Slashdot Log In
The 'Malware Economy' Evolves
Posted by
Zonk
on Fri Dec 14, 2007 12:23 PM
from the when-blackmail-is-business dept.
from the when-blackmail-is-business dept.
superglaze writes "ZDNet UK has a feature on how the malware economy is turning into a recognizable traditional IT economy. Leasing botnets? Malware support? Welcome to the new age of computing. As the piece suggests, it's all gone Darwinian. 'One indication of the maturity of the black economy, according to Telafici, was the recent case of a hacker who wrote a packer [software used to bypass antivirus protection], "threw in the towel recently as it wasn't profitable enough -- there's too much competition. They opened the source code and walked away."'"
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
This shouldn't have surprised anyone (Score:4, Informative)
So now when we see yet another article discussing the money that is made in malware, particularly the botnets that drive spammers, there's no reason why anyone should find this surprising.
Re: (Score:2)
Re: (Score:2)
It's all the economy of the threat escalation / threat deterrence software industry.
Re:This shouldn't have surprised anyone (Score:4, Funny)
Parent
Open source malware? (Score:2, Insightful)
Re: (Score:2)
This article is right on the tail of a post on Schneier's blog about Chinese kids winning hacking prizes.. funded by the PLA.. [schneier.com]
Hackers in the USA shouldn't be put out of business, they should be 'recruited' into cushy salaried jobs working for the Govt... One day they'll be the ones we HAVE to trust to defend us from attack.
Only high profit crime (Score:4, Interesting)
Re:Only high profit crime (Score:5, Insightful)
Like Patent trolling, DRM, or WGA.
Parent
When prey is plentiful... (Score:2)
Malware and ex-emailer (Score:5, Insightful)
I keep getting spam traffic from her that is reassigned from a myriad of outlook express ex-emailers. I have told her that she will have to get her OS reinstalled but she just won't listen. I am afraid that the windows OS and the Microsoft way of computing has done little more than create a shit load of computer using zombies and little old ladies (like my aunt) who in blissful ignorance just keep up the status quo. The result of this blissful ignorance is that bot nets have become almost impossible to kill.
Re:Malware and ex-emailer (Score:5, Interesting)
We have a license for everything. You need a license to drive, to prove you're able to steer a car without causing a problem. We (at least here) need a license for a gun, so you prove you're not just some maniac who wants to kill his wife's sisters. But even for "non-lethal" things like some jobs you need to prove you're able to handle what's put into your hands sufficiently professionally that you don't cause harm to anyone else.
Now, I wouldn't really want a "driving license" for computers, but I'd very much enjoy seeing people taking some more responsibility for their computers and what they do to others on the internet. As we see now, this has become an economic problem. We waste a lot of bandwidth and work hours fighting spam, we have the sword of a DDoS looming over our heads due to botnets ready to strike, and it all boils down to people using rooted boxes and not even knowing it.
Before you start crying about your freedom to use the net, be aware that sooner or later our legislators WILL react. They have to, the pressure from the industry is already tangible. And in our current environment, the result is very likely not one where people get better educated and more responsibility, instead we'll probably see laws regulating what kinds of machines you may attach to the net (and the accompanying locking of "insecure" machines from participation), and we know the current definition of "secure". It will pretty much lead to machines so heavily DRMed that Vista looks like open source compared to it.
So either we start pushing towards more personal responsibility or we'll have something dumped on us that is the maybe least favorable alternative. Because the industry WILL start lobbying for protection from those rooted machines. And they don't care if you can use your computer for anything but playing prepared content. Actually, some would definitly like that.
Parent
Re:Malware and ex-emailer (Score:4, Funny)
Parent
Re: (Score:2)
To create "secure" software, approved to be run in a tightly closed DRMified system, you'll need the "seal of approval" from some authority. That way you can avoid two "problems". First of all, the obivous one, malware. You can't get malware certified. But also software some companies would not want to exist. For example, software that lets you circumvent copy protection mechanisms.
And here's where the problem lies: People DO want
Re: (Score:3, Interesting)
Re:Malware and ex-emailer (Score:4, Funny)
Parent
Re: (Score:2)
Re:Malware and ex-emailer (Score:5, Funny)
Your post advocates a
( ) technical (X) legislative ( ) market-based ( ) vigilante
approach to fighting spam.
