?" Did I miss the new RAZR feature that lets you open a checking account? Look, you can't just "slip that in there" - if you are going to predicate results on a major paradigm shift, you need to give some evidence for that shift. It's like me saying, "once I've replaced my eyes with webcams, I'll be able to broadcast my life to the web" without also prognosticating some sort of advance in cybernetics.

Anyway, just my humble two cents.