Mikko Hypponen: Fighting viruses, defending the net

翻译人员: Jiwei Qu 校对人员: Angelia King

I love the Internet.

我爱网络

It's true.

这是真的

Think about everything it has brought us.

想想它给我们带来的一切

Think about all the services we use,

想想它给我们提供的服务

all the connectivity,

所有的互联性

all the entertainment,

娱乐性

all the business, all the commerce.

商业性，贸易性

And it's happening during our lifetimes.

这些都发生在我们的生活中

I'm pretty sure that one day

我非常肯定将来的某一天

we'll be writing history books

当我们书写从现在开始的

hundreds of years from now. This time

数百年历史的时候

our generation will be remembered

我们现在这段时期将被誉为

as the generation that got online,

网络的一代

the generation

真正的、完全的

that built something really and truly global.

全球化的一代

But yes, it's also true

但是，当然

that the Internet has problems, very serious problems,

也不可否认互联网仍然有许多问题，而且是非常严重的问题

problems with security

安全问题

and problems with privacy.

隐私问题

I've spent my career

我至今的职业生涯

fighting these problems.

都在和这些问题斗争

So let me show you something.

我给大家展示一下

This here

这

is Brain.

是个Brain

This is a floppy disk

这是个软盘

-- five and a quarter-inch floppy disk

--5.25英寸的软盘

infected by Brain.A.

被Brain A 病毒所感染

It's the first virus we ever found

这是我们至今发现的最早的

for PC computers.

个人电脑病毒

And we actually know

我们现在知道

where Brain came from.

它出自何处

We know because it says so

因为它的代码

inside the code.

告诉了我们

Let's take a look.

我们来看一下

All right.

好

That's the boot sector of an infected floppy,

这就是这个被感染软盘的引导区

and if we take a closer look inside,

如果我们仔细观察它的内部

we'll see that right there,

我们会在那里发现，

it says, "Welcome to the dungeon."

它说：“欢迎来到地牢”

And then it continues,

然后它继续提到

saying, 1986, Basit and Amjad.

1986，Basit 和 Amjad

And Basit and Amjad are first names,

Basit和Amjad是名字

Pakistani first names.

巴基斯坦人的名字

In fact, there's a phone number and an address in Pakistan.

事实上，那儿还有个巴基斯坦的电话和地址

(Laughter)

（笑声）

Now, 1986.

1986年

Now it's 2011.

现在是2011年

That's 25 years ago.

那已经是25年前的事情了

The PC virus problem is 25 years old now.

个人电脑病毒现在已经25岁了

So half a year ago,

因此一年半之前

I decided to go to Pakistan myself.

我决定自己去趟巴基斯坦

So let's see, here's a couple of photos I took while I was in Pakistan.

我们看一下，这有一些我在巴基斯坦时照的照片

This is from the city of Lahore,

这是拉合尔城的照片

which is around 300 kilometers south

它位于本·拉登被击毙的

from Abbottabad, where Bin Laden was caught.

阿伯塔巴德以南大约300公里

Here's a typical street view.

这是个当地典型的街景

And here's the street or road leading to this building,

这个是通往Allama Iqbal城 730尼扎姆街区

which is 730 Nizam block at Allama Iqbal Town.

的建筑物的街道

And I knocked on the door.

我敲了敲门

(Laughter)

（笑声）

You want to guess who opened the door?

你想知道谁开的门吗？

Basit and Amjad; they are still there.

就是Basit和Amjad, 他们还在那住着

(Laughter)

（笑声）

(Applause)

（掌声）

So here standing up is Basit.

站着的就是Basit

Sitting down is his brother Amjad.

坐着的是他的兄弟Amjad

These are the guys who wrote the first PC virus.

这就是编写了第一个个人电脑病毒的两个家伙

Now of course, we had a very interesting discussion.

在当下，我们有一个很有趣的讨论

I asked them why.

我问他们为什么

I asked them how they feel about what they started.

我问他们开始的时候是怎么想的

And I got some sort of satisfaction

同时我也得到了一些满足

from learning that both Basit and Amjad

从获悉他们两个

had had their computers infected dozens of times

的电脑这些年来也感染了很多次

by completely unrelated other viruses

完全不相关的

over these years.