Furthermore, your approach appears to require a level of international cooperation akin to
( ) Passing a meaningless UN resolution
( ) Negotiating a world wide free trade agreement
( ) private, i.e., commercial and civil, law
( ) Banning land mines
( ) Adding a permanent member to the UN Security Council
( ) Achieved balanced copyright reform
( ) Censuring Cowboy Neal
(X) Doing anything truly useful about climate change
( ) Eliminating Britney Spears
Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from jurisdiction to jurisdiction before a useful treaty can be negotiated.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
(X) It will stop spam for two weeks and then we'll be stuck with it
(X) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
(X) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business
Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
(X) Lack of centrally controlling authority for email
(X) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(X) Asshats
(X) Jurisdictional problems
(X) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
(X) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
(X) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
(X) Technically illiterate politicians
(X) Extreme stupidity on the part of people who do business with spammers
(X) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook
and the following philosophical objections may also apply:
(X) Ideas similar to yours are easy to come up with, yet none have ever been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
(X) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
(X) Countermeasures must work if phased in gradually
( ) Sending email should be free
(X) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
(X) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough
Furthermore, this is what I think about you:
( ) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your house down!
(X) uh, come to think of it, I have no particular opinion of you nor any desire to form one.
Parent
Re: (Score:2)
But Homer Simpson DID get a gun, remember?
Re: (Score:2)
See? The system works!
Re: (Score:2)
Re: (Score:2)
Not to mention that with some company controling the net, they can invariably decide who may create what kind of content, who may provide what service and, in a way, who may comp
Re: (Score:2)
So would I! (Hope the following makes sense, as I'm high on cold medicine.) This would require some education. Unfortunately, from what I've seen, all they are teaching kids in school about computers is typing and how to search online; the teens I've talked to don't even know what Unix is. I don't mean to sound se
Re: (Score:2)
They also tell them that filesharing is evil and bad and only criminals do it. So much for learning to share...
But I digress. I guess you're aware what such a "quiz" would look like if you leave it in the hands of the software manufacturers. We'd get quizzes that show off the new features of some product and how much better it is than anything there was or anything the competitors push out, with the mandated "push here to be
Re: (Score:2)
It happens all the time. Gullible
Re: (Score:2)
I don't think so. A government-mandated signature system would probably rather use PKI. Your key would need a(n expensive) signature from Verisign or another "trusted" signer. That would also scare away hobby programmers, and leave programming an exclusive domain of major companies, which we all know never make mistakes, and when they do, they can afford a few millions in fines.
Re:Malware and ex-emailer (Score:5, Interesting)
Parent
they raise billion dollars from IPO (Score:2, Funny)
such as Alibaba.com, a chinese company, well known for the malware 3721, can even make IPO for more than 1.3 billon dollars.
that's why it is called "Historic IPO"
No shortage of idiots (Score:3, Interesting)
I don't get it. One of the most popular uses for a botnet, according to the article, is for spam mailings. But how can spammers afford to pay any significant amount of money for the service? I understand that they're mailing out to millions of people and count on a high level of rejection, but how many people are stupid enough to open something that says, "5PL1t H3R 1n HALF WYTH YORE HUGE ORGAN"? Let's face it, half the population is female, and probably not interested (unless they're buying for their boyfriend, and wouldn't THAT be a kick-ass Christmas present); a majority of the male half of the population are probably reasonably satisfied with their equipment; and even a vast majority of those poor, pathetic guys who actually have "AY tiney Pinnus That You GIrflrend Lauff at" probably have an IQ in at least the high double digits (I mean, they figured out how to turn on a computer and collect their e-mail, at least). So they probably wouldn't open that message either.
And then there's the spam filters, which are getting pretty good these days.
So that leaves what percentage of the population stupid enough to open one of these things and infect their computers with something vile? And if they're that stupid, how likely is it that they have a bank account worth looting? Or that they haven't been hit before so often they just sign their paycheque over to the spammers automatically and save everybody a lot of trouble?
Help. Somebody please explain it all to me.
Re: (Score:2)
I believe because it doesn't require that many bots to send a bajillion emails, and even if the response rate is 0.000001, they still make money.
