Tired of Playing Cyber Cop, Microsoft Looks For Partners In Crime Fighting 113
chicksdaddy writes: When it comes to fighting cybercrime, few companies can claim to have done as much as Redmond, Washington-based Microsoft, which spent the last five years as the Internet's Dirty Harry: using its size, legal muscle and wealth to single-handedly take down cyber criminal networks from Citadel, to Zeus to the recent seizure of servers belonging to the (shady) managed DNS provider NO-IP. The company's aggressive posture towards cyber crime outfits and the companies that enable them has earned it praise, but also criticism. That was the case last week after legitimate customers of NO-IP alleged that Microsoft's unilateral action had disrupted their business. There's evidence that those criticisms are hitting home – and that Microsoft may be growing weary of its role as judge, jury and executioner of online scams. Microsoft Senior Program Manager Holly Stewart gave a sober assessment of the software industry's fight against cyber criminal groups and other malicious actors. Speaking to a gathering of cyber security experts and investigators at the 26th annual FIRST Conference in Boston, she said that the company has doubts about the long term effectiveness of its botnet and malware takedowns.
need to crack down on the russian government and o (Score:1)
need to crack down on the Russian government and others who just about look the other way.
Re: (Score:2, Insightful)
what about the NSA? How much of this "cyber crime" is related to government monitoring. I like how the focus shifts to Russia and China at a time when the US is being criticized/ignored for leading an international spying ring! How much malware has hit the internet lead by governments working together, until its caught in the wild then they all blame each other or some group as the cause?
That's the real problem anymore, no one knows who is responsible for half the shit going on. Even better you can set-up f
Re: (Score:1)
need to crack down on the Russian government
The Russian government? How about assigning responsibility where it belongs?
TFA is pure revisionist propaganda on the scale of editing Trotsky out of of pictures with Stalin. In reality, TFA should start:
When it comes to enabling cybercrime, few companies can claim to have done as much as Redmond, Washington-based Microsoft,
Plenty of us remember how fragile and colander-like most Microsoft OSs have been until VERY recently.
Re: Enabling software (Score:1)
Apparently it's forbidden Here to say anything bad about MS, but still. It is cause of monopoly that we have these problems. In healthy market it would BE difficult to take control of many machines when there would be many platforms.
Now media only mentions when MS uses it's Monopoly to take down those bots it has enabled.
It's Microsoft's fault (Score:1, Troll)
If Microsoft hadn't built such insecure operating systems, the problem wouldn't be so big. This is the company that brought you Active-X, autorun, and the ability to invoke programs from spreadsheets and documents.
Re: (Score:1, Interesting)
If the operating system is secure, criminals exploit the users instead. And if Microsoft had built a secure operating system in 2001 instead of spending the decade of the 2000s patching their vulnerabilities, there would have been fewer viruses and worms and more phishing and social engineering, exactly like the situation is now. Go back to the 1990s and take your irrational hatred of Microsoft with you, troll.
Re:It's Microsoft's fault (Score:5, Interesting)
If the operating system is secure, criminals exploit the users instead.
Nonsense. There is not a fixed quota of crime in the world. Criminals exploit profitable opportunities, and more opportunities mean more crime, while fewer opportunities mean less crime. A secure operating system does not "push" people into phishing. Writing a virus and social engineering don't even use the same skill sets.
Re: (Score:2)
Nonsense. There is not a fixed quota of crime in the world. Criminals exploit profitable opportunities, and more opportunities mean more crime, while fewer opportunities mean less crime. A secure operating system does not "push" people into phishing. Writing a virus and social engineering don't even use the same skill sets.
At first blush, I thought that I agreed with you. A moment of thought brought some nagging doubts to my mind...
Crime does not occur simply because there is opportunity. There are plenty of opportunities for crime that are never taken. Yes, opportunity does play a, significant I believe, role, but it is not a determining factor except that if there is no opportunity, there is no crime.
Whatever drives the need or desire for crime is the thing that makes criminals look for opportunities. Increasing the need or
Re: (Score:2)
If there was more diversity among the systems being used, then even social engineering attacks would be harder... Whats the point trying to trick someone into running a program, if the system theyre using isnt capable of running it?
Re: (Score:1, Insightful)
This is the company that brought you Active-X, autorun, and the ability to invoke programs from spreadsheets and documents.
