Microsoft Offers A Bounty On Virus Writers 719
Iphtashu Fitz writes "According to news.com Microsoft will announce a bounty of $250,000 on Wednesday for information on who wrote two recent Windows viruses. The bounty is offered for information that leads to the arrest of the people who released the MSBlast worm and the SoBig virus. Microsoft will officially announce the reward in a joint press conference with the FBI and U.S. Secret Service Wednesday morning. This is the first time a company has offered money for information about the identity of the cybercriminals. Could this be the start of a new trend in going after the writers of viruses & worms?"
Not always so catchable... (Score:5, Insightful)
I love Microsoft's Logic! (Score:2, Insightful)
worms = good (Score:2, Insightful)
Interesting.. (Score:1, Insightful)
I suppose we just have to ask the question, in the l33t hacker circles, is money or loyalty worth more?
Re:Didn't... (Score:3, Insightful)
Cyber Bounty Hunters (Score:1, Insightful)
Re:Here's an idea.. (Score:2, Insightful)
Well, there logic is (half) right... (Score:5, Insightful)
Of course, the question is how much of the "disease" is the virus writers and how much is Microsoft itself with its sloppy approach to secure computing?
Re:I love Microsoft's Logic! (Score:3, Insightful)
Actually wont' all this do is that, in the future, the virus writing will be done by the "professional" types who are going to be more careful about covering their tracks (launch only from internet cafes, zombiefied machines? with a long enough chain-of-zombies even assessing the traffic logs is going to come up with inconclusive info?) as opposed to newbie-types? will that ramp up the lethality of the virii?
Re:Quite (Score:3, Insightful)
Oddly enough, disobedience is not an easy thing to squash.
Re:I heard they needed skilled people (Score:5, Insightful)
Re:I love Microsoft's Logic! (Score:2, Insightful)
Re:worms = good (Score:5, Insightful)
I did >: (
Besides, in business where the sysadmin wasn't a total retard (read: not where I was) there was no way for the worm to get in. The people who needed to patch their systems were the home users who got shafted for not using firewalls. The same people who use Windows because it's not meant to need much setting up . . .
Re:Not always so catchable... (Score:3, Insightful)
2) I wonder if Microsoft are expecting this move to deter people from writing viruses. Maybe someone thought: that virus cost us a lot more than 1/4 million, let's spend that money and set an example even if the guy doesn't get caught.
3) This is going to spark a new underground industry: write a virus secretly, then turn around and tell microsoft you have info about it (of course in an imaginative enough way not to get caught but still get the bounty).
Isn't this like.. (Score:2, Insightful)
Yeah, it's all the DUI guy's fault, no product-liability here! In fact, we're really swell guys, closing the barn door after the horse got out and all..
It's a great PR move for people who don't have a sense of irony, which fortunately includes the majority of Americans, and Alanis Morissette.
People need to be better informed (Score:4, Insightful)
We know that other products aren't perfect but variety in software does do something to reduce the dramatic effect of these worms.
So the more people we can educate about alternatives to Microsoft products such as Mozilla Firebird, Thunderbird and Seamonkey (the app suite) will help to restore some balance and will hopefully reduce the number of email viruses. Commercial alternatives such as Opera should also be mentioned because although I think the interface is awful, other people like it and choice is good. Many home users just use thier computers for web browsing and simple documents, so Mozilla + OpenOffice would do all they need.
Then on the desktop you have various options as well as Windows, although unfortunately for most people they may be depending on it for certain applications. MacOS X is ok, but would require buying new hardware if you currently have an ix86 PC.
Poor victimised Microsoft (Score:3, Insightful)
Spammers (Score:3, Insightful)
And a connection in the public consciousness between spammers and hackers who write viruses might give a bit of impetus to the government for harsher anti-spam laws. I mean look at anti-hacking laws vs anti-spam laws. Which one has more teeth and are tougher?