其他病毒

So there is some sort of justice

因此说这个世界上毕竟还是

in the world after all.

有几分正义存在的

Now, the viruses that we used to see

如今，上世纪80-90年代之间

in the 1980s and 1990s

出现的病毒

obviously are not a problem any more.

对我们已经明显不是个问题了

So let me just show you a couple of examples

我给大家几个例子

of what they used to look like.

展示它们以前的样子

What I'm running here

我这里打开的是

is a system that enables me

一个让我可以在现代电脑上

to run age-old programs on a modern computer.

运行老程序的系统

So let me just mount some drives. Go over there.

让我来攻击几个驱动器，来到这一步

What we have here is a list of old viruses.

我们现在看到的是一个老病毒的清单

So let me just run some viruses on my computer.

让我在我的电脑上运行几个病毒

For example,

比如说

let's go with the Centipede virus first.

让我先运行一个蜈蚣病毒

And you can see at the top of the screen,

你可以看见在屏幕的上方

there's a centipede scrolling across your computer

有一个类似蜈蚣的滚轴在穿过你的屏幕

when you get infected by this one.

当你的电脑被感染的时候

You know that you're infected

你就知道你的电脑被感染了

because it actually shows up.

因为它就出现了

Here's another one. This is the virus called Crash,

这是另一个 这是一个叫做崩溃的病毒

invented in Russia in 1992.

1992年一个俄罗斯人发明的

Let me show you one which actually makes some sound.

让我给大家展示一个出声音的病毒

(Siren noise)

（警报噪声）

And the last example,

最后一个例子

guess what the Walker virus does?

猜猜Walker病毒什么样

Yes, there's a guy walking across your screen

对，就是有一个家伙走过你的屏幕

once you get infected.

当你的电脑被它感染的时候

So it used to be fairly easy to know

因此它很容易被发现

that you're infected by a virus,

你的电脑被病毒感染的时候

when the viruses were written by hobbyists

当病毒只是被爱好者以及青少年

and teenagers.

编写的时候

Today, they are no longer being written

现在，病毒的编写者已经不再是

by hobbyists and teenagers.

爱好者和青少年了

Today, viruses are a global problem.

如今，病毒已经是个全球问题

What we have here in the background

我们现在这里的背景情况是

is an example of our systems that we run in our labs,

我们在实验室运行了一个系统作为一个案例

where we track virus infections worldwide.

我们用它追踪世界范围内的病毒感染情况

So we can actually see in real time

因此我们可以进行实时关注

that we've just blocked viruses in Sweden and Taiwan

我们已经阻止了在瑞典、台湾

and Russia and elsewhere.

俄罗斯和其他任何地方的病毒

In fact, if I just connect back to our lab systems

事实上，如果我通过网络和我们实验室系统

through the Web,

进行连接

we can see in real time

我们就可以实时看到

just some kind of idea of how many viruses,

每一天会发现多少的病毒

how many new examples of malware we find every single day.

多少的恶意软件的新案例

Here's the latest virus we've found,

这是我们发现的最新的病毒

in a file called Server.exe.

在一个叫做Server.exe的文件内

And we found it right over here three seconds ago --

我们三秒前发现它在那

the previous one, six seconds ago.

之前一个，六秒之前

And if we just scroll around,

如果我们滚动一下

it's just massive.

会发现有很多

We find tens of thousands, even hundreds of thousands.

我们发现数万个，甚至数百万个

And that's the last 20 minutes of malware

那些是最近20分钟的恶意软件

every single day.

每一天都这样

So where are all these coming from then?

那么所有这些都是从哪里来的呢？

Well today, it's the organized criminal gangs

如今，它们都是有组织的犯罪团伙

writing these viruses

编写病毒程序

because they make money with their viruses.

因为他们通过病毒获利

It's gangs like --

它是个团伙--

let's go to GangstaBucks.com.

就像GangstaBucks.com网站一样

This is a website operating in Moscow

这是一个在莫斯科运行的网站

where these guys are buying infected computers.

