Author
David Harley
David Harley
Senior Research Fellow

Education? Academic background in modern languages, social sciences, and computer science.

Highlights of your career? I was a late starter (1986) as an IT professional, beginning at the Royal Free Hospital, then with the Human Genome Project (1989), then at Imperial Cancer Research Fund (1991-2001), where I wrote/co-wrote/edited a number of Internet FAQs and my first articles on programming and security. I presented my first conference papers in 1997 (at Virus Bulletin and SANS). In 2001 Osborne published Viruses Revealed (co-written with Robert Slade and Urs Gattiker): VR and the later AVIEN Malware Defense Guide (Syngress) – to which Andrew Lee also contributed – are probably the best known of my books. When I rejoined the UK’s National Health Service in 2006, I ran the Threat Assessment Centre and was the go-to person nationally for malware issues. I left to work as a freelance author and consultant in 2006, which is also when I began to work with ESET.

Position and history at ESET? Senior Research Fellow at ESET N. America. Primarily, I’m an author and blogger, editor, conference speaker, and commentator on a wide range of security issues. Like the rest of the industry, they put up with me because I’ve been around so long.

What malware do you hate the most? Malware is just code. It’s malicious people I detest. While I’ve no love of scammers, I can see that it’s easier to be honest in a relatively prosperous environment – if there is such a thing anymore – and that cybercrime can be driven by an economic imperative. But I have nothing but contempt for those sociopaths who cause harm to others for no reason except that they can.

Favorite activities? The guitar (I still gig and record when time allows), other people’s music. I love opera but don’t attempt to sing it. Photography, art, poetry, country walking – well, ambling is about as much as I can manage at my age – good food and wine, good television when I can find it...

What is your golden rule for cyberspace? Scepticism is a survival trait: don’t assume that anything you read online is gospel truth, even this adage.

When did you get your first computer and what kind was it? Amstrad PCW (primarily a word-processor) in 1986. What else would you expect a not-very-rich author to buy in 1986? :)

Favorite computer game/activity? Extra-curricular writing (blogging, verse and lyrics, articles). Digital photography and miscellaneous artwork.

More Info

Privacy? Who Cares?

In the security industry, we’re sometimes over-ready to be over-prescriptive, seeing security and privacy concerns as paramount where others see them as a distraction. And we’ve become used to the mindset that computer users will always prefer convenience to security.

Scareware and Legitimate Marketing

Kurt Wismer posted a much-to-the-point blog a few days ago about the way that purveyors of scareware (fake/rogue anti-virus/security products) mimic the marketing practices of legitimate security providers. You may remember that a while ago, I commented here about a post by Rob Rosenberger that made some related points. If you’re a regular reader of

New Papers and Articles

Here are a few papers and articles that have become available in the last week or two.

Strong passwords: deja vu all over again

Since never changing your password isn’t generally a realistic option, and some sites actually prevent you from using good passwords and, even better, passphrases, we’ve produced a number of articles and papers on the topic to help make it easier to follow good practice, even when your provider seems set on preventing it. Here they are as a list, to make it easier to follow.

Email Scam Resource

On Guard Online, has a number of other useful-looking pages, though I haven’t checked them all out personally: for example, talking to children about privacy and the internet, other forms of fraud and abuse, and social networking.

Facebook ‘em, Danno*

Will I no longer be able to blog from my Netbook, or my antique iBook or Lifebook? Will I have to tear up my addressbook and insert appropriate spaces into the title page of the Handbook of Computer Security, to which I was a contributor? If I don’t do all these things, will Facebook go after my chequebook?

Cell Phone Telemarketing Hoax

You may have received an email message that looks something like this. (ESET was just asked about it – thanks to Chris Dale for passing it on.) Please note: this is, if not an out-and-out hoax, a very misleading message. Don't act upon it until you've read the rest of this article. REMEMBER: Cell Phone

DLL loading vulnerability

Scarcely had we got our breath back mainly after Microsoft addressed a serious vulnerability in handling .LNK (shortcut) files, before researcher HD Moore made public a serious security failure in the dynamic loading of libraries in Windows that came to light when he was investigating the .LNK issue.

AMTSO’s next meeting

…quite a few other issues have come up that are less obviously related to AMTSO’s aims, and it’s probably inevitable that some of those concerns will find their way out in the course of the meeting. Watch this space.

Adobe Updates

Adobe has just released an update for 20 vulnerabilities in Shockwave Player, most of which could allow an attacker to execute malicious code. The bulletin APSB10-20 – Security update available for Shockwave Player – refers. According to Jeremy Kirk's Macworld report and the Adobe advisory, the vulnerabilities affect both Windows and OS X versions up to

Anaconda, or a Monty Python sketch?

…you might wonder how a South American snake came to swallow an African mammal in the first place. (Don’t bother with the jokes about zoo viruses. I got there first.)

Support Scams On The Rise (2)

The problem with preventing such scams is that social engineering is very lo-tech in nature, requiring little in the way of technical resources and investment. Scammers are relying on the victims naivety, to grant them access to their computer and credit card details, so there’s very little a security company can do to prevent them,

Support Scams On The Rise (1)

Urban Schrott, IT Security & Cybercrime Analyst, ESET Ireland, contributed an article to ESET's July ThreatSense report about support scams. Since this is an issue that is still being under-reported, we thought it was worth reproducing, with the urbane Mr. Schrott's permission, on the blog. While we're on that topic, there's a video worth watching

Social Media: Another Survey

The survey asked just two questions:
1.Does your organization have a formal/written social media acceptable use policy?
2.What level of access does your organization allow to each of the follwoing social media sites: Twitter, Facebook, YouTube, LinkedIn, Blogs, and Other?

Support Scams Part Umpteen

UK journalist Kevin Townsend has blogged today on what sounds like two support scam phone-calls of a type I’ve mentioned here a few times since a colleague at another company drew my attention to it last month.

Quicktime,malicious movies and Angelina Jolie

…criminals are making use of the fact that Quicktime Player 7.6.6 allows movie files to trigger file downloads…the volume of reports picked up our ThreatSense.Net® telemetry suggests the likelihood of significant prevalence, though by no means an epidemic right now…

Incidents on Facebook

My Spanish colleague Josep Albors has also commented on recent Facebook security issues. Mistakes in translation and interpretation are, as always, mine. The world's largest social network is a nearly inexhaustible news source: not only because it has reached 500 million users, or because it's the subject of a forthcoming film. It is also making

Facebook Losing More Than Face

Despite all those people who honoured May 31st 2010 as Quit Facebook Day – well, 31,000 people, maybe not an enormous dent in the 500 million users Facebook recently claimed – Facebook marches on. Clearly they're doing something right. But what? It's probably not the personal charm of founder Mark Zuckerberg, who when he's not

False Positives and Apportioning Blame

All this is potentially frightening and inconvenient (or worse) for a home user. And if it happens in a corporate environment, it can be very, very expensive to remedy. So while some of the public comments we see in the wake of such incidents may seem over the top, “FP rage” is certainly understandable.

More LNK exploiting malware, by Jove!*

Pierre-Marc and I reported a few days ago that we were seeing both new malware and older families starting to incorporate the same .LNK exploit used by Win32/Stuxnet. We also predicted that “…more malware operators will start using this exploit code in order to infect host systems and increase their revenues.” Well, that was a pretty safe bet.

Follow Us

Sign up to our newsletter

The latest security news direct to your inbox

ESET Virus Radar

Archives

Select month
Copyright © 2015 ESET, All Rights Reserved.