Re:Not always so catchable... (Score:5, Insightful)
Ever read the book, "The Silicon Samurai", the cracker in that book was very clever, a master of the art. Still he got caught. Why? Because crackers, virus writers, DDoS organisers have one thing in common. They want fame. They cant sit without leaving clues. History teaches us that the greatest thieves and criminal got caught due to their hunger for fame. This will happen here also. Though i am not to sure if that is a very good thing, coz when such showdowns happen a lot of innocent people suffer.
New senario ... (Score:3, Insightful)
So it now becomes a career move to write a virus, get your own brother (or someone you trust) to hand you in and collect the money. You do your time in relative comfort and your whole family is rich (comparatively)...
No, worms = bad (Score:5, Insightful)
- throwing stones through people's windows is good. It encourages them to buy bullet-proof glasses before a real thief breaks through that window.
- lockpicking into someone's house and spray-painting their walls is good. It encourages them to buy better locks, giving a real thief less opportunity to steal stuff.
- poisoning the neighbour's dog is good. It encourages him to get a dog which won't wag its tail when a (potential) thief throws him a piece of meat.
- keying random people's cars is good. It encourages them to park those cars in proper park houses, where presumably a real thief would have a harder time getting away with their car.
And so on, and so forth. I'm sure you get the idea by now.
Basically, no, there is no proper excuse for vandalism. Neither in the proper world, nor in the IT world. And just as any judge would probably just have a laugh if someone pulled the retarded excuse "but the lock wasn't 100% secure, so it's not my fault" in a break-and-enter trial, the same should apply to breaking-and-entering someone's computer.
And if you do go around keying cars or flooding the net with RPC exploit packets, no matter how well intentioned you are, I do hope they throw you in a nice jail cell, with two convicted anal rapists as cell-mates. Yes, that same heartfelt wish goes to whoever thought that an RPC patching worm is a good idea.
Clever (Score:5, Insightful)
Now consider what this means to their "secure computing" initiative, how the frustrations from dealing with this shit can make people more accepting of their draconian security measures. Consider the financial benefits of "digital rights management" that they can only realize after the hardware and software is locked down.
You can imagine the conversation that lead to this, like something out of "24" or the Bush administration: Lets allow, no, lets *encourage* a virus 911 so they'll let us lead them to safety!
Re:Well, there logic is (half) right... (Score:5, Insightful)
The same doctor will tell you that elimination of all dangerous viruses and bacteria from our environment is impossible.
The best way to fight the diseases is to make our constitution stronger.
The same with software.
Smoke and Mirrors - Windows not ready for Internet (Score:5, Insightful)
This bounty is just a PR game to distract from anti-trust, patent violations, anti-competitive fines, security fines. Microsoft's executives and other investors have had enough time now to dump their stock. Game over.
Re:Here's an idea.. (Score:1, Insightful)
The new trend of spammers writing viruses to make zombie machines is different. I suspect the people behind it are much older, although they may have hired someone of any age to write the code.
We Need to Stop Equating All Conspiracy Theories (Score:5, Insightful)
Yes, but they aren't the same conspiracy theorists.
On a serious note, folks on slashdot (and indeed, people in general) tend to equate all types of conspiracies (and conspiracy theories) and lump them together...somehow equating Enron with the X-Files, at least until Enron is exposed publicly (then, for some reason, people are able to grasp the difference). This is a real problem, because it means that people will live in denial of real-world conspiracies that are taking place (e.g. Monsanto's conspiracy to dump toxic waste into the rural groundwater of the deep American south in the 1990s, or the current SCO conspiracy to defraud their investors and steal the copyright of thousands of software developers around the world) by dismissing them in their minds as no more likely than alien invasion, UFOs in storage at area 51, or silent black helicopters hovering overhead.
We do know conspiracies exist, therefor, it logically follows that some conspiracy theories are likely to be not out in left field, but rather quite correct.
