RSA 2009: Conficker frenzy exposed media ignorance, says Schneier

Schneier: Conficker hubbub was a classic "boy who cried wolf" story

The Conficker worm was a classic example of media misunderstanding of malware, said security guru Bruce Schneier.

Calling the panic over the virus an “April fool's joke”, he said it was a classic example of how the mainstream news media misunderstood the threat from malware and used it to make news to the detriment of security.

“Conficker pushed a few good buttons,” he said.

“It appeared to come from nowhere, it had a funny-sounding name – and research shows unusual names provoke fear – and it came on a 'magic' date. But it was the classic boy who cried wolf story.”

He pointed out that for all the media frenzy, the malware didn't even update itself on April 1st. Instead it did so five days later, by which time the media had forgotten the story.

“This is why I tell people that if it's in the news then it's nothing to worry about,” he said.

“By definition news is something that happens rarely, because that's what news is.”

While the technical press were among the few to point out that there was little to fear from the Conficker worm, many media outlets speculated wildly that the worm would cause massive damage.

Schneier said that such cases may have helped vendors sell more security products but in some ways they made the situation worse, since people became inured to virus stories and this might lead them to ignore future warnings.