Forgot your password?
typodupeerror
Security Microsoft The Almighty Buck Your Rights Online

Microsoft Offers A Bounty On Virus Writers 719

Posted by timothy
from the must-bring-left-ears dept.
Iphtashu Fitz writes "According to news.com Microsoft will announce a bounty of $250,000 on Wednesday for information on who wrote two recent Windows viruses. The bounty is offered for information that leads to the arrest of the people who released the MSBlast worm and the SoBig virus. Microsoft will officially announce the reward in a joint press conference with the FBI and U.S. Secret Service Wednesday morning. This is the first time a company has offered money for information about the identity of the cybercriminals. Could this be the start of a new trend in going after the writers of viruses & worms?"
This discussion has been archived. No new comments can be posted.

Microsoft Offers A Bounty On Virus Writers

Comments Filter:
  • by svvampy (576225) on Wednesday November 05, 2003 @08:00AM (#7394917)
    But this is ridiculous!
    • by studpuppy (624228) on Wednesday November 05, 2003 @08:18AM (#7395041)
      So.. like, is the 250K a signing bonus? Or do they get it in stock options? Of course, the real question is... is it cheaper for MS to pay 250K to jail each person that writes a virus exploiting on of their security holes than it is to pay the developers to avoid creating them in the first place?
      • by kfg (145172) on Wednesday November 05, 2003 @08:45AM (#7395200)
        I think they're going to pay it in used computers valued as new and Windows seat licenses.

        If you want actual CDs you'll have pay retail though.

        KFG

    • I think that is why I find it strangely appealing. Envision the typical biker dude bounty hunter storming some high school kid's room. Does C*O*P*S do the occasional bounty hunter episode: "Bad Nerd, Bad Nerd, whacha gonna do?"

      But only if Gates presents the check personally.
  • Well I find him...Untouchable!
  • by the uNF cola (657200) on Wednesday November 05, 2003 @08:01AM (#7394925)
    It's not that hard to deploy a virus and not get caught. There are so many open access points and people who forget to log off of an email account after leaving.. how would you track it?
    • by Anonymous Coward
      Temptation of $250k might make friends turn on friends - no tracking necessary.

      I wonder if the writers could turn themselves in and still get the reward :)
    • 1) Not getting caught is easy assuming whoever wrote the virus expected such a wide response and therefore took precautions to guard his identity. If he didn't and started bragging to all his friends, who then told their friends...

      2) I wonder if Microsoft are expecting this move to deter people from writing viruses. Maybe someone thought: that virus cost us a lot more than 1/4 million, let's spend that money and set an example even if the guy doesn't get caught.

      3) This is going to spark a new underground
    • Even funny will be when somebody who did not write the virus sets himself up so that he gets some money. $250,000 is a lot of money in many countries.
    • by tanveer1979 (530624) on Wednesday November 05, 2003 @08:38AM (#7395154) Homepage Journal
      Hmm not really. Given enough resources and motivation, it is not that daunting a task. With internet being taken into control everywhere and watchdogs sitting, it may not be that difficult.

      Ever read the book, "The Silicon Samurai", the cracker in that book was very clever, a master of the art. Still he got caught. Why? Because crackers, virus writers, DDoS organisers have one thing in common. They want fame. They cant sit without leaving clues. History teaches us that the greatest thieves and criminal got caught due to their hunger for fame. This will happen here also. Though i am not to sure if that is a very good thing, coz when such showdowns happen a lot of innocent people suffer.

      • by asn (4418) on Wednesday November 05, 2003 @08:54AM (#7395246) Homepage
        History teaches us that the greatest thieves and criminal got caught due to their hunger for fame.

        History has taught us nothing about the greatest thieves and criminals -- they have never been caught!

      • Your analogy is flawed, since these particular virus/worm writers aren't doing it to "leave a mark on the world", they aren't gloating about what they've done ... they're *using* those infections as part of their *business*. Witness the latest worm's DDoS assault on SpamHaus.