他们这些家伙购买被感染的电脑

So if you are a virus writer

因此如果你是一个病毒编写者

and you're capable of infecting Windows computers,

并且你有感染Windows系统电脑的能力

but you don't know what to do with them,

但是你不知道怎么处理它们

you can sell those infected computers --

你可以卖掉这些被感染的电脑--

somebody else's computers -- to these guys.

其他人的电脑--卖给那些家伙

And they'll actually pay you money for those computers.

他们会付给你钱买

So how do these guys then monetize

那么这些家伙如何靠这些染上病毒的电脑

those infected computers?

赚钱的呢？

Well there's multiple different ways,

有许多不同的方法

such as banking trojans, which will steal money from your online banking accounts

比如银行木马，它可以从你的在线银行帐号中盗取你的钱

when you do online banking,

当你在线交易的时候

or keyloggers.

或者键盘记录

Keyloggers silently sit on your computer, hidden from view,

键盘记录潜伏在你的计算机中，在视图中隐藏自己

and they record everything you type.

同时它可以记录你键入的所有信息

So you're sitting on your computer and you're doing Google searches.

因此当你坐在电脑旁同时在谷歌上进行搜索时

Every single Google search you type

每一次你键入的搜索词

is saved and sent to the criminals.

都会被保存并且发送到犯罪分子那里

Every single email you write is saved and sent to the criminals.

每一封你写的邮件也会遭受同样的经历

Same thing with every single password and so on.

同样的遭遇还会发生在密码及其他资料上

But the thing that they're actually looking for most

但是他们事实上最想获取的是

are sessions where you go online

你的上网记录

and do online purchases in any online store.

以及在网店进行在线交易的过程

Because when you do purchases in online stores,

因为当你进行网上交易的时候

you will be typing in your name, the delivery address,

你会输入你的姓名，邮寄地址

your credit card number and the credit card security codes.

你的信用卡卡号以及安全码

And here's an example of a file

这里有一个案例

we found from a server a couple of weeks ago.

是我们数星期前在一个服务器上获得的

That's the credit card number,

那是信用卡卡号

that's the expiration date, that's the security code,

这是截至日期，这是安全码

and that's the name of the owner of the card.

这是持卡人姓名

Once you gain access to other people's credit card information,

一旦你获取侵入他人信用卡的信息

you can just go online and buy whatever you want

你就可以在线购买任何你想买的东西

with this information.

用所盗取的信息

And that, obviously, is a problem.

当然，很明显，这是一个问题

We now have a whole underground marketplace

我们现在存在着一整套的地下市场

and business ecosystem

以及商业模式生态系统

built around online crime.

围绕着网上犯罪所设立的

One example of how these guys

有一个例子是说这些家伙

actually are capable of monetizing their operations:

如何运作这个系统赚钱

we go and have a look at the pages of INTERPOL

我们打开看一下国际刑警组织的页面

and search for wanted persons.

然后搜索想找的人

We find guys like Bjorn Sundin, originally from Sweden,

我们找到了比约恩·松丁这个人，来自瑞典

and his partner in crime,

与他的伙伴进行了犯罪

also listed on the INTERPOL wanted pages,

同样在国际刑警组页面上列出了

Mr. Shaileshkumar Jain,

Shaileshkumar Jain

a U.S. citizen.

一名美国公民

These guys were running an operation called I.M.U.,

这些家伙在运作着一个叫做I.M.U.的组织

a cybercrime operation through which they netted millions.

是一个网络犯罪系统，净赚到数百万

They are both right now on the run.

他们现在还都在运作着

Nobody knows where they are.

没人知道他们在哪里

U.S. officials, just a couple of weeks ago,

美国官方，就在数星期前

froze a Swiss bank account

冻结了一个瑞士银行账户

belonging to Mr. Jain,

是属于Jain的

and that bank account had 14.9 million U.S. dollars on it.

账户中有1490万美元

So the amount of money online crime generates

因此说网上犯罪的金额是

is significant.

非常大的

And that means that the online criminals

这就意味着网上犯罪

can actually afford to invest into their attacks.

是可以负担的起他们进行攻击的支出

We know that online criminals

我们知道网上犯罪

are hiring programmers, hiring testing people,

要雇佣程序员，测试人员

testing their code,

测试他们的代码

having back-end systems with SQL databases.

