Overview

by Ryan Russell and Tim Mullen

Here we go.

I wander down the hall to tell my wife that I ll be working all night. She tells her friend on the phone to hold on a sec.

Why? What happened? she says.

A new worm, I say.

Aw crap, not again. Is it a big one?

I don t know. I ll have to look at it first.

She tells her friend that I m going to be up all night, and that I ll probably be useless tomorrow. I hear her voice trail off as I wander back down the hall to my home office.

Whenever someone asks me what I do for a living, and I know they really don t care, I tell them computer stuff. If that s not enough for them, I clarify with computer security stuff hackers, viruses, worms . About then, their eyes glaze over, and I can stop explaining. If it s someone in my field of work, I tell them I do malicious code analysis, vulnerability analysis, IDS signatures, tool development, and computer forensics. That s enough to satisfy them. Rarely do people like me want to chitchat about what we do in general terms. We live in a world of minute detail, machine-language code, operating system calls, and compiler quirks. Most of the time, we would rather keep to ourselves and do independent study, unless we re having trouble with something specific or want someone to double-check our work.

One kind of event that tends to cause a lot of interaction...