        These writers won't get caught because they can't help but leave signposts, but they *may* get caught if someone in their dirty end of the world rats them out. I mean, after all, they've obviously built up this tool (a private, massi
    • New senario ... (Score:3, Insightful)

      by Zemran (3101)
      In a country such as Laos, people earn about $75 a month... or $900 a year... if they work from 15 until 65 they will earn $45,000 in their life forgetting the fact that they are extremely unlikely to have work all the time.

      So it now becomes a career move to write a virus, get your own brother (or someone you trust) to hand you in and collect the money. You do your time in relative comfort and your whole family is rich (comparatively)...

      • My guess is that Microsoft will never pay anything to anyone. Once Microsoft finds the name of a person who wrote the virus, that person's name will be given to the police. Microsoft can claim they got the information somewhere else. "Oh yes, you were the 110th person who reported the virus writer." To use your example, Microsoft won't pay, and the family in Laos will be powerless to compel payment.

        It seems likely that whoever admits he or she had knowledge of the creation of a virus will be arrested a
  • by goldcd (587052) * on Wednesday November 05, 2003 @08:03AM (#7394934) Homepage
    Tomorrow: $500k reward for writers of Linux or Apple viruses
  • If you cant fix the bug, just get rid of the bug writers, so that you dont have fix anything! HA!
    • by WIAKywbfatw (307557) on Wednesday November 05, 2003 @08:12AM (#7395013) Journal
      Well, ask any doctor and he'll tell you it's better to cure a disease than to treat its symptoms. No virus writers means no viruses, which means no headline news virus alerts and scares.

      Of course, the question is how much of the "disease" is the virus writers and how much is Microsoft itself with its sloppy approach to secure computing?
      • On the other hand, curing the disease is what we currently do with virus cleaning software. You can treat the symptom, treat the cause, or prevent the infection. Microsoft is trying the third option.

        Prevention is better than cure, certainly -- but there are limited. Darwinian evolution tells us that those organisms that can't survive their environment must adapt or die. Microsoft is attempting to address this problem by controlling the environment. The growing concern about supergerms and the dangers

      • by ajr_trm (702658) on Wednesday November 05, 2003 @08:59AM (#7395274) Homepage
        Well, ask any doctor and he'll tell you it's better to cure a disease than to treat its symptoms. No virus writers means no viruses, which means no headline news virus alerts and scares.

        The same doctor will tell you that elimination of all dangerous viruses and bacteria from our environment is impossible.
        The best way to fight the diseases is to make our constitution stronger.

        The same with software.
    • what are the realistic chances of a payout? Beyond finding the person, it's also another question finding enough evidence to put that person away. The realistic odds of MS ever having to pay out the $$, how high is that?

      Actually wont' all this do is that, in the future, the virus writing will be done by the "professional" types who are going to be more careful about covering their tracks (launch only from internet cafes, zombiefied machines? with a long enough chain-of-zombies even assessing the traffic
      • I think we can all see that this is actually a pretty poor marketing attempt by Microsoft. throwing around terms like $1/4M is going to make people (like the news companies) look up and report about what a good job MS are doing.

        I think everyone (well, most of you anyway) in this crowd realise that it is the buggy software that made this possible in the first place.

        However, outside of tech circles, MS is highly regarded (and lets be honest, they have done more good than bad overall... please dont hurt me f
    • I think you mean the bug exploiters
  • Interesting idea (Score:5, Interesting)

    by Zocalo (252965) on Wednesday November 05, 2003 @08:04AM (#7394947) Homepage
    But if Microsoft are going to take this approach, then what about extending it to spammers? Microsoft must spend a hell of a lot more the that $250,000 on hardware, bandwidth and stafff to deal with all the spam going to hotmail accounts, so it could actually save them money.

    Or does Microsoft actually make money from spam? I seem to call they were not exactly a staunch supporter of anti-spam legislation recently.