We know as a matter of historical record that the Nazis conspired to stage a "terrorist" act against the Reichstag as a prelude to a coup d'tate, however, listening to the "conspiracy theorists" of the time would have been like listening to a conspiracy theorist today claiming that 9/11 was staged by Baby Bush (it obviously wasn't
Microsoft has a history of conspiring to do dishonest and disingenuous things that directly (and illegally) harm and coerce their customers and their competitors, indeed, they have been convicted of doing so on numerous occasions (the DOJ anti-trust trial and subsequent sell-out being only the latest example). A conspiracy theorist pointing out a economic or tactical political advantage Microsoft might gain through ill-behavior toward its customers is not out in left field
So IMHO it is a mistake (and disingenuous) to equate actions by Microsoft and the copyright cartels that directly threaten our digital freedoms, and the conspiracies that do in fact drive these agendas (even if said conspiracies have the most banal of motivations: greed for cold, hard cash), with tin-foil hats, ghosts, and UFO sightings, as is so often done by the apologists of such groups.
Expressing concern about corporate or government malfeasance (conspired or not) isn't even remotely analogous to X-Files-like nonsense, and it is time we stopped allowing sceptics to use dishonest means (equating suspicion of the Reichstag burning ^H^H^H Microsoft's exploitation of their woeful security record to political advantage, with suspicion of Alien Lizard ruling the earth) to denigrate those who do express such concerns.
Re:No, worms = bad (Score:3, Insightful)
System admins are a different issue. I'm sure many of you appreciate the job security, but I'm not sure that your _employer_ appreciates having to spend the extra money. All this worm frenzy _is_ costing the economy real money. Including the money to hire a good helping of extra network admins.
I do not, however, appreciate someone unilaterally deciding for millions of people that everyone must dedicate time and money into securing their systems. If you really think that putting the millions of average Tom, Dick and Harry through all this nightmare is just a small price to pay in the anti-Microsoft crusade, then you have a reality check problem.
The thing is, from the point of view of how the rest of the world works, this is the most absurd and idiotic system possible. In the rest of the world model, Tom, Dick and Harry already _know_ that the lock on their front door _can_ be picked. They _know_ that if someone really wanted to steal their car, that's very much possible too. Etc.
But they also know that if someone actually does, the law will sooner or later catch the thief and throw them into jail. And they know that if someone broke at night into the company and had a look at the paper based financial records, they wouldn't have "but I just wanted to help them secure their system" as an excuse.
The real world does not work by the idea that "lock vendors must produce a 100% non-lockpickable lock". It works more by the idea that the lock is a token. It helps if it can keep away the non-determined nosy neighbour or their cat, or maybe a drunk teenager, but it is _not_ supposed to be a 100% secure anti-theft device. It's main value is as a marker which says, "if we catch you beyond this line, we'll throw your criminal ass into jail." That's their real value, and that's the real deterrent.
Just in case you were wondering why regular people can't comprehend the idea of needing to check the Microsoft update page every few minutes, and configuring sophisticated firewalls: it's because their normal lives happen in this completely other security model. The model where your main defense is the law, not having to have a 100% unbreakable titanium bunker door and a 100% non-pickable lock.
So when they go on the Internet, they assume the same implied protection and deterrent. Not that they enter a "Wild West" kind of world, where if someone can lockpick your door and shoot your dog, then it's fair game. And hey, now that someone's so k3wl and l33t, because they had downloaded a "lockpick door and shoot dog" script.
And maybe it's about damn time that it actually started to work like in the real world.
Causing millions of people millions of hours worth of unneeded trouble, is _not_ some cool way of promoting security. It's just the IT version of vandals throwing stones through home windows. Only now they can throw millions of stones per second. (See the packet storms caused by RPC worms.)
And maybe it's about damn time someone figured out a way of putting those vandals behind bars. Just so the rest of the world can spend their time and money in a better way than constantly patching, and constantly upgrading firewalls.
