Mikko Hypponen Quotations

Governmental surveillance is not about the government collecting the information you're sharing publicly and willingly; it's about collecting the information you don't think you're sharing at all, such as the online searches you do on search engines... or private emails or text messages... or the location of your mobile phone at any time.

I'm a hacker, but I'm the good kind of hackers. And I've never been a criminal.

It's going to be interesting to watch presidential elections in around 2040, when voters can dig up candidates' teenage angst pics and posts from old social media and discussion forum archives.

Everything is being run by computers. Everything is reliant on these computers working. We have become very reliant on Internet, on basic things like electricity, obviously, on computers working. And this really is something which creates completely new problems for us. We must have some way of continuing to work even if computers fail.

It's been a bit sad to see that out of Linux distributions, it was Android - the most successful mobile Linux distribution - that has really introduced the malware problem to the Linux world.

How many of the 'Fortune' 500 are hacked? 500.

Nuclear scientists lost their innocence when we used the atom bomb for the very first time. So we could argue computer scientists lost their innocence in 2009 when we started using malware as an offensive attack weapon.

It's not publicly known, but antivirus companies co-operate all the time. On the surface, antivirus vendors are direct competitors. And in fact, the competition is fierce on the sales and marketing side. But on the technical side, we're actually very friendly to each other. It seems that everyone knows everyone else.

I've spent my life defending the Net, and I do feel that if we don't fight online crime, we are running a risk of losing it all.

Today, in 2011, if you go and buy a color laser printer from any major laser printer manufacturer and print a page, that page will end up having slight yellow dots printed on every single page in a pattern which makes the page unique to you and to your printer. This is happening to us today. And nobody seems to be making a fuss about it.

In the 1980s, in the communist Eastern Germany, if you owned a typewriter, you had to register it with the government. You had to register a sample sheet of text out of the typewriter. And this was done so the government could track where text was coming from.

It's so cheap to store all data. It's cheaper to keep it than to delete it. And that means people will change their behavior because they know anything they say online can be used against them in the future.

The truth is, consumer-grade antivirus products can't protect against targeted malware created by well-resourced nation-states with bulging budgets. They can protect you against run-of-the-mill malware: banking trojans, keystroke loggers and e-mail worms. But targeted attacks like these go to great lengths to avoid antivirus products on purpose.

It's high time for a fresh European alternative to enter the market, taking the existing Internet behemoths head on. What the world needs now is a cloud storage service that is not subject to uncontrolled access by intelligence agencies.

One thing we should all understand is that we are brutally honest with search engines. You show me your search history, and I'll find something incriminating or something embarrassing there in five minutes. We are more honest with search engines than we are with our families.

The United States has an unfair advantage, as most of the popular cloud services, search engines, computer and mobile operating systems or web browsers are made by U.S. companies. When the rest of the world uses the net, they are effectively using U.S.-based services, making them a legal target for U.S. intelligence.

Stuxnet, Duqu and Flame are not normal, everyday malware, of course. All three of them were most likely developed by a Western intelligence agency as part of covert operations that weren't meant to be discovered. The fact that the malware evaded detection proves how well the attackers did their job.

Surveillance changes history. We know this through examples of corrupt presidents like Nixon.

There is a difference between the stuff that people put online themselves, like pictures and their trips and flights and meals they've eaten, than the stuff that they don't realize is also going into foreign computers. Like, for example, copies of your emails or every single online search you ever do, 'cause all that is being recorded as well.

We're risking the future of the net. People are already losing their trust. Once you get burned once - somebody steals your credit card, or makes a purchase on your account - people tend to stay away from online commerce and from trusting online services.

You can get the best locksmith in the world to design the best lock he can design, is it pick proof? No, it's not: it can be very hard to pick, but it is pickable. Because you can get, say, the next 10 best locksmiths, and give them unlimited money and time, they will figure out a way to pick it.

Defending against military-strength malware is a real challenge for the computer security industry. Furthermore, the security industry is not global. It is highly focused in just a handful of countries. The rest of the countries rely on foreign security labs to provide their everyday digital security for them.

I believe in the freedom of the net, but I don't believe in the freedom of the net at the cost of having these online criminal gangs running completely loose and using the freedom of the net to steal everybody's money and take away the trust we have.

