Microsoft Offers A Bounty On Virus Writers

Iphtashu Fitz writes "According to news.com Microsoft will announce a bounty of $250,000 on Wednesday for information on who wrote two recent Windows viruses. The bounty is offered for information that leads to the arrest of the people who released the MSBlast worm and the SoBig virus. Microsoft will officially announce the reward in a joint press conference with the FBI and U.S. Secret Service Wednesday morning. This is the first time a company has offered money for information about the identity of the cybercriminals. Could this be the start of a new trend in going after the writers of viruses & worms?"

I heard they needed skilled people

But this is ridiculous!

Re:I heard they needed skilled people

So.. like, is the 250K a signing bonus? Or do they get it in stock options? Of course, the real question is... is it cheaper for MS to pay 250K to jail each person that writes a virus exploiting on of their security holes than it is to pay the developers to avoid creating them in the first place?

Re:I heard they needed skilled people

I think they're going to pay it in used computers valued as new and Windows seat licenses.

If you want actual CDs you'll have pay retail though.

KFG

Re:I heard they needed skilled people

C'mon.

The target was Windows. They can get off - it was entrapment!

Re:I heard they needed skilled people

can I shop the microsoft outlook team in? it might not be a virus itself, but a virus facilitator at least!

Microsoft Outlook: The IDE for virus development.

re: i heard they needed skilled people

cantina thug: "i have the death sentence in 12 systems"

virus writer: "ah, but microsoft is offering a US $250,000 bounty for me!"

cantina thug: "..."

virus writer: "and i shut down millions of PCs on my home planet!"

cantina thug: "..."

virus writer: "and in a little while, i'll finally be able to move out of my parents' basement!"

cantina thug: "that does it."

[blaster fire]

ed

Re: i heard they needed skilled people

virus writer: "and in a little while, i'll finally be able to move out of my parents' basement!"

cantina thug: "that does it."

[blaster fire]

Han Solo: "No need to thank me kid"

virus writer: "Holy shit, you're Han Solo"

Smoke and Mirrors - Windows not ready for Internet

If that were even remotely true then Apache would be swimming in remote exploits, which it is not. Not only that, Microsoft's products just aren't designed for security [infoworld.com], even by the admission of their own executives. In fact, Windows is insecure by design [washingtonpost.com]. Microsoft has worked hard to earn the shoddy reputation it has among technology experts and is focusing all the more on marketing efforts. But face it, Windows is not ready for the Internet and is not likely to be. Even Joe Sixpack is starting to figure that out.

This bounty is just a PR game to distract from anti-trust, patent violations, anti-competitive fines, security fines. Microsoft's executives and other investors have had enough time now to dump their stock. Game over.

Re:I heard they needed skilled people

You know damn well that if Linux enjoyed the sort of desktop ubiquity that M$ has right now, we'd all be bitching about the latest exploit/virus/worm and complaining about how it takes so long to get them patched and why in $#%^&$%@#&* couldn't it have been written correctly in the first place!

Right. Which is why I'm bitching all the time about hbow insecure Apache is, and how long it takes to get it patched, and why the $#%^&$%@#&* it couldn't have been written right in the first place ...

... oh, wait a minute, I'm not.

Re:I heard they needed skilled people

Perhaps I'm barking up the wrong tree...But....

Its not JUST that MS makes the default user---

It is also that Windows runs a ton of stupid, random crap in kernel space.

Like Windows Media Player. Like Internet Explorer. Like Outlook. Like a ton of office stuff.

None of that belongs in kernel space.

+5 Insightful? Try -1 blatantly wrong!

It is also that Windows runs a ton of stupid, random crap in kernel space. Like Windows Media Player. Like Internet Explorer. Like Outlook. Like a ton of office stuff.

This is one of the most blatantly false statements I have seen get modded up to +4 or +5 in a long, long time.

Windows Media Player, Internet Explorer, and Outlook do NOT run in kernel mode whatsoever. They may talk to kernel-mode drivers like 95% of all user-mode software does (read from a file, talk to the network), but they absolutely do not run in kernel-mode!