I'm looking for a virus writer... (Score:4, Insightful)
Contact me on 555-EASYCASH.
Re:Why People Bash Microsoft (Score:3, Insightful)
1) Freedom of the press is only truly open to those who can afford to publish? Uh, hello, communication channels are more wide open today then they have ever been, thanks to blogs, email, newsgroups, P2P, desktop publishing, etc. Of course big corporations have more options available to them, but that is (and has always been) the case just about everywhere in the world.
2) "What will hopefully emerge from this process is a totally new form of government, a meritocracy. In my opinion, music will be the greatest power." Have you taken your meds today, or are we looking at 50 Cent as the new Director of Homeland Security?
3) "the company with the greatest financial clout in the world right now is Microsoft." A software company [yahoo.com], no matter how large, hardly wields "financial clout" like a GE [yahoo.com], which spans the globe and gobbles up companies in a variety of industries by the handful, or a huge bank like Citigroup [yahoo.com], which brokers deals and provides the financing that makes business projects possible. Microsoft is a giant in the software business, but in terms of the overall business picture, they aren't the biggest kid on the block by far.
4) Gates can direct the "full power of the press" to back candidates of his choosing? While Microsoft has a partnership with NBC, I doubt that he spends his time telling Katie & Matt which candidates to pump up.
5) "If my thesis is right, and this is a plutocratic system, then Gates is nominally the king, with no hereditary right of succession as such, unless he can prolong his wealth into the next generation. Well, your "thesis" is dead wrong from the start, and is certainly finished off by the fact that Gates plans to give all his fortune away [guardian.co.uk].
There are plenty of reasons to bash or admire Microsoft, but paranoid fantasies are another thing entirely...
Re:Brilliant move (Score:4, Insightful)
Oops! Be careful with that. Compare the MS business process with real life, and you might raise the specter of product liability.
Anal fantatsis again! (Score:2, Insightful)
Is it because your not getting enough yourself?
Re:I heard they needed skilled people (Score:5, Insightful)
... oh, wait a minute, I'm not.
Who caused the damage? (Score:3, Insightful)
What if I make a spreading virus that works with a known flaw in a MS product. I post this virus and code to say Bugtraq, IRC, or here on
Re:I heard they needed skilled people (Score:0, Insightful)
Re:I heard they needed skilled people (Score:2, Insightful)
from this report [cornell.edu]:
To give an idea of the scope of the deterioration problem, 150 bridges collapse each year in the US
Yeah, that was 1996, but there were "engineering standards" back then...
As far as I can tell, there's nothing that is Perfect... It doesn't matter how many standards you have in place, humans introduce a certain amount of imperfection into whatever they muck with.
Also, consider that (to the best of my knowledge) no one is out trying to cause bridges to collapse. Now Windoze, on the other hand...
Sure, MS shares some of the blame here - they didn't produce a "safe" product because of market demand etc. But SO WHAT? If I went around cutting the brake lines on all the cars in supermarket parking lots, would you really blame the car manufacturers for not "securing" their products?
My point is that there is going to be a way to break something, regardless of how hard you try to secure it. I'm not saying MS necessarily tried hard enough, but you're arguing that they should have created a perfect product and that's simply not possible.
Re:Here's an idea.. (Score:3, Insightful)
That, in a nutshell, is wit.
Re:I heard they needed skilled people (Score:4, Insightful)
Its not JUST that MS makes the default user---
It is also that Windows runs a ton of stupid, random crap in kernel space.
Like Windows Media Player. Like Internet Explorer. Like Outlook. Like a ton of office stuff.
None of that belongs in kernel space.
Re:Not always so catchable... (Score:3, Insightful)
These writers won't get caught because they can't help but leave signposts, but they *may* get caught if someone in their dirty end of the world rats them out. I mean, after all, they've obviously built up this tool (a private, massive, distributed, anonymized network of PCs) for a reason, and that's for one of two obvious reasons: 1) to sell spam-sourcing services to folks who can't get an ISP to let them send, 2) to cruch their competition/adversaries.
