The Internet is Sick... But We Can Make it Better

Remedy 1: Create Diversity on Your Desktop

Make software and operating systems that evolve when attacked, so the same trick doesn´t work on so many computers

In June 2004, Internet-security researchers discovered a vulnerability in Internet Explorer 6 that could let attackers take over your computer when you visited an infected Web site. The attack exploited a flaw in how IE 6 managed security, fooling the browser into thinking that malicious code was running in a so-called â€trusted zone†on your local machine instead of on the Internet. Once a machine was infected, the attackers could do anything they pleased-erase files, install a key-logger to steal bank-account information, or turn the computer into a zombie. The problem was so bad that the U.S. Computer Emergency Readiness Team, a division of the Department of Homeland Security, advised Web surfers to stop using IE until Microsoft issued a patch, which it did in August of that year. The worst part? Because every single copy of IE 6 contained the same flaw, the attackers had tens of millions of potential targets.

â€The reason the human race is so robust is that there´s diversity in the gene pool,†Khosla says. â€The problem with [software] is that every version has the same damned bugs.†Researchers at CyLab are studying how plants and animals evolve in response to disease, hoping to emulate those processes by building software that adapts when attacked. If some copies of Explorer â€evolved†to resist the attack, hackers would soon give up and go looking for easier targets. Taking the idea one step further, CyLab imagines creating programs or entire operating systems that would randomly change the way they functioned as they operated or that would execute instructions in a different order every time. For example, each copy of IE might use a slightly different method of determining security zones.

The difficulty lies in replicating enough of the code so that every application does the same thing, without replicating its vulnerabilities, says CyLab´s technical director, Mike Reiter, who thinks we might begin to see programs like this in three to five years. â€Why do we have epidemics?†Khosla says. â€Not because there are germs out there. It´s because we can´t control their propagation. You can´t stop the dissemination of viruses and worms, but you can reduce their speed of propagation.â€