C'mon, people. If you want to bash MS, you can do better than make up ridiculous statements like that.

Re:I heard they needed skilled people

Stop being an apologist for Bill Gates. When he pays for clean water and sanitation for every human being on the planet {and he wouldn't even notice it} or performs some similar act for the greater human good {this would not include hara-kiri - given the mess he would be leaving behind, that would be too much like a coward's way out} then he'll have earned a little of my respect.

Maybe this is a troll, but I'll bite...

Last I checked, Bill Gates was performing similar acts for the greater human good. He's one of the most prolific charitable contributors in history. If you check out the Bill and Melinda Gates Foundation [gatesfoundation.com] you'll notice that they have poured billions of dollars into global health projects. According to their annual financial report for 2002 [gatesfoundation.com] they gave away over $1Bn last year alone.

Re:I heard they needed skilled people

Yes, but he's worth $46 billion.

Consider that most people have net worths of $46 thousand or less, he's doing the equivalent of John Q. Citizen writing two checks for five hundred bucks. Even those who are lucky enough to be equity millionaires, that's like sending one kid to college. If he cashed out everything and shoved it into a 2.25% interest bearing checking account he'd STILL make over a billion dollars the first year.

Besides, he didn't give dime one to a single soul for long after he became a multi-billionaire. Last I recall, "tithing" was considered par for philanthropy and this guy is quite a few points below par on that course. Would you really gush thankful if your local millionaire spent twenty years consuming and hording and then sent one kid to college to save his immortal soul? You probably wouldn't even stop to notice. I'd gander most people would do like a waiter receiving an insulting tip and insist he take his stingy excuse for gratuity and shove it where it came from. Bill Gates' "philanthopy" does not exceed that which is merely beneficial from a tax write-off point of view. He's not being generous at all. He simply knows how to do his taxes, which incidentally means for every billion he sends off to his pet projects, the public coffers lose several hundred million dollars. As the wealthiest person on the planet, I think it is fair to expect real generosity and not just good bookkeeping.

He's a robber-baron and should be treated with the respect one worthy of the title deserves.

Oh please, sir, might I have some more?

Not always so catchable...

It's not that hard to deploy a virus and not get caught. There are so many open access points and people who forget to log off of an email account after leaving.. how would you track it?

Re:Not always so catchable...

Hmm not really. Given enough resources and motivation, it is not that daunting a task. With internet being taken into control everywhere and watchdogs sitting, it may not be that difficult.

Ever read the book, "The Silicon Samurai", the cracker in that book was very clever, a master of the art. Still he got caught. Why? Because crackers, virus writers, DDoS organisers have one thing in common. They want fame. They cant sit without leaving clues. History teaches us that the greatest thieves and criminal got caught due to their hunger for fame. This will happen here also. Though i am not to sure if that is a very good thing, coz when such showdowns happen a lot of innocent people suffer.

Re:Not always so catchable...

History teaches us that the greatest thieves and criminal got caught due to their hunger for fame.

History has taught us nothing about the greatest thieves and criminals -- they have never been caught!

Today $250k for turning in Windows virus writers

Tomorrow: $500k reward for writers of Linux or Apple viruses

Well, there logic is (half) right...

Well, ask any doctor and he'll tell you it's better to cure a disease than to treat its symptoms. No virus writers means no viruses, which means no headline news virus alerts and scares.

Of course, the question is how much of the "disease" is the virus writers and how much is Microsoft itself with its sloppy approach to secure computing?

Re:Well, there logic is (half) right...

Well, ask any doctor and he'll tell you it's better to cure a disease than to treat its symptoms. No virus writers means no viruses, which means no headline news virus alerts and scares.

The same doctor will tell you that elimination of all dangerous viruses and bacteria from our environment is impossible.
The best way to fight the diseases is to make our constitution stronger.

The same with software.

Interesting idea

But if Microsoft are going to take this approach, then what about extending it to spammers? Microsoft must spend a hell of a lot more the that $250,000 on hardware, bandwidth and stafff to deal with all the spam going to hotmail accounts, so it could actually save them money.

