The Malware Arms Race as Hidden Ecological Threat

Most often, when people think of ways in which they can conserve energy with their computer, they tend to focus on finding ways to more effectively manage their power management settings (for example, by using our SURVEYOR product), or alternately, people try to figure out ways in which to make the software and hardware they use more energy-efficient.

Originally, what I was going to write about was how malware (viruses, botnets and spyware) can infect huge numbers of computers and turn them, often unbeknownst to their owners, into power-eating zombies – carrying out compute-intensive tasks, sending huge amounts of spam, and otherwise just wasting a lot of CPU cycles and thus energy. With some sources [1,2] pegging botnet sizes at an average of roughly 20,000 computers (with many examples of significantly larger botnets), the aggregate annual global energy waste generated by malware could reasonably be estimated to be in the tens of millions of kilowatt-hours or more. In reality, malware is a real and growing ecological threat and financial drain – it’s a grim scene, and one few people are talking about.

But there’s a bit more to the story than just going on the offensive and trying to put an end to malware, as many out there are nobly endeavoring to do. There’s really, effectively, an arms race going on between anti-malware software vendors and malware creators. With each innovation in anti-malware technology, malware creators find a new way to sneak in and exploit some new flaw or technique. As anti-malware technology evolves, it’s worth considering how much extra processing overhead computers and servers must now carry out in order to ensure that data being exchanged is “safe”.

While there will likely always be millions of PCs that will live out their entire natural service lives as energy-sucking zombies without a lick of malware protection, those other computers and devices that do have anti-malware software are also consuming more power than they theoretically should need to (e.g. by having to continuously scan incoming files, memory, the registry, etc.) – simply as the cost of doing business in today’s world. While anti-malware software is incredibly sophisticated, and most of the high-quality products out there are very well-implemented and as courteous and efficient as possible, this still does not take away from the fact that the malware arms race has a real cost in terms of extra energy consumption. I’m not sure how exactly one would quantify the energy cost of this arms race, but it certainly would be interesting (and depressing) to have that data in order to consider the true carbon footprint of the global malware battle.

So what do we do from here? Aside from continuing to research and implement many of the incredibly smart (and respectful and non-invasive) anti-malware solutions at higher levels than just individual clients (e.g. at the network-level), an easy thing we all can do is to simply make sure we power-down or put to sleep our computers when they’re not in use. Of course, we offer the SURVEYOR product here at Verdiem for larger organizations to help reduce power consumption, but individual users can also do their part by taking five minutes or less to ensure that their PC power management is enabled and configured to put their computer to sleep during idle times.

When an idle computer is powered off or sleeping, it has a vastly smaller surface area needlessly exposed to invading malware. Aside from the obvious energy savings of effective power management, that computer also becomes one less player in the hidden global ecological threat that is the malware arms race. That’s something I think we can all feel good about.

[1] http://www.washingtonpost.com/wp-dyn/content/article/2006/02/16/AR2006021601388.html

[2] M. Abu Rajab, J. Zarfoss, F. Monrose, and A. Terzis. My botnet is bigger than yours (maybe, better than yours): why size estimates remain challenging. In Proceedings of the first annual workshop on hot topics in botnets, March 2007.