    • by stretch0611 (603238) on Wednesday November 05, 2003 @12:11PM (#7396937) Journal
      If Microsoft makes it commonplace to pay $250,000 for finding a virus writer, it will go broke soon. After all they only have $50 Billion in cash.
  • worms = good (Score:2, Insightful)

    by alan_d_post (120619)
    The not-very-malicious worms that we've seen exploiting e.g. the NT RPC vuln are good things, IMO. They encourage admins to patch their systems, giving black hats less opportunity to do real damage.
    • Re:worms = good (Score:5, Insightful)

      by Pike65 (454932) on Wednesday November 05, 2003 @08:19AM (#7395050) Homepage
      Well you clearly didn't get a temp job on a helpdesk a week before the shit hit the fan.

      I did >: (

      Besides, in business where the sysadmin wasn't a total retard (read: not where I was) there was no way for the worm to get in. The people who needed to patch their systems were the home users who got shafted for not using firewalls. The same people who use Windows because it's not meant to need much setting up . . .
    • No, worms = bad (Score:5, Insightful)

      by Moraelin (679338) on Wednesday November 05, 2003 @08:45AM (#7395196) Journal
      This idea is about as retarded as saying that:

      - throwing stones through people's windows is good. It encourages them to buy bullet-proof glasses before a real thief breaks through that window.

      - lockpicking into someone's house and spray-painting their walls is good. It encourages them to buy better locks, giving a real thief less opportunity to steal stuff.

      - poisoning the neighbour's dog is good. It encourages him to get a dog which won't wag its tail when a (potential) thief throws him a piece of meat.

      - keying random people's cars is good. It encourages them to park those cars in proper park houses, where presumably a real thief would have a harder time getting away with their car.

      And so on, and so forth. I'm sure you get the idea by now.

      Basically, no, there is no proper excuse for vandalism. Neither in the proper world, nor in the IT world. And just as any judge would probably just have a laugh if someone pulled the retarded excuse "but the lock wasn't 100% secure, so it's not my fault" in a break-and-enter trial, the same should apply to breaking-and-entering someone's computer.

      And if you do go around keying cars or flooding the net with RPC exploit packets, no matter how well intentioned you are, I do hope they throw you in a nice jail cell, with two convicted anal rapists as cell-mates. Yes, that same heartfelt wish goes to whoever thought that an RPC patching worm is a good idea.
  • Here's an idea.. (Score:4, Informative)

    by greenerx (598149) on Wednesday November 05, 2003 @08:05AM (#7394950) Homepage Journal
    they should invest the 250000 into their security team and fix the vulnerabilities instead of chasing after 13 year olds
    • by svvampy (576225)
      Theres only so much money they can throw at a problem.
    • Brilliant move (Score:5, Interesting)

      by forged (206127) <soltesz.gmail@com> on Wednesday November 05, 2003 @08:26AM (#7395088) Homepage Journal
      No intention to troll, but I honestly think that this decision is brilliant. Software to which you are only granted a license to use, still belongs to Microsoft at the end of the day. To some degree a virus wrecking havoc amongst computer using their software can be seen like if somebody was vandalizing your property. If that was the case and you wanted to catch them, why not put a bounty on their head ? Seems logical to me, if you can afford someone to do it for you.

      Certainly the government has been doing so for a while, considering the various bounties for information leading to the arrest of international criminals and terrorists. Maybe corporation joining the bandwagon to do the same is the next good thing..

      And remember, MS has ~ $50BN in case, so it isn't a big deal to them to put the money where their mouth is. In fact, $250K is rather cheap considering how much bad PR they got recently due to the attacks (that must have cost them $BN's in lost revenue from customers switching), so imho they cound't hope for a better use of the same amount if they tried to make up for the negative publicity some other way.

      • Re:Brilliant move (Score:4, Insightful)

        by lone_marauder (642787) on Wednesday November 05, 2003 @10:27AM (#7395921)
        To some degree a virus wrecking havoc amongst computer using their software can be seen like if somebody was vandalizing your property.

        Oops! Be careful with that. Compare the MS business process with real life, and you might raise the specter of product liability.
      • by js7a (579872) *
        $250K is rather cheap considering how much bad PR they got recently due to the attacks

        "Cheap" is right, or an understatement.

        Any decent reward these days should be at least [placing pinky to corner of mouth] one million dollars.

  • by caitsith01 (606117) on Wednesday November 05, 2003 @08:06AM (#7394956) Journal
    ...closer together.

