Why You Are Not “Good Enough” to Avoid Malware

Sat, May 1, 2010 by

Compiling CodeIn my line of work, most of my colleagues are very technically savvy. Sometimes I will ask them about their views on different computer security products. More often than I would expect, I receive this response: “Oh, I think that is really important, but I don’t need it because I know what I’m doing.” When I press more on what it is they are doing that makes them immune, here are some of the possible responses, and my thoughts on each.

I’m careful where I click

Hmm, thats good. How are they careful. Maybe they don’t go to any site they haven’t heard of? So googling something, and clicking that perfect result is out of bounds for this person? Never clicking any link that has been run through a URL shortener like is so common on twitter? Staying away from sites that show ads? Never going to a site which doesn’t have perfect server security? If they did all these things then they really aren’t browsing at all. ANY site can be bad.  There are just too many ways that even the most trustworthy site can be turned malicious –  I will save that for another post.

I don’t use Windows

First off, I love Windows. It is my OS of choice, but it saddens me to say that this tactic does help. But why? Because Windows sucks? Not really, it is just a matter of targeting. When a hacker writes an exploit, he wants it to work on as many people as possible. Since most of the world uses Windows, he writes his exploit for Windows. It doesn’t mean he couldn’t have written it for any other OS, and there are times when hackers do write the exploits for the other OS’s. So while using a different OS will get you by most of the malware on the web, you are still counting on luck.

I’ve never gotten a virus before…

This one is classic on so many levels. So you’ve never been infected with malware before, therefore you must be immune… Hmmm, ok, lets assume that to be true, even though a child could tell you that it’s NOT. If you never use anti-malware products, and you have never been infected by anything, that tells me that you have never been infected by a poorly-written, or relatively harmless piece of malware. Those are the ones that you would be aware of if you were infected. A relatively harmless piece of malware would have a juvenile purpose: changing your desktop wallpaper, or showing you popups for porn sites. Not so bad. If the malware were more sinister, they want to make sure you don’t know they are there. They want to steal things from you without your knowledge. But if they are poorly written, they can crash your computer or other applications. But if it’s a well-written sinister piece of malware, that’s bad. You will not know it is there just by using your computer normally. Software specifically designed to find this stuff is the only way to know if it is there. You know, like anti-virus products.

Don’t fall into the trap in thinking you are just too smart to get infected online. It is a dangerous place out there, and it’s actually getting worse. In the old days, hackers wrote malware just to mess with people. Now they make money off of it. They are smart, and persistent. Do everything that you can to protect yourself. Here is a good starting point.