Or does Microsoft actually make money from spam? I seem to call they were not exactly a staunch supporter of anti-spam legislation recently.

We Need to Stop Equating All Conspiracy Theories

Mind you, some conspiracy theorists also claim that the world is ruled by alien lizards, so I think it's fair to take what they say with a pinch of salt.

Yes, but they aren't the same conspiracy theorists. :-)

On a serious note, folks on slashdot (and indeed, people in general) tend to equate all types of conspiracies (and conspiracy theories) and lump them together...somehow equating Enron with the X-Files, at least until Enron is exposed publicly (then, for some reason, people are able to grasp the difference). This is a real problem, because it means that people will live in denial of real-world conspiracies that are taking place (e.g. Monsanto's conspiracy to dump toxic waste into the rural groundwater of the deep American south in the 1990s, or the current SCO conspiracy to defraud their investors and steal the copyright of thousands of software developers around the world) by dismissing them in their minds as no more likely than alien invasion, UFOs in storage at area 51, or silent black helicopters hovering overhead.

We do know conspiracies exist, therefor, it logically follows that some conspiracy theories are likely to be not out in left field, but rather quite correct.

We know as a matter of historical record that the Nazis conspired to stage a "terrorist" act against the Reichstag as a prelude to a coup d'tate, however, listening to the "conspiracy theorists" of the time would have been like listening to a conspiracy theorist today claiming that 9/11 was staged by Baby Bush (it obviously wasn't ... but it has certainly been exploited in analogous ways by the FBI and the secret service to grab unprecidented power in the United States).

Microsoft has a history of conspiring to do dishonest and disingenuous things that directly (and illegally) harm and coerce their customers and their competitors, indeed, they have been convicted of doing so on numerous occasions (the DOJ anti-trust trial and subsequent sell-out being only the latest example). A conspiracy theorist pointing out a economic or tactical political advantage Microsoft might gain through ill-behavior toward its customers is not out in left field ... their theory, while quite possibly false, is certainly worthy of consideration, particularly given the amount of historical fact that illuminates similiar behavior by Microsoft in the past.

So IMHO it is a mistake (and disingenuous) to equate actions by Microsoft and the copyright cartels that directly threaten our digital freedoms, and the conspiracies that do in fact drive these agendas (even if said conspiracies have the most banal of motivations: greed for cold, hard cash), with tin-foil hats, ghosts, and UFO sightings, as is so often done by the apologists of such groups.

Expressing concern about corporate or government malfeasance (conspired or not) isn't even remotely analogous to X-Files-like nonsense, and it is time we stopped allowing sceptics to use dishonest means (equating suspicion of the Reichstag burning ^H^H^H Microsoft's exploitation of their woeful security record to political advantage, with suspicion of Alien Lizard ruling the earth) to denigrate those who do express such concerns.

Re:Interesting idea

If Microsoft makes it commonplace to pay $250,000 for finding a virus writer, it will go broke soon. After all they only have $50 Billion in cash.

Re:worms = good

Well you clearly didn't get a temp job on a helpdesk a week before the shit hit the fan.

I did >: (

Besides, in business where the sysadmin wasn't a total retard (read: not where I was) there was no way for the worm to get in. The people who needed to patch their systems were the home users who got shafted for not using firewalls. The same people who use Windows because it's not meant to need much setting up . . .

No, worms = bad

This idea is about as retarded as saying that:

- throwing stones through people's windows is good. It encourages them to buy bullet-proof glasses before a real thief breaks through that window.

- lockpicking into someone's house and spray-painting their walls is good. It encourages them to buy better locks, giving a real thief less opportunity to steal stuff.

- poisoning the neighbour's dog is good. It encourages him to get a dog which won't wag its tail when a (potential) thief throws him a piece of meat.

- keying random people's cars is good. It encourages them to park those cars in proper park houses, where presumably a real thief would have a harder time getting away with their car.

And so on, and so forth. I'm sure you get the idea by now.