    Later in the same press conference, newly appointed Communications Secretary William Gates III announced that sale of all software in the United States will cease Monday, to be replaced by a Federally subsidised regime of nationally distributed software based on a uniform technology. In response to questions Mr. Gates indicated that the vendor supplying the software had not yet been selected, before laughing maniacally.
    • by whig (6869) * on Wednesday November 05, 2003 @08:50AM (#7395226) Homepage Journal
      Slightly off-topic, but related to what you said, this is part of a recent journal entry [slashdot.org] I made.

      I don't think most people who bash Microsoft really know, cognitively, why they do it. But there is a social dynamic in effect that causes people to resent, and therefore attack, what they cannot quite understand.

      Most people imagine that the United States is a democracy. Others will correct them and say, no, it is a republic. Both of these are really a statement of expectation, not actual fact.

      The US is in truth a plutocracy. Firstly, the freedom of the press is only truly open to those who can afford to publish. The emergence of mass media in the 20th century further centralized the primary means of communication in a small number of corporate hands. That person or corporation with the most power, in economic terms, can "speak" with the greatest volume.

      The Internet has lowered the barrier to communication, and is the leading edge of the revolution (see, it's not being televised, is it?) in terms of giving a greater and increasing voice to those with the greatest persuasiveness, rather than those with the most financial means to promote their message. What will hopefully emerge from this process is a totally new form of government, a meritocracy. In my opinion, music will be the greatest power. Some might suggest pornography will rule. Much of what goes for popular music today (given current media) is some combination of the two.

      In the meantime, and returning to the subject of this journal entry, the company with the greatest financial clout in the world right now is Microsoft. Moreover, the company is controlled in large part by a single man, William Gates III. What he says Microsoft will publish, they will publish. When he wants to back a candidate for office, he can ensure that candidate will have the full power of the press behind him.

      I am not trying to say that Gates is a bad man, only that he is a man who controls the largest share of the liquid assets which confer power. There are many other wealthy individuals and families, some of whom probably resent Gates. His power is counterbalanced by the old money still very capable of exercising their power.

      If my thesis is right, and this is a plutocratic system, then Gates is nominally the king, with no hereditary right of succession as such, unless he can prolong his wealth into the next generation.

      Thus the GNU project, and associated free software and open source projects, originally aimed at AT&T, has become a loaded gun pointed at the king himself.
      • "Most people imagine that the United States is a democracy. Others will correct them and say, no, it is a republic."

        Yeah, I know these kinds of people, and it's usually someone who has their main political experience from playing "Civilisation".

        (Although it seems the US doesn't get as many unhappy faces for going to war as other nations ...)

        To have democracy is to be ruled by the people. When a nation is a republic it just means there's no king/queen/tsar/other hereditary figurehead or ruler.

        Nepal is no
      • That is one the silliest things I've read in a looooong time.

        1) Freedom of the press is only truly open to those who can afford to publish? Uh, hello, communication channels are more wide open today then they have ever been, thanks to blogs, email, newsgroups, P2P, desktop publishing, etc. Of course big corporations have more options available to them, but that is (and has always been) the case just about everywhere in the world.

        2) "What will hopefully emerge from this process is a totally new form of
      • Or Occam's Razor might say that people dislike Microsoft because Microsoft has been responsible for countless hours of frustration and time wasted due to bad products and no readily available alternative.

        It's like buying a lemon from the only car dealer in town that you can afford to buy from. You despise the dealership and the salesman who sold you the car. You despise the owner of the dealership for tricking you.

        It's not about how much money the owner has, but how he got the money. People associate Bill
  • ehehe... (Score:2, Funny)

    by stephenry (648792)
    There seem to be a couple of programs in Windows, I don't know their name, that shut-out competitors applications and routinely tunnel useage information back to it's headquarters. Not only that, but they seem to integrate with the system itself and mysterious de-configure my existing software. Strange.

