F-Secure’s Hyppönen: big picture very hard to see

Photo: Tarmo Virki

Due to the scandals of late, people gave grown increasingly sensitive towards data shared over Internet. Thus, business blooms for companies offering computer security.

According to Mikko Hyppönen, world leading computer virus expert and technology director at Europe’s largest IT-security company F-Secure (Finland), people still fail to realise the gravity of dangers lurking in Internet.

What’s an ordinary guy’s greatest danger in Internet, right now?

The greatest likelihood is getting something downloaded into your computer, while you Google something with Windows and click on a link. That’s the most dangerous thing, something we do all the time. Top danger is not in downloading pornography or pirate pictures, even thou that breeds infections.

People often fail to grasp the dangers of Gmail or some other personal web mail account. But attackers search traces of Internet-purchases, scanning archived e-mails. Then, for instance, they click Amazon’s link «I’ve forgotten my password». The service sends a new one – to the account which is in the criminal’s hands. And then they order computers or jewellery for «gifts» so that the packages never arrive at your address.

Users fail to grasp the danger related to inboxes – «They can read my old mail, so what?» –, but the danger is much greater.

Attacks against companies are on the rise; should I worry, however, having a small business?

What increases the fastest is Trojan Horses used to attack Internet banks. That would be logical, as, thanks to IBAN, European money transfers are fast.

Nordic Trojans, for instance, direct money to Latvia or Lithuania. Should they get into my account, they’d get a few thousands; from F-Secure’s account, they would get hundreds of thousands, or millions. The more so that the disappearance of money is often detected only a month later – often, in the yearly audit.

Also, as a rule, companies’ Internet bank security is no different than that of private persons – therefore, I have developed a custom: as I visit customers, I ask then to show me the financial arm office. Company bills are always paid by a middle-aged lady. I ask to see the computer and inquire how much money goes through that machine. My final question will be: what computer do they use to Facebook and YouTube, and to surf the net – at that point, they often realise that’s not wise...

Can you help?

Sure we can, but we cannot offer total security. The attacker always has the advantage; they can download our software and, by testing, find a version of their software not caught by our antivirus. They have unlimited time on their hands; we however, have to find a solution fast.

How much do you share about yourself, over the Internet: do you use public services, share your private life? Do you use Facebook and bank in the same computer?

I will not give detailed answers, because I’m no fool I’m paranoid and I should be – that’s what they pay me for.

One must always be careful; I know people are attempting to get into my computer. Therefore, I try to always keep my private life and work life totally separate – realising, I work in a field where my opponents are criminals..

Hollywood heroes attempt to get in via home computers... Have these lonely wolves disappeared, by now?

They still come around, occasionally. In Finland, a guy recently made the headlines, breaking into hundreds of servers, without a motive. But he was an exception.

So today’s hero is Edward Snowden?

I can’t tell yet whether he’s hero of cheat.

Why?

There’s three things that bother me with Mr Snowden. Watching the video interviews, he has tremendous clarity of speech and strong comments, speaking in sentences easy to quote – looks to be top trained. But he hasn’t even finished high school.

Secondly, in January he contacted a journalist and only after that he applied for work in [consultancy] Booz Allen Hamilton, where he started in March. This is no ordinary whistleblower. As a rule, if you work someplace and cannot solve the situation from inside the organisation, then you go public. That’s not what Snowden did. What he did was unethical. Thirdly, the revelations started two days before Barack Obama was due to meet Chinese leaders on cyber attacks; pulled the rug from under Obama...

I don’t know which he is. I’d really love to believe he’s a hero, that he messed up his life to save you and me. But these three issues bother me.

What is your typical opponent, currently?

He’s at St Petersburg, Kiev, or Moscow, 25-30 of age, a professional criminal belonging to a criminal organisation limited to Internet only. 

Young skilled men from Russia, Ukraine, Latvia. Having working experience as programmers, for instance, in some small Russian city with the lower kinds of wages.

However, once they start distributing the anti-bank Trojan Horses, the whole world opens up to them. And, the risk to get caught is small as they never attack Russian banks. Therefore, the police are not highly motivated to go after them.

For years, cooperation between officials has been a top problem. Any changes for the better?

The situation is improving, but it’s still a big problem. The international police organisations, Europol and Interpol, are more like post offices; they have no operational activities of their own. 

They have been built to fight international drug-business and money laundering, where millions are moved at a time.

Now, however, €1,000 is stolen from a grandma at Tampere, the money is moved to Holland. The interest to investigate this is a lot lower; and they will not even notice that the grandma was not the only victim: these may be in the hundreds or in the thousands.

It is very hard to see the big picture. The attackers are well aware of that and make use of that.

In Europe, authorities possess ever increasing powers to place malware into people’s computers, as part of their investigations. How do you look at that?

Our task is hindering any malware from getting into computers. Our clients desire that we stop malware, no matter who made it. To detect crimes, we cooperate with the selfsame people; but, in this regard, we have told them point blank: better not tell us what you are doing, otherwise we will make use of the information.

I really do understand the authorities; even so, use of such malware must be transparent. The citizens must be aware, at least, how often it is being used, and how often criminals are caught. Without such information, we cannot judge if it’s prudent. Let’s say: if the Finnish police uses it 100 times a year, and in 90 cases the person proves innocent... that’s not a good idea.