拥有带SQL数据库的后端系统

And they can afford to watch how we work --

同时他们可以监视我们如何工作--

like how security people work --

比如安保人员工作状况--

and try to work their way around

并且尝试解决我们在他们周围

any security precautions we can build.

所部属的各种防范措施

They also use the global nature of Internet

他们还利用互联网的全球性质

to their advantage.

使他们自己有利

I mean, the Internet is international.

我的意思是，互联网是个国际性的

That's why we call it the Internet.

这也是我们为什么称它为国际互联网

And if you just go and take a look

如果你只是去看看

at what's happening in the online world,

在网络世界发生了什么

here's a video built by Clarified Networks,

这里有一个 Clarified Networks 制作的视频

which illustrates how one single malware family is able to move around the world.

说明了一个单一的恶意软件家族是如何在世界各地转移的

This operation, believed to be originally from Estonia,

这个操作系统，被认为是来自爱沙尼亚

moves around from one country to another

会从一个国家转移到另一个国家

as soon as the website is tried to shut down.

只要网站一被关闭

So you just can't shut these guys down.

但你不可能阻止住这些家伙

They will switch from one country to another,

他们会从一个国家转到另一个国家

from one jurisdiction to another --

从一种管辖权转移到另一个

moving around the world,

在全球转移

using the fact that we don't have the capability

利用一个现实，也就是说我们不可能有全球警察

to globally police operations like this.

像他们那样运作

So the Internet is as if

所以说，互联网就像

someone would have given free plane tickets

某人获得了免费机票

to all the online criminals of the world.

可以在世界各地进行网上犯罪

Now, criminals who weren't capable of reaching us before

之前，罪犯是不可能追踪到我们的

can reach us.

现在却可以了

So how do you actually go around finding online criminals?

因此 你如何找到网络犯罪分子？

How do you actually track them down?

你是如何追踪到他们的

Let me give you an example.

我来举个例子

What we have here is one exploit file.

我这里有一个有漏洞的文件

Here, I'm looking at the Hex dump of an image file,

这里，我们看一个十六进制的图像文件

which contains an exploit.

它包含了一个漏洞

And that basically means, if you're trying to view this image file on your Windows computer,

这意味着，如果你试着在你的Windows计算机上打开这个图像文件

it actually takes over your computer and runs code.

它将会接管你的计算机并且运行代码

Now, if you'll take a look at this image file --

现在，如果你看一下这个图像文件--

well there's the image header,

这是图像的开始的部分

and there the actual code of the attack starts.

这是真正开始进行攻击的代码

And that code has been encrypted,

这些代码已经被加密了

so let's decrypt it.

让我们把它们解密

It has been encrypted with XOR function 97.

它用的是XOR函数97进行的加密

You just have to believe me,

你只能相信我

it is, it is.

真是这样的

And we can go here

然后我们就来到这里

and actually start decrypting it.

然后开始解密

Well the yellow part of the code is now decrypted.

密码的黄色部分现在已经被解密了

And I know, it doesn't really look much different from the original.

我知道，它们现在看起来和一开始差不多

But just keep staring at it.

但是请继续看下去

You'll actually see that down here

你会看到下半部分

you can see a Web address:

有一个网址：

unionseek.com/d/ioo.exe

unionseek.com/d/ioo.exe

And when you view this image on your computer

当你在电脑上看这个图像的时候

it actually is going to download and run that program.

它将下载且运行这个程序

And that's a backdoor which will take over your computer.

这是个后门程序，它将接管你的电脑

But even more interestingly,

但是更有趣的是

if we continue decrypting,

如果我们继续解密

we'll find this mysterious string,

我们将发现一串奇怪的

which says O600KO78RUS.

叫做O600KO78RUS的代码

That code is there underneath the encryption

这个代码在加密文件的底部

as some sort of a signature.

就像署名一样

It's not used for anything.

它没有什么实际作用

And I was looking at that, trying to figure out what it means.

当我看到它的时候，我试图找到它的作用

So obviously I Googled for it.

于是我自然的用GOOGLE去搜索了一下

I got zero hits; wasn't there.

