InfoWorld - Security Adviser: Fighting malware: An interview with Paul Ferguson

Paul Ferguson has been fighting malware since the days of the earliest attacks. In this InfoWorld interview, Roger Grimes talks with his longtime colleague about the state of current threats and what they future of malware may hold

By Roger A. Grimes
January 23, 2009

I first started fighting computer malware back in 1987. Back then, it was a lot easier. We didn't have the Internet (in widespread use). Viruses and Trojans were limited to an even dozen on the PC DOS platform, with four times that on the Mac and other nubile personal computer platforms. I read Ross Greenberg's book on Flushot over and over and talked to many anti-virus leaders and coders, including John McAfee, on a fairly regular basis. We even had an early version of the Internet using BBSes (bulletin board systems) and store-and-forward e-mail lists on the FIDONet. We couldn't believe how our e-mails went around the world -- in less than a day! It was pretty heady stuff.

I learned assembly language from Peter Norton's programming guides to learn how to disassemble viruses, which were sent to me to analyze and write up. I was 19, sopping up knowledge like a new sponge, and looking for a place where I could learn more. That place ended being the PC Antivirus Research Foundation. One of its leaders, Paul Ferguson, seemed piped into an inside channel. He never seemed to sleep -- the type of guy who always responded to a 3 a.m. e-mail so fast that you knew he was awake, too. He got the viruses from around the world first and assigned nightly disassembly duties. We worked together for many years until the rush of viruses (now coming in at dozens per week instead of one or two a day) overwhelmed our serious hobby. But I never forgot how he took me under his wing and challenged me to do better. A decade later, I dedicated one of my first books on computer security to him.

Imagine my surprise when I ran into him on a private anti-malware mailing list this year. The other members rallied to defeat my nomination for group membership because I was a journalist and the group's discussions should never be discussed publicly. Paul Ferguson vouched for me. Since then, I've been privy to a very active group of anti-malware fighters, made up of law enforcement, ISPs, researchers, and anti-malware companies. When something malicious is pushed to the Internet, the reports, samples, and full details are available within the hour. I've found my FIDONet again. Paul has been a fixture in the malware the whole time, and I decided to conduct a short interview.

Click the URL above to read the full article