    They definately seem to be illegal, possibly even viruses; maybe I can get some payola from Microsoft for letting them know about them. Oh wait...
  • ahh (Score:4, Informative)

    by slobarnuts (666254) on Wednesday November 05, 2003 @08:06AM (#7394959) Homepage
    the miracle of money. If they look like the are trying to make things better, people will like them more. and $250k will work wonders with their publicity. This is marketing 101. Very good tactical manuever. But the question is whether it will actually find those virus writers. I imagine every single person on IRC will turning in their avowed rival. It is like when there is massive rewards for criminals, police get flooded with "tips". But then again it might work. they caught Malvo.
  • by Erwos (553607)
    "This is the first time a company has offered money for information about the identity of the cybercriminals."

    Is this really true? It seems kind of unlikely.

    -Erwos
  • All this demonstrates is that Microsoft (and, perhaps, the FBI) are dumbfounded and need to offer a monetary reward to determine who's the culprit. As far as Microsoft is concerned, that's not really a big deal; even as much as we all may hat them, tracking down worm authors isn't their business. But a joint press conference with the FBI?

    Something tells me that:

    a) The FBI has jack shit for leads (big surprise) and cajoled Microsoft into making this lovey-dovey announcement "for the consumers' benefit"

    b)
  • New markets! (Score:3, Interesting)

    by Mononoke (88668) on Wednesday November 05, 2003 @08:08AM (#7394984) Homepage Journal
    Could this be the start of a new trend in going after the writers of viruses & worms?
    Could this be the start of a new trend of making big bucks writing viruses and worms that make the mean old lady next door with the AOL account look guilty?

  • ... so to help promote SP2/NX which is media wise being used to soften up the consumers to heavier DRM Technology.

    MS to intro hardware-linked security for AMD64, Itanium, future CPUs [theregister.co.uk] which failed to mention BSD already using it???

    Or does this mean they are looking for a fall guy?

  • Dear MS,

    I am a virus writer and would be happy to sell you my virii. These can be purchased by depositing 250,000 USD in my numbered Austrian bank account. By doing this you will save future embarassement, and you can look through your wonderfully robust windows code and provide patches to it before a similliar virus is seen "in the wild".

    I know this may just blow my pay day, but perhaps you could just write secure code in the first place? Just a thought.

    cluge


  • I thought these guys are meant to be terrorists. $250k to give information leading to the arrest of a terrorist ? Not enough, I want $10m which I thought was the standard US terrorist suspect reward.

    Its not even a figure Dr Evil would get out of bed for.
  • I'd like to spammers on FBI's ten most wanted list instead of this.

    z
  • I don't really see anything diabolical here. Someone write a virus(s) that cost MS a lot of money and time. They want them to be caught, and so put up a substantially lesser ammount of money as a reward. It boils down one way or another that distributing a virus is a crime, whether it's against windows or not, and whether or not it causes them to fix a vulnerability. If you're really that worried about it i'm sure they wouldn't mind you simply telling them about it instead of costing thousands of comple
  • Isn't this like.. (Score:2, Insightful)

    by wfberg (24378)
    Isn't this like the manufacturers of cars that don't have seatbelts putting a bounty on the heads of drunk drivers who crash into their unsafe cars, say, killing families of four in the process?

    Yeah, it's all the DUI guy's fault, no product-liability here! In fact, we're really swell guys, closing the barn door after the horse got out and all..

    It's a great PR move for people who don't have a sense of irony, which fortunately includes the majority of Americans, and Alanis Morissette.
  • PR stunt (Score:5, Interesting)

    by David Kennedy (128669) on Wednesday November 05, 2003 @08:21AM (#7395060) Homepage
    This is a lovely bit of marketing. It deflects all blame for the viruses onto the writers, and implies that Microsoft have no responsibility here.

    Don't get me wrong, I'd cheerfully beat the living daylights out of a virus writer on the basis that I can barely use my email now. Let's have an analogy:

    You are a major company with expensive commercial premises. [You are a company who uses IT kit.]

    You employ a security firm to look after your building. [You install an OS.]

    Your building burns down because there were no doors and some bored teenagers wandered in and torched the place. [You get burned by a virus, and trust me, that costs business money in downtime and/or admins.]