The vast majority of the online crime cases, we don't even know which continent the attacks are coming from. And even if we are able to find online criminals, quite often there is no outcome. The local police don't act, or if they do, there's not enough evidence, or for some reason we can't take them down.

Anonymous is like an amoeba: it's got too many different operations run by truly different people which might not share a single person with another operation, but they use the same branding - they are part of the Anonymous brand, just like al-Qaida.

There is no need to have your computer online 24 hours (a day) as a target of an attack when you are sleeping or away from your computer.

U.S. intelligence has the legal right to monitor foreign communications as they go through to U.S. service providers. However, even though something is legal doesn't make it right. I'm not American; I don't really care about what data is being collected about American citizens. I'm worried about us, the foreigners.

This was not a bug; this was something that was needed at the time. It is just bad design, design from another era.

Mozilla's popularity has gone from almost zero to double digits, so they have had to deal with a lot of sudden attention. Since Mozilla has become popular, people have been looking for more vulnerabilities.

Online crime is practically always international, because they almost always cross traditional national borders.

But at least you know someone on your premises has an infected phone.

If systems administrators block these URLs at their gateways, it's not going to break anything.

Laws and regulations are supposed to restrict the kind of surveillance governments do. In fact, the U.S. government is quite restricted in what kind of surveillance they can do on U.S. citizens. The problem is that 96 percent of the planet is not U.S. citizens.

I see beauty in the future of the Internet, but I'm worried that we might not see that. I'm worried that we are running into problems because of online crime. Online crime is the one thing that might take these things away from us.

Otherwise, it's totally new code. But there's a common idea,

It all comes down to whether the code ends up being shared or not. We have not seen it out on the Internet yet.

We are seeing less of the big virus outbreaks such as Sasser and Blaster, and so some people believe the situation is getting better, when in fact it is getting worse. The bad boys are getting more professional and doing more targeted attacks.

We have listed URLs that we are recommending systems administrators block. We don't recommend blocking the whole domain, as 99 percent of the pages on these free Austrian and German domains are OK. You should just block the problem URLs.

We learned of the scanning bug in early December, but because it affected a wide range of our products, we wanted to release a fix for all (of the affected versions) at once.

We have seen dozens of different attacks using this vulnerability since Dec. 27. One exploits image files and tries to get users to click on them; another is an MSN Messenger worm that will send the worm to people on your buddy list, and we have seen several spam attacks.

There appears to be three different virus writing gangs turning out new worms at an alarming rate -- as if they would be competing who would build the biggest network of infected machines.

We've been monitoring the locations of the files that infected machines are now trying to download. So far none of them have activated.

We seem to have a botwar on our hands. There appear to be three different virus-writing gangs turning out new worms at an alarming rate, as if they would be competing who would build the biggest network of infected machines.

We seem to have a botwar on our hands. There appears to be three different virus-writing gangs turning out new worms at an alarming rate ­ as if they would be competing who would build the biggest network of infected machines.

We seem to have a botwar on our hands, ... There appears to be three different virus-writing gangs turning out new worms at an alarming rate ­ as if they would be competing who would build the biggest network of infected machines.

We seem to have a botwar on our hands, ... There appears to be three different virus-writing gangs turning out new worms at an alarming rate ­ as if they would be competing who would build the biggest network of infected machines.

We want to detect malware, regardless of its source or purpose. Politics don't even enter the discussion, nor should they. Any malware, even targeted, can get out of hand and cause 'collateral damage' to machines that aren't the intended victim.

Everything would look fairly convincing if they did some surfing to check out the site before clicking on the link. But they would still get burned.

Everybody would like to see the patch as soon as possible, but I can't blame Microsoft for wanting to test it thoroughly. However, if a widespread worm is found before next Tuesday, I do believe they will break the cycle and just release the patch.

As the virus is not new it's 2 years old this could only have happened if those testing computers were not running any anti-virus programs,

At the moment we are not aware of any attacks that would have used this vulnerability.

The worm can spread quite well once it finds its way beyond corporate firewalls.

I've worked with viruses for 15 years and things have been getting progressively worse. This year is going to be bad.

These will only get reported when people get home from work, and it will take awhile before they figure out who to call.

