David Marcus
Dave Marcus has more than twelve years of technical experience in information security, and network and host ...
I cribbed the title from Megadeth–I admit it. However, when looking at this year’s growth in malware it seems disturbingly appropriate. Global economic downturn or not, malware production continues at a record-setting pace because this is how many cybercriminals make their money. (Malware long ago stopped being about fun and bragging.)
We at Avert Labs have seen almost as much unique malware in the first half of 2009 as we did in ALL of 2008. This is quite something when you consider that in 2008 we saw the greatest ever growth in malware:

For you math and data junkies that comes out to an average of 200,000 unique pieces monthly or more than 6,000 daily. Yep–that was over 6,000 on a daily basis. Bear in mind these are malware we consider unique (something we had to write a driver for) and does not count all the other malware we detect generically or heuristically, but we will save that discussion for another post. When you add in the generic and heuristic detections the number becomes truly mind boggling.
Even when compared to the first half of 2008, the growth is almost three times what it was. The sheer growth is even challenging Moore’s Law a bit.

Our latest whitepaper, Financial Fraud and Internet Banking: Threats and Countermeasures, explains how much of this malware can be used to scam and steal from users. The new whitepaper was written by one of our French researchers, François Paget. It can be found here.
There are many reasons why malware continues to grow, but it is mainly a criminal’s game at this point. Malware steals data. The people who write and distribute malware are criminals. Pretty plain and simple to me. The tools and code are readily available and that will certainly not change, but (and this is important) it is also definitely NOT doomsday. Staying educated and updated goes a long way toward safe computing.
mainly unique hashes (which includes as properties much of what you stated in your comment) normailizing out duplicates and so on…..
I second Matthew’s questions.
Thank you for these interesting statistics. And btw, nice also to see there are Megadeth fans out there…
I think someone should create vaccines with a “virus like mobility”, even if it means that my computer will become a battle field. Those vaccine agents may change the graphics. It would make the security programs shift from defensive-passive to a lot more aggressive and more interesting field.
I’m curious as to what your methodology is to distinguish a malware sample as unique? Are we talking a different hash of the binary, unique bot builds, unique bots?
Submit your own comments / message for this post