我什么也没发现

So I spoke with the guys at the lab.

然后我就跟实验室的其他人说了这个事情

And we have a couple of Russian guys in our labs,

我们实验室有几个俄罗斯的人

and one of them mentioned,

他们其中一个提到

well, it ends in RUS like Russia.

恩，结尾字母RUS可能代表俄罗斯

And 78 is the city code

数字78则代表城市代码

for the city of St. Petersburg.

也就是 圣彼得堡

For example, you can find it from some phone numbers

举个例子，你可以从有些电话号码中发现类似的代码

and car license plates and stuff like that.

或者是在车牌之类的东西上

So I went looking for contacts in St. Petersburg,

于是我就去找它圣彼得堡的关系

and through a long road,

经过长时间的努力

we eventually found this one particular website.

我们最终发现了一个特别的网站

Here's this Russian guy who's been operating online for a number of years

这个网站就是这个俄罗斯人运作的，他已经运作这个私人网站

who runs his own website,

很多年了

and he runs a blog under the popular Live Journal.

他在这个流行的 Journal网站下还有一个博客

And on this blog, he blogs about his life,

在博客里，他记录他的生活

about his life in St. Petersburg --

他在圣彼得堡的生活情况--

he's in his early 20s --

他20出头--

about his cat,

有关他的猫的情况

about his girlfriend.

他的女友

And he drives a very nice car.

而且他还有一辆很好的车

In fact, this guy drives

实际上，这家伙开的是

a Mercedes-Benz S600

一辆奔驰S600

V12

12缸

with a six-liter engine

6升发动机

with more than 400 horsepower.

400多马力

Now that's a nice car for a 20-something year-old kid in St. Petersburg.

对于一个在圣彼得堡20岁出头的孩子来说,这已经是一辆非常好的车了

How do I know about this car?

我是如何了解到这辆车的?

Because he blogged about the car.

因为他的微博提到过

He actually had a car accident.

他还有过一次车祸

In downtown St. Petersburg,

在圣彼得堡的市区

he actually crashed his car into another car.

他开车撞到了另一辆车

And he put blogged images about the car accident --

他把车祸的情况放到了博客上--

that's his Mercedes --

就是那辆奔驰--

right here is the Lada Samara he crashed into.

那就是他撞上的 拉达萨马拉

And you can actually see that the license plate of the Samara

你可以很清楚的看见被撞车的车牌

ends in 78RUS.

以78RUS结尾

And if you actually take a look at the scene picture,

如果你看下现场的照片

you can see that the plate of the Mercedes

你可以看见奔驰车的车牌

is O600KO78RUS.

是O600KO78RUS

Now I'm not a lawyer,

我不是一个律师

but if I would be,

但如果我是的话

this is where I would say, "I rest my case."

看到这我想我会说：“我可以结案了”

(Laughter)

（笑声）

So what happens when online criminals are caught?

那么，当网络罪犯被抓获以后又会怎么样呢？

Well in most cases it never gets this far.

大多数案例都不会获得如此详细的信息

The vast majority of the online crime cases,

绝大多数网络罪犯的情况是

we don't even know which continent the attacks are coming from.

我们甚至不知道他们从哪个大洲发动的攻击

And even if we are able to find online criminals,

即使我们有能力去找到这些网络罪犯

quite often there is no outcome.

大多数情况都不了了之

The local police don't act, or if they do, there's not enough evidence,

地方警察不会有所行动，即使他们实施抓捕，也没有充足的证据

or for some reason we can't take them down.

或者因为一些原因无法抓到罪犯

I wish it would be easier;

我希望事情能简单一些

unfortunately it isn't.

不幸的是，并非如此

But things are also changing

但事情总是在改变

at a very rapid pace.

并且速度非常可观

You've all heard about things like Stuxnet.

大家应该都已经听说过Stuxnet震网病毒 的事情了

So if you look at what Stuxnet did

如果你看看Stuxnet震网病毒 的作为

is that it infected these.

它感染了这些

That's a Siemens S7-400 PLC,

那是一台西门子S7-400 PLC

programmable logic [controller].

可编程逻辑控制器

And this is what runs our infrastructure.