This can't be emphasised enough. Before Outlook, there was a scam/joke which claimed that there were emails spreading viruses. Nobody could be stupid enough to execute the contents of an email. Microsoft realised that, at the cost of the security of their users, they could make something easier. They looked at a choice that everybody else had knowingly and clearly made the other way for the good of their own users and were the only company unethical enough to make the choice in the other direction.
The s
Re: (Score:2)
The problem is policing agencies have been left way behind and are still just barely catching up. This creates a problem private corporations have the computer skill but lack the legal propriety to conduct the policing role and shouldn't really be trusted with it as competitive pressure will not allow the impartial application of the policing role. Police agencies are woefully lacking in the skills, going so far as to actively avoid hiring the people that would be most useful in that role. It's likely that
Re: It's Microsoft's fault (Score:1)
Re: (Score:1)
What's with all the services hiding under svchost.exe anyways?
They're not hiding.
tasklist /svc
Sorry to dispel your ignorance.
If I didn't know better, I might ask what's with all those daemons hiding behind xinetd? But I do know better.
Hmm...
C:\Windows\system32>tasklist /svc | grep svchost
'grep' is not recognized as an internal or external command, operable program or batch file.
DAMMIT!!
Re: (Score:1)
Perhaps we could all get together and form some kind of group, call it something like Software Protection For Kittens and Children, and then this group could be responsible for doing stupid things like taking domain names from companies and then botching handling it before handing it back.
This way, the blame for stupidity won't be squarely placed one specifically stupid company, instead, it will be spread on the entire software industry. Of course, it'll still be the one company doing the stupidity.
Re: (Score:1)
Metonymy as a rhetorical device has been used since ancient times. Get used to it.
Partners in crime fighting (Score:3)
dinner, dinner, dinner, dinner, dinner, dinner, dinner, dinner,
Batman
re:cautiously pessimistic (Score:2)
ed
Re: (Score:2)
sounds to me like we need develop more user friendly distributed anonamous internet tools. while the tools we have work when used they are not user freindly and often have horrible documentation. We need a suit of tools to fix the internet to stop corporate/government control over the web. include tor freenet i2p namecoin & bitcoin, retroshare and pgp. encrypt everything end to end and make domain hijacking impossible.
Summary should say ... (Score:3, Insightful)
Few companies can claim to have done as much fighting - or feeding - cybercrime.
There, fixed that for you.
no-ip is shady? (Score:1)
recent seizure of servers belonging to the (shady) managed DNS provider NO-IP
That's blatantly libelous journalism right there.
Re: (Score:1)
Slashdot.... journalists? Hehe... re... Hahahaha....really? Did you *laughs uncontrollably* really call Slashdot.... journalists?
Hold on, I might just pass out from laughing so hard, rolling on the floor...
Re: (Score:1)
TFA calls NO-IP shady. ITworld aren't journalists either, apparently.
Re: (Score:2)
TFA calls NO-IP shady. ITworld aren't journalists either, apparently.
The whole summary reads like propaganda.
"fighting cybercrime ... the Internet's Dirty Harry ... single-handedly take down cyber criminal networks ... the (shady) NO-IP ... "
And, of course, along with being the big, bad, good-guy cop, some "alleged" that their business was disrupted. Poor old Microsoft is "weary" of its role.
Re: (Score:2)
Solutions (Score:1)
1. Make email White-list based (with a choice to opt out), That will kill spam
2. Allow people to "lock" their machines so they will only download from curated sites., That will severely hurt malware sites.
3. Allow web browsers to 'block' sites/IPs on a per country basis, e.g. all of Ukraine, Russia,China,Brazil, etc, that will kill the redirect bots
4. Allow countries to place Tariffs on imported goods from countries that do not take positive action against cybercrime, nothing inspires politicians like a los
Re: (Score:2)
Police (Score:1)
So in America, Microsoft polices the internet. Who polices in real life? McDonalds? Disney?
Re: (Score:1)
Dunkin Donuts.
No-ip isn't shady (Score:5, Insightful)
I've used No-ip for non-mission-critical dynamic IP services and for domain registration for over 10 years. There's nothing "shady" about them.
They offer a free service that is sometimes exploited by criminals and are very responsive to reports of abuse.
Microsoft not only didn't report these criminals to no-ip- they actually sealed the court order so they could seize the domains before no-ip found out about it.