    Was the teenager guilty? Yes. Was the security firm negligent? Yes. Does going after the teenager mean the security firm is not negligent? Nope.

    I'm rather bemused as to why a major business hasn't sued Microsoft over some of the security scandals this past couple of years. Much as I'd like to see it, I don't think any will really vote with their wallets; migrating desktops for plain ordinary business work (mail, Word, Excel) from Windows is never even discussed, no matter what the servers are.

    My solution? XML document formats! Even if it's not XML, something common. Until we have that there'll always be a monoculture on the commercial desktop.

    (For what it's worth, I bought Office on my Mac OS box. It's nice. I don't like Windows, but I don't object to Office at all, realising that LaTeX isn't for everyone.)
  • by RobotRunAmok (595286) * on Wednesday November 05, 2003 @08:22AM (#7395067)
    Because we know these virus-writing punks can't resist bragging about their exploits in whatever low-rent Usenet hang-outs they frequent, it should be interesting to see if there is as little honor among them as there is rumored to be among thieves.

    Script-Kiddie: "Dude! You turned me in to... to... Microsoft!?! That's cold!"

    Former Friend of Script-Kiddie: "Sorry, man, tuition at MIT is a real bitch, yo."

    S.K.: "MIT? What choo talking 'bout, MIT? You go to Westchester Community College!"

    F.F.o.S.K.: "That was before I got this here letter of recommendation from my new sponsor, William H. Gates III. Hey, whaddya think of these new Birkenstocks? Too gay? I kinda think they set off my eyes pretty well, yo..."

    S.K.: "Dooooooood....!" (As two big guys in MS-branded butterfly suits drag him into back of van)

    F.F.o.S.K.: "Hey, look me up when you get out, man. By then I should be setting myself up in my own company and will be able to use a guy with your leet skills."
  • started to write a "viral" software back in 1991 when he was studying CS in Helsinki. It has infected both of my computers. MS Windows won't even boot on them. I know his name and contact info, so do I get the bounty?
  • by linuxci (3530) on Wednesday November 05, 2003 @08:27AM (#7395093)
    The problem is not many people look further than Microsoft products because they know no better, and the mainstream press doesn't do much to help this. Microsoft throwning money into the pot to catch criminals is unlikely to solve the problem, in the UK there's a lot of schemes that offer rewards for finding criminals, but although they often catch people, it doesn't seem to deter people. I mean we can't tell people in the UK that they can install new Windows and doors in their house and not bother to lock them, and installing an MS OS (and to be fair many Linux distributions) without doing a 'lock down' is just as stupid, but most people don't know how to go about securing their PC.

    We know that other products aren't perfect but variety in software does do something to reduce the dramatic effect of these worms.

    So the more people we can educate about alternatives to Microsoft products such as Mozilla Firebird, Thunderbird and Seamonkey (the app suite) will help to restore some balance and will hopefully reduce the number of email viruses. Commercial alternatives such as Opera should also be mentioned because although I think the interface is awful, other people like it and choice is good. Many home users just use thier computers for web browsing and simple documents, so Mozilla + OpenOffice would do all they need.

    Then on the desktop you have various options as well as Windows, although unfortunately for most people they may be depending on it for certain applications. MacOS X is ok, but would require buying new hardware if you currently have an ix86 PC.
  • Bounties, Bounties everywhere,
    And I am loosing my Counties of how many there are.

    Every Mountie must now be getting this idea,
    that if they can't catch the Evilers Dead or Alive -
    Make an Announcie of "X" Million Dollar Reward.

    X is 25 for Osama, and 0.25 for MSBlatie,
    10 for Saddamie, and 10 for his baby boys.

    Some you will catchie and some will get away.

    No Osama, but M$ might catchy MSBlastie,
    No Saddam, but they got his progeny.

