A friend was spending part of his day last week cleaning up malware (adware, spyware) from a home computers, including his business computer in his home office. (Search for “spyware review” will turn up a lot of sites including this review in PC Magazine. Friday, he IMed me the following:

Remember I told you I was battling spyware and the like? Well, my debit card was denied yesterday. I checked the bank statement on-line and found an unexplained charge for over $1K from [name1 omitted]. Turns out I made a legit purchase from [name2 omitted] for $100 and some trojan program tagged along and xferred over $1K to someone else’s account at [name1 omitted]. They tagged it as suspicious and blocked further withdrawals. I talked to them and they will refund (and I hope will prosecute).

Now, this wasn’t your average spyware… or was it? It did what any spyware/adware/malware can do. It just did something illegal.

Yesterday (12Dec04), Marcus Ranum posted the following in the firewall-wizards list.

… What is the cost of enumerating viruses and malware and running antivirus software ($19/year/desktop…) versus the cost of telling the system exactly what code you want to allow to run. (Hmmm, let’s see – I could define my desktop computer’s “allow” list in 3 seconds: Eudora, Opera, Photoshop, Powerpoint, Word, and directory toolkit) The obvious answer is “default deny” rather than “default permit and block/enumerate all evil.”