It boggles my mind that a vigilante corporation can get a court order to simply seize another companies assets.
Re: (Score:2)
Microsoft compounded the problem by having a DNS infrastructure that completely failed to resolve the subdomains that were not implicated in any botnet use.
Perhaps the core problem was rate limiting by No-IP, but Microsoft should have anticipated this.
Re: (Score:2)
Yeah, it will go down a little smoother when it is Microsoft, Sun, Google, and Facebook working together. I mean, it's easy to bash MS, but when it is team of industry titans, everything will run much, much smoother. Yeah.
Re: (Score:1)
I've used No-ip for non-mission-critical dynamic IP services and for domain registration for over 10 years. There's nothing "shady" about them.
They offer a free service that is sometimes exploited by criminals and are very responsive to reports of abuse.
Microsoft not only didn't report these criminals to no-ip- they actually sealed the court order so they could seize the domains before no-ip found out about it.
It boggles my mind that a vigilante corporation can get a court order to simply seize another companies assets.
Apparently 6,000 to 8,000 sub-domains were being created each month on domains controlled by no-ip, just to support botnets.
no-ip insisted that the only way to report these sub-domains was through a manual reporting system on their website. This meant that the botnets could operate with impunity. Contrary to your statement, a number of organizations such as Microsoft, Cisco and the EFF had contacted no-ip and suggested methods to automate the process. no-ip did publicly acknowledge the issue but they did
Re: (Score:2, Insightful)
So in both things you link they state they rely on people informing them. So instead of informing them microsoft got a court order, without even talking to no-ip. And no-ip is supposed to look bad, how? It's obvious you are a shill for microsoft, you didn't have to actually admit it in the post.
Re:No-ip isn't shady (Score:5, Insightful)
hotmail has been known to send a lot of spam. I hope someone takes control of hotmail domain, since microsoft is unable to police it. (Note that it has recently been brought down, by someone should have taken control of their domain when it was a serious problem).
The point is a free service being abused is expected. It is not as if noip encouraged abuse and were paid by abusers.
Re: (Score:2)
The point is a free service being abused is expected. It is not as if noip encouraged abuse and were paid by abusers.
Expected: That the owners of no-ip should continue to make their own profits from advertising revenue, and a bunch of legitimate users should continue to get free dyndns service, and the benefit to these two groups comes at the expense of a wider pool of internet users who suffer from malware (and at the expense of unpaid volunteers to police no-ip since they're not spending enough resources to do it effectively themselves).
Does that sound like a fair trade to you? Not to me. Count me out.
In other news (Score:5, Insightful)
In other news, Google is the most popular site for finding <your choice of illegal material here>.
See what I did there? And how the reports of NO-IP's use for malicious software are meaningless?
Re: (Score:1, Troll)
Re: (Score:2)
What percentage of their total hosted IPs are illegal or malware?
Sounds to me like the old "Windows has more viruses because its more popular" argument, used against NO-IP.
Re: (Score:2)
They can sound hurt all they want that OpenDNS and Cisco and Microsoft wrote public blogs or took action rather than reporting the individual offenders to No-IP first.
Really? What about all their legitimate customers? Just "collateral damage", all worth the cost? Most of their customers use their free services, they only have a staff of *12* people. Of COURSE they want help getting reports of abuse. And the *DO* respond to those quickly and appropriately.
What Microsoft did was unconscionable. It's like some vigilantes wanted to put an end to shootings in South Side Chicago, but instead of reporting all the shooters to police, they just decided to set off a nuke in
Re: (Score:1)
no-ip was the second most popular dynamic-DNS site for malicious software
How popular are they overall as a DDNS provider, and how many legit VS malicious customers do they have? It may sound big if they've got 1,000,000 malicious DDNS sites, but not so much if it turns out that's less than half a percent portion of 10,000,000,000 overall sites and the rest are legit.
"fighting" crime? (Score:1)
Using Microsoft's tools to fight cybercrime is bringing a knife to a gunfight.
Re: (Score:3)
Re: (Score:2)
...only if you consider that stubby, broken off plastic thing they are waving around a 'knife'
MS knows about crime (Score:1)
After all, it's been found to be a criminal organization more than once in a court of law.
So they're gonna crack down (Score:3, Interesting)
all the holes in Windows and commercial software that allow so many criminals to profit from the security holes?