    When will someone get the idea,
    of Putting up X for the Lunactic,
    or X for the Du
  • by amorsen (7485) <benny+slashdot@amorsen.dk> on Wednesday November 05, 2003 @08:30AM (#7395115)
    People have been starting to see Microsoft as a vendor of poorly-written, insecure software. What this offer makes people see is that Microsoft is just the victim of evil criminals. And you can never blame the victim for the crime...
  • by shish (588640) on Wednesday November 05, 2003 @08:32AM (#7395119) Homepage
    1) Claim to be the virus writer
    2) Get $250k
    3) Bail yourself out of jail

    Wow! Profit at stage #2 and no ???! This *has* to be a good plan!
  • Come on, in the scheme of things $250,000 is not an awful lot, especially to a company like MicroSoft.

    Morals or no, most people have a price. Had they made it something a little more interesting, say in the $1,000,000-$5,000,000 range, most everyone involved would shop their friend/brother/business associate.

    If some of the recent spate of viruses were funded and unleashed by organised crime/spamming syndicates (as some have conjectured), do you really think anyone will risk being found at the bottom of
  • Spammers (Score:3, Insightful)

    by tehanu (682528) on Wednesday November 05, 2003 @08:33AM (#7395129)
    Given that the Sorbig virus has been linked to spammers, finding the person who wrote the virus might be a blow against spammers as well. Any trial will be well publicised and having the public connection of spammers==virus writers==evil hackers (yes I know the proper term is crackers, but this is public opinion I'm talking about here)==terrorists could be a big blow against the reputation of spamming so that it is no longer seen as just an annoyance but something potentially dangerous. This probably won't bother the spammers so much but it might help get legitimate companies who hire them give the whole email marketing process a second thought, especially if any connections come up during a trial. "Trial: Virus used to advertise for Company X." "Virus writers hack computers to advertise for X" does not sound good for Company X on the front page. At the very least it might make them more careful about who they hire and who the people they hire outsource to (as I'm sure there will be so much outsourcing something known as "plausible deniablity" will be used).

    And a connection in the public consciousness between spammers and hackers who write viruses might give a bit of impetus to the government for harsher anti-spam laws. I mean look at anti-hacking laws vs anti-spam laws. Which one has more teeth and are tougher?
  • by HisMother (413313) on Wednesday November 05, 2003 @08:39AM (#7395165)
    This reminds me of O.J.'s promise not to rest until he personally found the real killers.
  • Clever (Score:5, Insightful)

    by 0xdeadbeef (28836) on Wednesday November 05, 2003 @08:55AM (#7395254) Homepage Journal
    By offering a bounty on their heads, they only serve to increase the status of worm and virus authors. What was once the loserdom of the script kiddie community is now glamorous.

    Now consider what this means to their "secure computing" initiative, how the frustrations from dealing with this shit can make people more accepting of their draconian security measures. Consider the financial benefits of "digital rights management" that they can only realize after the hardware and software is locked down.

    You can imagine the conversation that lead to this, like something out of "24" or the Bush administration: Lets allow, no, lets *encourage* a virus 911 so they'll let us lead them to safety!
  • Good idea (Score:3, Interesting)

    by mseeger (40923) on Wednesday November 05, 2003 @09:11AM (#7395340)
    Hi,

    while i'm no big fan of M$ as most here, i think this is a good idea. Especially the Sobig virus author is becoming a menace. So making him watch his back, may set back the release date for Sobig.G.

    Please be aware that the Sobig viruses were written with a comercial interest. Putting a bounty on their arrest something worth considering and in line with all ethical codes i know.

    As the Sobig author pobably has his roots in the SPAM community and they would sell their next-of-kin for half price their, i guess the chances are quite good.

    Regards, Martin

    P.S. Putting 250 K$ (better M$) into R&D for more security would be good thing too.

  • by IGnatius T Foobar (4328) on Wednesday November 05, 2003 @09:37AM (#7395523) Homepage Journal
    In particular, Microsoft would like to locate and permanently detain the individual responsible for the treacherous malware program called "Linux." This highly dangerous program causes Windows to not be present at all on any infected computer! Since, as Steve Ballmer keeps telling us, every time you fail to buy a Microsoft program, God kills a kitten ... Microsoft is offering a large bounty to find the author of this "Linux" program.

    God Bless Mom, Apple Pie, and John Ashcroft! Preseve the American way of life! Find and destroy the evil virus writers!
  • by clickety6 (141178) on Wednesday November 05, 2003 @10:19AM (#7395852)
    ...who is willing to spend a few years out of circulation for $125,000...!