The situation on the Internet right now is so bad that if you go and buy a brand new computer and turn it on and plug it into the Internet, it will be infected by a worm within five to ten minutes,

The target is fooled into logging into a fake bank, where they ask for his authorization code. The fake bank logs into the real bank with the one-time password and moves money around. Then it gets back to the customer, says there has been a problem and asks him to give the next code.

Right now, the situation is bad, but it could be much worse. The potential for problems is bigger than we have ever seen. We estimate 99 percent of computers worldwide are vulnerable to this attack.

The most significant change has been the evolution of virus writing hobbyists into criminally operated gangs bent on financial gain.

Companies should make sure that their patch procedures extend to all applications, including security and backup programs.

Antivirus systems need to strike a balance between detecting all possible attacks without causing any false alarms. And while we try to improve on this all the time, there will never be a solution that is 100 percent perfect.

A large company would not want somebody entering their premises with an infected phone because they could easily infect the entire company's phones.

You should have mechanisms of communication, like faxes, which are obviously getting removed from offices because nobody uses them anymore. Faxes are great when e-mail doesn't work. I wouldn't be throwing them away.

This is enough to invoke the exploit and infect the machine.

Although the WMF bug is there (in the older versions), there's no known code at the moment to exploit it.

There was no market because there were no Mac viruses.

There might be no attack at all. As everybody knows about the attack, the virus writer may lay low and attack at a later date. The ISPs involved can actively block malicious postings. It's more likely the attacker will lay low or be blocked, rather than succeed.

It's trivial for anybody to understand how it works, ... To modify the virus is relatively easy, and to change what the e-mail says is trivial.

Foreigners like me have no privacy rights whatsoever. Yet we keep using U.S.-based services all the time, making us a legal target for gathering and storing our private information. Other countries do surveillance as well. But nobody has the global visibility that United States does.

It's surprisingly bad. In sheer amount of e-mails, it's larger than any outbreak of the year.

It's the first time I've heard of any activity coming from there.

It's more likely he'll lay low than engage in activation.

It's still climbing. It's not the worst we've seen, but the infection is sizable.

Everybody was hoping they would get the patch out before a major attack would start. Now it looks like they are succeeding in doing just that. Well done.

It took 15 years for the first moneymaking viruses to emerge for the PC. On the mobile side, I'm sure it will happen. It just hasn't happened yet.

The vulnerability probably affects more computers than any other security vulnerability, ever.

(The) vast majority of the machines infected...are home computers. Nothing will happen on them until people get home from work and boot up their machines. We'd like to think that they whole problem was avoided and everybody cleaned up their machines in time. But unfortunately, that's probably not true.

Not one of these is able to spread by itself, always the user of the phone has to accept installing of the virus.

It's really quite clever, ... It uses realistic file names and sends those to people you know. It's social engineering, just like we saw with Love Letter.

I'm glad the guy was stupid enough to get caught. If you have to write viruses, something like the type of message is not bad.

If you invest in a security product and if you have a large company, it costs you a lot. And if it works perfectly, you have no problem, which means you don't see the product at all. You pay lots of money, but you don't see any results.

If you run a Mac right now, you don't need antivirus. If you want to be safer, you should be using software that other people are not using.

This is nasty, as this is done on all mounted drives, ie. any drive that has a drive letter. So it might affect your USB thumb drives, external hard drives and network drives. Also, if you're taking daily automatic backups, you might end up backing up the corrupted files over good files.

Alternative services would mean that there would be services available to compete with Google, Facebook, Amazon, Dropbox, Skype, etc., and they would be run by companies not based in the U.S.A. The rest of the world has simply failed in being able to compete with them, and we really should be doing better here.

[Computer viruses] switch from one country to another, from one jurisdiction to another - moving around the world, using the fact that we don't have the capability to globally police operations like this. So the Internet is as if someone [had] given free plane tickets to all the online criminals of the world.

You will not even have enough time to go online and download all the patches to your computer before it is infected.

It's more than unsettling to realize there are large companies out there developing backdoors, exploits and trojans.

Privacy is implied. Privacy is not up for discussion.

The latest variants of Bozori even remove competing viruses like Zotob from the infected machines.