It's a (commercial) battlefield out there in Packet Land.
Anyway, that's my take on it. =)
Re:Ignorant Ignorant Ignorant! (Score:3, Insightful)
Someone who trained to use a grenade launcher is going to use a grenade launcher when available, even if pistols are more prevalent.
Re:Why People Bash Microsoft (Score:3, Insightful)
It's like buying a lemon from the only car dealer in town that you can afford to buy from. You despise the dealership and the salesman who sold you the car. You despise the owner of the dealership for tricking you.
It's not about how much money the owner has, but how he got the money. People associate Bill Gates with the crap that Microsoft has made billions selling. He's painted his own portrait in their minds--not the media.
Part of the problem, I believe, is the hype that Microsoft raises with new product releases. They generate artificial demand by hyping products that are supposed to solve your problems. Most of the time, the problems aren't solved, and even in the cases where they are, the problems are generally shifted to something else.
Re:I heard they needed skilled people (Score:3, Insightful)
Re:I heard they needed skilled people (Score:2, Insightful)
I grew up a few miles away from the "Schoharie Creek Bridge" in the list. A week after it fell, a bridge a bit further up the creek fell as well. The second abutted my front yard. Both fell due to poor engineering.
In fact, the one next to my house was built across a bend in the creek. When they "fixed" it, (eight years later), they built the new one in the same place. Talk about not learning from past mistakes...
Designing secure and bug-free software is a tedious process, but do-able.
The original argument was that building bridges that don't fall down is also "do-able"... Apparently, that's not the case.
There is no way you can guarentee PERFECTION with ANY amount of checks / tests / standards / whatever. Who's going to run the tests? A HUMAN.
Software or not, humans make mistakes. There's nothing you can do about it. Again, I'm not asserting that MS didn't release a product with "too many" bugs. Just that the goal of "perfection" is WAY beyond reach...
Microsoft is doing something at least... (Score:4, Insightful)
Let's put all of that aside for a minute. I'm not going to be pro-Microsoft or Pro-anything here. I am going to be Anti-virus writer though.
Cyber-crime be it scams, viruses, trojans, worms, password/identity theft, carding or whatever affects all of us personally. It does because it casts things like the internet, ecommerce, and technology in a poor light. It causes "big money" to think twice before they invest in technology, it causes things like e-voting to come more slowly to the forefront and, it forces companies to take sometimes extreme security measures.
In a sense, the 'net hasn't matured yet. It can be compared to the Wild West where crooks didn't have to run very far or hide very long or even worry very much about getting caught. I have no doubt that over time we will see the net change and cyber-criminals and other scumbags will have more to fear. But right now, a wanted poster with a reward is appropriate. It is what Wells-Fargo did to catch outlaws way back when and it will work as well today.
Re:I heard they needed skilled people (Score:3, Insightful)
Where's the supervirus? (Score:3, Insightful)
Given how fast some recent viruses seem to have spread, it certainly seems feasible. So why do these viruses always have fairly innocuous payloads? It would seem a relatively simple thing to write a virus like this -- not to mention release it anonymously and never tell anyone about it. Is it just that the people capable of doing this are all ethical enough not to? Or that the ones who aren't ethical enough, are dumb enough to get caught? Or that nobody, I mean nobody would want to see the havoc wrought by such a virus?
Why haven't we seen a virus like this yet? Is it because such a virus isn't possible, or just because no one's bothered yet?
Bounty on Microsoft security holes (Score:2, Insightful)
Seriously, the PR design here is quite good: shift the blame. By putting a bounty on the bad guys, Microsoft frames the issue as the bad guys are the problem, and gets the heat off Microsoft's absymal security. I congratulate Microsoft's PR talent here. Very slick.