Re: (Score:2)
Microsoft may be growing weary of its role as judge, jury and executioner of online scams.
I personally thought it meant they were getting tired of pushing Windows 8 as an upgrade path.
Re: (Score:2)
If the software becomes a big part making machines function then yes even OSS should be liable.
Re: (Score:1, Informative)
Re: (Score:2)
Bad programming (Score:5, Insightful)
Microsoft has been writing poor quality software for my entire life.
The best programmers do not go to work for Microsoft. Maybe that was the case in the early 90's but it hasn't been true for decades.
To make matters worse, Microsoft does a lot of its programming in India. We all know that Indian programming is of poor quality, and the reason is not because Indian programmers are much less competent. It has more to do with the fact that in programming if two parties can't communicate completely unambiguously in one language then they have no hope of writing good software. Programmers have to be more than fluent in the language they speak with each other, they have to be scientifically precise.
People go to work for Microsoft because it's safe. There's no risk of the company going under. Risk minimizers don't write good software, because they're not very creative. They tend to keep patching up the same old crap rather than writing something new that works better.
At mature software companies hundreds of non-programmers are telling the programmers what to do, and it only gums up the works. You wind up not working efficiently, because you need too much sign off to get anything done. And once you get signoff, the hundreds of non-programmers are dictating your schedule, not quality of the code or whether it is completed to your satisfaction.
There is no one to clean up Microsoft's mess but themselves. Probably the best solution would be for the company to split up. The people who make the Xbox are probably weighed down by the rest of the company's ineptitude. I'd like to see those guys go their own way.
Re: (Score:3, Insightful)
How much is 'a lot'? What %?
So that's a problem only with Indians? Not Chinese? Australians? Romanians? Turks? Russians? Nigerians?
If you hire those who can c
Re: (Score:1, Insightful)
Re: (Score:2)
The original Microsoft BASIC was quite good.
Re: (Score:2)
I was pretty aware of the art of the day. I don't know exactly what Kemeny and Kurtz were thinking when they first made BASIC, but after that it was used a lot for working code. (If they didn't intend it for working code, why the array operators?) Most software for the earliest home computers, such as the Apple II, Commodore Pet, and TRS-80, was written in BASIC. The main alternative was assembly language, and I assure you BASIC was a heck of a lot easier to write and debug than Z80 assembly (I never d
Re: (Score:2)
"Probably the best solution would be for the company to split up. The people who make the Xbox are probably weighed down by the rest of the company's ineptitude. I'd like to see those guys go their own way"
XBOX is running a version of Windows, which, is in many ways better than Linux. What's up for debate is its openness or lack thereof, but featureswise, Windows has lead Unix in a lot of ways.
Even Windows 3.1 had a better device independent rendering model than did the X terminals it competed against. An
Re: (Score:1)
Re: (Score:1)
Re: (Score:1)
"At mature software companies hundreds of non-programmers are telling the programmers what to do, and it only gums up the works. "
And the other option is.... Linux! Where the programmers design everything with no consideration of what non-programmers want/need. LOL! [fyi Linux is unusable for anybody who is not a programmer].
What's with the scare brackets? (Score:2)
Re: (Score:2)
Hey, somebody else fix our products for us! (Score:1)
Only a part of the headline is correct... (Score:1)
Microsoft Looks For Partners In Crime
Re: (Score:2)
You could have a secure sandpit and memory on consumer computers at a huge cost in cash and GUI slowness.
Speed to market for 1.0, GUI look and feel, security, costs, speed to market with new features vs security.
Helping the police and security services without slowing down the dev and release cycle.
The hardware was just too costly and slow at the consumer level vs a responsive, secure, feature rich software
When it comes to fighting cybercrime .. (Score:3, Insightful)
Despite how much effort Microsoft retrospectively put into trying to change the historical facts. When it comes to causing cybercrime, few companies can claim to have done as much damage as Redmond, Washington-based Microsoft.
"Windows NT and its successors
Partner in Cybercrime (Prevention) (Score:2)
Nobody asked you to play cyberpolice - you took that upon yourselves in an attempt to make yourselves look better after being the laughingstock of security experts for several decades. Lately you've been overstepping your bounds and now you're looking for other companies to join you so that you don't have to take all of the heat the next time you overstep your bounds. Good luck with that.
How about an anti-NSA? (Score:2)