Author
David Harley
David Harley
Senior Research Fellow

Education? Academic background in modern languages, social sciences, and computer science. A Fellow of the BCS Institute (formerly the British Computing Society), Chartered IT Professional, Certified Information Security Systems Professional, BS7799/ISO27001 Lead Auditor.

Highlights of your career? Office administration, programming, and IT support at Royal Free Hospital, then with Human Genome Project. System administration and support, then security analyst at Imperial Cancer Research Fund (now Cancer Research UK). Wrote/co-wrote/edited a number of Internet FAQs and my first articles on programming, security etc. I presented my first conference papers in 1997 (at Virus Bulletin and SANS), and soon after inherited the Mac Virus web site, which I still run as an independent security information resource. In 2001 I joined the UK’s National Health Service, where I ran the Threat Assessment Centre until 2006, acquired qualifications in computer security, security audit, and service management (ITIL), and was the go-to person nationally for issues related to malware. Viruses Revealed, published the same year by Osborne, wasn’t my first security book (I’ve written or contributed to about a dozen) but it was the first to make a real impact and was published in 2001: that, and the AVIEN Malware Defense Guide (Syngress), to which Andrew Lee also contributed, are probably the best known of my books.

Position and history at ESET? Senior Research Fellow at ESET N. America. I’ve worked with ESET since 2006, primarily as an author and blogger, editor, conference speaker, and commentator on a wide range of security issues. Essentially, they put up with me because I’ve been around so long.

What malware do you hate the most? Malware is just code. It’s malicious people I detest. While I’ve no love of the gangs behind phishing scams and banking Trojans, fake AV, 419s, support scams and so on, I can see that it’s easier to be honest in a relatively prosperous environment, if there is such a thing anymore, and that cybercrime can be driven by an economic imperative. But I have nothing but contempt for those sociopaths who cause harm to others for no reason except that they can.

Favorite activities? The guitar (I still play semi-professionally when time allows), songwriting, recording, listening to other people’s music. I love opera but don’t attempt to sing it. Photography, art, poetry, country walking – well, ambling is about as much as I can manage at my age – good food and wine, good television when I can find it...

What is your golden rule for cyberspace? Scepticism is a survival trait: don’t assume that anything you read online is gospel truth. Even this adage.

When did you get your first computer and what kind was it? Amstrad PCW in 1986. It ran a version of CP/M and came with an integral printer, word-processing software and versions of BASIC and Logo. I moved on to an 8086 when I got my first job in IT. What else would you expect a not-very-rich author to buy in 1986? :)

Favorite computer game/activity? Extra-curricular writing (blogging, verse, articles). Artwork and digital photography.

More Info

Support scam cold-calling: the next generation

Stop me if you’ve heard this before… While I was in London recently for the InfoSec exhibition and some other meetings, my wife received a call from a lady with a heavy Indian accent, who told her that she had errors on her computer caused by viruses, and offering to remove them for her. For a fee, of course…

Job Scams: Nice Work If You Can Get It

The new ESET blog format must be striking a real chord with people. At any rate, job offers are just pouring in. Except that they don’t seem to be jobs for security bloggers, or for web developers like the team that maintains this site.

Win32/Cridex: Java pushes Cyprus into a Blackhole

Banking crisis in Cyprus is now being used in a spam campaign promoting the Blackhole exploit kit and the Win32/Cridex Trojan.

Phishbait: not so much a Smile as a rictus

Below, you can see the textual part of a bank phishing email I received today (it also contained a Smile logo, which was the only graphical content).  Here’s the message text from the phishing email:  Dear Account Holder, Do you know that with Smile Internet banking, you can eliminate the cost of receiving and transferring

Hundreds of thousands of Facebook likes can certainly be wrong

Issues with malware are always with us. There may or may not be a current media storm, or companies hoping for a slice of the anti-malware pie by proclaiming the death of antivirus in a press release, but AV labs continue to slog their way every day through tens of thousands of potentially malicious samples.

Scam conference invites: a tale of several cities

An invite to a conference in California proves to be a scam, and a very similar spam claims the very same conference is taking place in New York in March.

Who goes there? Identity and multiple authentication factors

Correct identification of an individual using a computer or service is important because it represents the accountability of the person identified. If you know my username on a computer system, you can check on what I do on that system through an audit trail, and I can therefore be held accountable for those actions. However,

Free AV and relying on the luck of the Irish

ESET Ireland’s Urban Schrott has blogged recently that “Research reveals nearly half of all Irish computers depend on free antivirus for protection”.

It’s a wonderful hoax

In a world where nothing seems to be constant but change, it’s good to know that there are, in fact, some things that change fairly slowly. Unfortunately, readiness to believe and spread hoaxes is one of them.

Mystery shopper scam: misery shopping

Money for nothing? Don’t believe it: a variation on the Mystery Shopper scam that misuses the Pinecone Research brand.

More on that Java vulnerability

  [Update 2: a note for Mac users in Turn off that Java Lamp. And Brian Krebs notes that Oracle Ships Critical Security Update for Java] [Update to a link at java.com offering more information on disabling Java in web browsers.] This is a quick pointer to blogs posted by our colleagues in Spain and in

2012 malware Top Ten and revisiting 2012′s Threatblog

Apparently we posted 235 blogs here in 2012, just a fraction under 20 blogs per month on average. So this would be a perfect moment to produce one of those summaries of the year’s activities that wordpress.com provides, telling you how many people viewed your blog site and how many times they’d go round the

Imperva, VirusTotal, and whether AV is useful

Offending the AV industry is one thing, but do you want to base a security strategy (at home or work) on a PR exercise based on a statistical misunderstanding? (Yes, I’m being diplomatic here…)

Phishing and malware – keep Smiling through…

Three current phishing gambits and email-borne malware currently getting past normally efficient email filtering.

Phishing and the Smile on the Face of the Tiger

Two rough and ready phishing emails that nevertheless tell us a great deal about the social engineering underlying more sophisticated, graphic-rich scams.

Malicious Apache Module: a clarification

Apache modules are add-on code taking advantage of the Apache module API to extend the functionality of the standard Apache distro. In this case, the binary’s functionality was malicious, but there is no exploitation of a known Apache vulnerability in this case.

A Load of (Red) Bull

A hoax/chain message claiming that a well-known energy drink poses a serious threat to health, is now spreading on Facebook.

Diamonds are forever, and so are investment scams

Tempted to invest in colour diamonds or collectible bottles of wine? That irresistible offer could be a boiler room scam.

Maryam Abacha rides again: yes, Virginia, there IS a Sani-ty Clause!*

419 (Advance Fee Fraud) scams aren’t amusing to the victim, but the chutzpah of a dictator’s wife claiming her $700m Swiss bankroll back is worth a chortle.

Spying on Tibetan sympathisers and activists: Double Dockster*

Does the expression 'In the Wild' still mean anything today? Well yes, in the sense of something that is 'out there' threatening real-world systems. But things move a lot faster these days than they did in the 90s and later, fastburning mass-mailers notwithstanding. Just a few days ago (on the 30th of November, to be

Follow Us

Automatically receive new posts via email:

Delivered by FeedBurner

ESET Virus Radar

Archives

Select month
Copyright © 2014 ESET, All Rights Reserved.