它用于我们的基础设施中

This is what runs everything around us.

它用于周遭的一切东西中

PLC's, these small boxes which have no display,

它是这些小盒子，没有显示器

no keyboard,

没有键盘

which are programmed, are put in place, and they do their job.

程式化的，被放到需要的地方后便自动工作

For example, the elevators in this building

举个例子，这栋建筑的电梯

most likely are controlled by one of these.

很有可能就是被这套装置所控制

And when Stuxnet infects one of these,

因此当Stuxnet震网病毒 侵入到它们之中

that's a massive revolution

就会造成我们不得不担心的

on the kinds of risks we have to worry about.

各种风险的重大变革

Because everything around us is being run by these.

因为我们周边的一切都被这种病毒所接管

I mean, we have critical infrastructure.

我的意思是，我们有一些关键性的设施

You go to any factory, any power plant,

你去看任何一个工厂，电站

any chemical plant, any food processing plant,

化学设备，食品制造设备

you look around --

你看看周遭--

everything is being run by computers.

一切都是依靠电脑运行的

Everything is being run by computers.

一切都是依靠电脑运行的

Everything is reliant on these computers working.

一切都是依赖电脑才能工作

We have become very reliant

我们已经变得非常依赖

on Internet,

网络

on basic things like electricity, obviously,

依赖基础资源例如电力，这是很明显的

on computers working.

依赖电脑工作

And this really is something

这就是些

which creates completely new problems for us.

对我们来说全新的问题

We must have some way

我们必须找到其他的途径

of continuing to work

来继续工作

even if computers fail.

即使在电脑不能运行的情况下

(Laughter)

（笑声）

(Applause)

（掌声）

So preparedness means that we can do stuff

应此，有备无患意味着即使我们认为理所当然

even when the things we take for granted

的事情发生了意料之外的改变，我们仍然可以

aren't there.

照常工作

It's actually very basic stuff --

这其实是基本常识--

thinking about continuity, thinking about backups,

要考虑到持续性，后备方案

thinking about the things that actually matter.

以及真正至关重要的问题

Now I told you --

我把这些都告诉你们了--

(Laughter)

（笑声）

I love the Internet. I do.

我真的很爱网络

Think about all the services we have online.

想想那些我们通过网络得到的服务

Think about if they are taken away from you,

想想如果把它们从你身边拿走

if one day you don't actually have them

如果有一天因为这样或那样的原因

for some reason or another.

你真的失去了它们

I see beauty in the future of the Internet,

我看到了网络美好的未来

but I'm worried

但是我同样担心

that we might not see that.

我们可能看不到它

I'm worried that we are running into problems

我担心我们正在因为网络犯罪的原因

because of online crime.

陷入到问题之中

Online crime is the one thing

网络犯罪是一个可能把

that might take these things away from us.

这些美好的事物从我们身边夺走的原因之一

(Laughter)

（笑声）

I've spent my life

我用尽我的一生

defending the Net,

去保卫网络

and I do feel that if we don't fight online crime,

我真正的感觉到如果我们不对抗网络犯罪

we are running a risk of losing it all.

我们将走向一条失去一切的不归之路

We have to do this globally,

我们必须全球联手

and we have to do it right now.

且刻不容缓

What we need

我们需要的

is more global, international law enforcement work

是更加全球化，国际性法规强制性的

to find online criminal gangs --

抓捕网络罪犯

these organized gangs

这些有组织的

that are making millions out of their attacks.

从攻击中创造百万利润的罪犯们

That's much more important

这要比研发反病毒软件

than running anti-viruses or running firewalls.

研发防火墙要重要的多

What actually matters

真正重要的是

is actually finding the people behind these attacks,

找到在这些攻击的幕后指使者

and even more importantly,

更重要的是

we have to find the people

我们必须要找出

who are about to become

将要成为网络犯罪世界

part of this online world of crime,

其中一部分

but haven't yet done it.

但是还没有那样做的人

We have to find the people with the skills,

我们要发现有才之人

but without the opportunities

只是怀才不遇

and give them the opportunities

并且给他们机会

to use their skills for good.

让他们的才能为我们所用

Thank you very much.

非常感谢

(Applause)

（掌声）