Basically, no, there is no proper excuse for vandalism. Neither in the proper world, nor in the IT world. And just as any judge would probably just have a laugh if someone pulled the retarded excuse "but the lock wasn't 100% secure, so it's not my fault" in a break-and-enter trial, the same should apply to breaking-and-entering someone's computer.

And if you do go around keying cars or flooding the net with RPC exploit packets, no matter how well intentioned you are, I do hope they throw you in a nice jail cell, with two convicted anal rapists as cell-mates. Yes, that same heartfelt wish goes to whoever thought that an RPC patching worm is a good idea.

Here's an idea..

they should invest the 250000 into their security team and fix the vulnerabilities instead of chasing after 13 year olds

Brilliant move

No intention to troll, but I honestly think that this decision is brilliant. Software to which you are only granted a license to use, still belongs to Microsoft at the end of the day. To some degree a virus wrecking havoc amongst computer using their software can be seen like if somebody was vandalizing your property. If that was the case and you wanted to catch them, why not put a bounty on their head ? Seems logical to me, if you can afford someone to do it for you.

Certainly the government has been doing so for a while, considering the various bounties for information leading to the arrest of international criminals and terrorists. Maybe corporation joining the bandwagon to do the same is the next good thing..

And remember, MS has ~ $50BN in case, so it isn't a big deal to them to put the money where their mouth is. In fact, $250K is rather cheap considering how much bad PR they got recently due to the attacks (that must have cost them $BN's in lost revenue from customers switching), so imho they cound't hope for a better use of the same amount if they tried to make up for the negative publicity some other way.

Re:Brilliant move

To some degree a virus wrecking havoc amongst computer using their software can be seen like if somebody was vandalizing your property.

Oops! Be careful with that. Compare the MS business process with real life, and you might raise the specter of product liability.

..and the state and corporations move another inch

...closer together.

Later in the same press conference, newly appointed Communications Secretary William Gates III announced that sale of all software in the United States will cease Monday, to be replaced by a Federally subsidised regime of nationally distributed software based on a uniform technology. In response to questions Mr. Gates indicated that the vendor supplying the software had not yet been selected, before laughing maniacally.

Why People Bash Microsoft

Slightly off-topic, but related to what you said, this is part of a recent journal entry [slashdot.org] I made.

I don't think most people who bash Microsoft really know, cognitively, why they do it. But there is a social dynamic in effect that causes people to resent, and therefore attack, what they cannot quite understand.

Most people imagine that the United States is a democracy. Others will correct them and say, no, it is a republic. Both of these are really a statement of expectation, not actual fact.

The US is in truth a plutocracy. Firstly, the freedom of the press is only truly open to those who can afford to publish. The emergence of mass media in the 20th century further centralized the primary means of communication in a small number of corporate hands. That person or corporation with the most power, in economic terms, can "speak" with the greatest volume.

The Internet has lowered the barrier to communication, and is the leading edge of the revolution (see, it's not being televised, is it?) in terms of giving a greater and increasing voice to those with the greatest persuasiveness, rather than those with the most financial means to promote their message. What will hopefully emerge from this process is a totally new form of government, a meritocracy. In my opinion, music will be the greatest power. Some might suggest pornography will rule. Much of what goes for popular music today (given current media) is some combination of the two.

In the meantime, and returning to the subject of this journal entry, the company with the greatest financial clout in the world right now is Microsoft. Moreover, the company is controlled in large part by a single man, William Gates III. What he says Microsoft will publish, they will publish. When he wants to back a candidate for office, he can ensure that candidate will have the full power of the press behind him.

I am not trying to say that Gates is a bad man, only that he is a man who controls the largest share of the liquid assets which confer power. There are many other wealthy individuals and families, some of whom probably resent Gates. His power is counterbalanced by the old money still very capable of exercising their power.

If my thesis is right, and this is a plutocratic system, then Gates is nominally the king, with no hereditary right of succession as such, unless he can prolong his wealth into the next generation.

Thus the GNU project, and associated free software and open source projects, originally aimed at AT&T, has become a loaded gun pointed at the king himself.