Put it another way - since spam is the major driver of botnets, the price of botnet rental will drop such that it's profitable for the spammers to use them, or spammers will use something else.
The real money in spam? Selling to spammers (Score:5, Interesting)
It's been said before, probably better than I can: The "mark" in the spam economy is NOT the person receiving the email. The "mark" is the person foolish enough to buy the Spam-in-a-box kit thinking they will be able to get a single person to buy their w0tches or v1agra. The money in spam is made not from the person foolish enough to buy the w0tches. The money is made in selling the service to spam millions of people.
Parent
Re: (Score:2)
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Help. Somebody please explain it all to me.
It's just arithmetic. Lets say...
A bottle of V|4GR4 costs me £1.99 and sells for £9.99
It takes 2 seconds to mail a spam mail.
My broadband costs £14.99 per month.
I basically need to make 3 sales per month to make a profit.
There are 2592000 seconds in a month, it takes 2s to send each mail, that's 1.3 million spam mails.
Only 0.0002% of the population mailed to need buy a bottle of V|4GR4 to make a profit.
50% of the population have an IQ of 100 or lower. Basically I'm on to a winner.
Re: (Score:2, Funny)
Re: (Score:2)
Simple. Most of those spam mailings for pharmaceuticals are simply affiliates of shady sites, earning a percentage of the take by people they "refer". If you make 10% of an average order of $150, that's $15 per customer. If you can send 50MM messages and convert
Simply put, unless and until p
Re: (Score:2)
I understand that they're mailing out to millions of people and count on a high level of rejection, but how many people are stupid enough to open something that says, "5PL1t H3R 1n HALF WYTH YORE HUGE ORGAN"?
According to this [news.com] CNet article from 2004 the volume of email in North America alone was 31 Billion messages each day, approximately 90% of email is spam.
So that is 27.9 Billion spam messages a day (in 2004). Let's be forgiving and say that only 5% of spam gets through filtering. That is 1.395 Billion spam messages a day get through to the inbox. If only 1 in 100,000 people responded that would still be over 10,000 responses daily. And these are the numbers from 2004.
So that leaves what percentage of the population stupid enough to open one of these things and infect their computers with something vile?
Um the vast majority of people wh
Re: (Score:2)
Utility Computing (Score:4, Interesting)
No kidding :-) I said in a public forum about 4 years ago that botnets are the first and only successful example of commercial utility computing [wikipedia.org], where a vendor tries to rent out time on large compute clusters.
This works much better for botnet vendors than for Amazon EC2 or HP Utility Data Center, because the really valuable resource the botnets are renting is a routable IP address that hasn't been shut down yet. Computers are nearly free, but IP addresses that work are not.
Malware is closed-source (Score:3, Funny)
Re: (Score:2)
Mature IT industry, eh? (Score:2)
Here's the actual paper. (Score:5, Interesting)
Here's the actual paper from which came most of the material in the article: "The Commercial Malware Industry" [auckland.ac.nz], from the University of Auckland. More technical details.
New threats of interest:
Kind of like open source copy protection? (Score:2)
I'm sure all the AV guys have already grabbed a copy of that packer and are totally on top of it.
Some day may all spammers.... (Score:2)
Re:Oblig.. (Score:5, Funny)
Parent
Re: (Score:2, Troll)
Crackers can be hackers but usually script kiddies (Score:2)
These days there's enough division of labor that the hackers who develop malware aren't the people who run most of it. Sometimes the hackers are individual shops, and sometimes they're working for mafiya guys, and there's enough volume out there that hand-crafted malware isn't as necessary. For instance, if you
Hacker v Cracker (Score:2)
Please look at the definition of hack [catb.org] and how it's different from cracking [catb.org]
For those who hate reading: A hack is pretty much a clever trick. A crack is something that does all that security breaking stuff.
Re: (Score:2)
Re: (Score:2)
If you were the one who did the original breaking and figured everything out.
If you're some kind of script kiddie using said programatic ingenuity without any comprehension or understanding, you are most definitely not a hacker.
Crackers are the Bards making "Use Magic Device" checks. Hackers are the Wizards with ranks in "Craft Wondrous Item." Oh wait, that didn't involve cars...