News has broken that hackers are using passages from literary classics, in particular Jane Austen, to fool antivirus software. Amichai Shulman, CTO of Imperva and David Harley, Senior Research Fellow at IT Security Firm ESET commented on the Jane Austen Spreads Malware.
Amichai Shulman, CTO of Imperva :
“This is emphasizing what we have been saying again and again for the past few years: it is virtually impossible to tell “malicious code” from “code” and thus any security solution that relies on attempting to make this observation is doomed to fail. While anti-malware solution are improving, they are bound to stay behind attack methods (and not necessarily the most advanced ones). The focus and effort should be shifted into detecting the attack, and the attack is almost always targeted at enterprise data. You don’t get 145M user account details, 70M credit card numbers or 300K medical records from an endpoint. You get these by ABUSIVE access to enterprise databases and files servers – that is where the focus of advanced security solutions should be.”
David Harley, Senior Research Fellow at IT Security Firm ESET :
“This is not a new phenomenon. Spammers have used extracted text from all sorts of sources rather than purely random text for many years. Though, I have noticed a recent uptick in comment spam that uses bulk text that is sometimes a ‘pure’ extract and sometimes coherent but unconnected sentences.
In general, I wouldn’t expect the coherence or otherwise of text to be the primary factor in a security product’s assessment of a page as malicious, though it might be used as one heuristic among many.”[su_box title=”About Imperva” style=”noise” box_color=”#336588″]
