The problem of spotting scams

Ed Bott writes an interesting article on the subject of Why do people fall for trojans? As he explains, one of the problems is that the steps that one must go through to make even a legitimate purchase can often resemble the experience of a scam, including false alarms such as Windows warning us that our legitimately purchased item "might harm your computer".

This is also one reason why I think schemes such as the "verified by Visa" scheme for credit card purchases, in addition to being senselessly irritating, are actually a bad security measure because they imitate during a legitimate procedure precisely a process that an attacked might exploit or which might be the warning sign of an attack. Or in other words, in both this case and the scarey dialogs that can appear in Windows while you are downloading and installing a legitimate program, we are actually risking that what should be warning signs actually become ignored due to being "dulled by familiarity".

What is the mysterious PIFTS.EXE?

Update 10/03/09 11:50am Luckily, it does appear that PIFTS.EXE is just a storm in a teacup. Symantec still appear to be saying about as much as the Queen did after Diana died.

So after a mysterious PIFTS.EXE program hits the Kaspersky firewall asking to connect out from one of our machines, I hit the Internet to find that nobody knows, but the world is wondering. According to Google Trends, it has been hovering between the 15th and 25th most frequent search for the last couple of hours. Various theories about PIFTS.EXE appear to be emerging: was it some component of Norton Antivirus that went wrong? Is it some mad terrorist plot to wipe the Internet off the face of the earth and thus prevent people from finding out about why Lil' Kim went to jail?

Update 10/03/09 Reading things so far, and just possibly maybe having had a quick look at a disassembly of the exe in IDAPro, the consensus seems to be that the file is essentially harmless, but was an attempt by Symantec to gather some statistics from users' machines about installed antivirus components. A user posting to Reddit also suggests that a code review of PIFTS.EXE does not reveal anything too nafarious, and that automated code analysers such as ThreatExpert don't pull anything up either (then again, a "well written" virus wouldn't do, would it?).

Sometimes in cases like this, it's not so much whether there is anything wrong but whether there appears to be. Pulling down all forum posts about the file when there is clear user anxiety without then making an official statement doesn't making it look as though everything's hunky-dory...