A Theory of Malware

[MyndFyre]

I was paging through a journal tonight from the ACM and I came across this article that advocated teaching a curriculum about malware in higher education.  I was a little skeptical of this until I read the author's thought "The reason we haven't solved the problem of malware is that we don't have a theory of malware."  Then I went from being a little skeptical to thinking the author was utterly ridiculous.

A theory that could completely encapsulate malware today would be so incredibly generalized (because it would have to encapsulate innumerable systems) that it would provide no value to solving such a problem, I think.

What do you think?  Do you think we just haven't academic-ized the problem enough?

[Sidoh]

Probably not, but I think that there would be some benefit to introducing the study of malware to an academic curriculum.  I don't think we're missing a "theory" of malware, but having a better understanding of it would probably help things a bit.

[iago]

There are plenty of "theories" in security - like how to prove a system is secure. And guess what? They never work.

The problem with theories is that they tend to look at a certain set of factors. Pieces, inputs, outputs, calculations, etc. But it turns out that in security, the most dangerous problems are the ones that you don't realize exist (until it's too late). In other words, abusing the system.

A good example is threat modeling. I want a shirt that says, "I'm not in your threat model" - implying that your threat model doesn't (and can't) cover a sufficiently creative hacker.

[Chavo]

[Sidoh]

chavo, you're my hero.

[iago]

At least I spelled everything (more or less) right.

[Blaze]

At least I spelled everything (more or less) right.

I don't see any misspellings. 

[iago]

At least I spelled everything (more or less) right.

I don't see any misspellings. 

Presumably, s/thread/threat/. Unless it's a pun about shirts. In which case, Boo!

[Chavo]

or forum threads

* Chavo pretends the typo was intentional

[Sidoh]

Hah.  I didn't even notice that.

Don't worry, Chavo, you're still my hero.