    Contact me on 555-EASYCASH.

  • by nolife (233813) on Wednesday November 05, 2003 @11:14AM (#7396354) Homepage Journal
    Is the writer the responsible party or is the person who deploys the virus?

    What if I make a spreading virus that works with a known flaw in a MS product. I post this virus and code to say Bugtraq, IRC, or here on /. How can I be prosecuted? I wrote some code but did not use it or set it free on a network. You could take this to extremes on either side. What if I give code examples? What if I only documented HOW to write code to exploit an existing hole? What if I only describe the hole? I can make a machine gun and provide you with plans for a machine gun but unless I use it to kill people, I did nothing wrong. Seems to me that the prosecutors and MS are trying to hang someone as an example but that is a very fine line. Is there a law that clearly states that you can not knowingly write code that may cause millions of computers to crash? I know this is a touchy subject but I view this software as free speech.
  • by Baldrson (78598) on Wednesday November 05, 2003 @11:29AM (#7396499) Homepage Journal
    Perhaps M$ has figured out that paying for results [google.com] is a good policy -- unlike the policy followed by NASA, DoE, etc.

    Now, if Gates would only get a clue [slashdot.org]...

  • by Chatmag (646500) <editor@chatmag.com> on Wednesday November 05, 2003 @11:59AM (#7396814) Homepage Journal
    Steve Linford [spamhaus.org] of Spamhaus seems to think he knows who is behind the Fizzer/Sobig/Mimail attacks, and will be releasing the information in the near future.

    In the article, he leads one to believe that Fizzer is still active in the wild. As a member of IRC Unity, the group founded to eradicate Fizzer, I have not seen a report of Fizzer in months.

    If Steve Linford actually knows, he needs to contact Microsoft. The money would help him pay for the losses incurred by the DDoS attacks against Spamhaus.
  • by gone.fishing (213219) on Wednesday November 05, 2003 @02:23PM (#7398313) Journal
    Gee, I knew what most of these posts were going to say before I even read them. Most of them say that this is just a marketing ploy by Microsoft to deflect criticism, that Microsoft's poorly written code is what is really the cause, and Microsoft this and Microsoft that and oh, by the way Linux rules.

    Let's put all of that aside for a minute. I'm not going to be pro-Microsoft or Pro-anything here. I am going to be Anti-virus writer though.

    Cyber-crime be it scams, viruses, trojans, worms, password/identity theft, carding or whatever affects all of us personally. It does because it casts things like the internet, ecommerce, and technology in a poor light. It causes "big money" to think twice before they invest in technology, it causes things like e-voting to come more slowly to the forefront and, it forces companies to take sometimes extreme security measures.

    In a sense, the 'net hasn't matured yet. It can be compared to the Wild West where crooks didn't have to run very far or hide very long or even worry very much about getting caught. I have no doubt that over time we will see the net change and cyber-criminals and other scumbags will have more to fear. But right now, a wanted poster with a reward is appropriate. It is what Wells-Fargo did to catch outlaws way back when and it will work as well today.
  • by Dirtside (91468) on Wednesday November 05, 2003 @09:47PM (#7403025) Journal
    I've been wondering for a while why we haven't seen any really nasty virus epidemics -- I'm not talking massive DDOS, or spamfloods. I'm talking, a virus that infects a few million hosts over the course of a day or two, and then at a predetermined time, starts formatting the hard drive.

    Given how fast some recent viruses seem to have spread, it certainly seems feasible. So why do these viruses always have fairly innocuous payloads? It would seem a relatively simple thing to write a virus like this -- not to mention release it anonymously and never tell anyone about it. Is it just that the people capable of doing this are all ethical enough not to? Or that the ones who aren't ethical enough, are dumb enough to get caught? Or that nobody, I mean nobody would want to see the havoc wrought by such a virus?

    Why haven't we seen a virus like this yet? Is it because such a virus isn't possible, or just because no one's bothered yet?

If God is perfect, why did He create discontinuous functions?

Working...