Hugh Pickens writes "Business Week reports that security experts plan to recruit victims and other computer users to help them go on the offensive and hunt down hackers. '"It's time to stop building burglar alarms to keep people out and go after the bad guys," says Rowan Trollope, senior vice-president for consumer products at Symantec, the largest maker of antivirus software. Symantec will ask customers to opt in to a program that will collect data about attempted computer intrusions and then forward the information to authorities. Symantec will also begin posting the FBI's top 10 hackers and their schemes on its Web site, where customers go for software updates and next year the company will begin offering cash bounties for information leading to an arrest. The strategy has its risks as hackers who find novices on their trail may trash their computers or steal their identities as punishment. Citizen hunters could also become cybervigilantes and harm bystanders as they pursue criminals but Symantec is betting customers won't mind being disrupted if they can help snare the bad guys. "I'm convinced we can clean up the Internet in 10 years if we can peel away the dirt and show people the threats they're facing," says Trollope.'"
How many of these scams and hack originate in the US anyway? Will their customers really have information to share?
Lots actually. If I wanted to hack you my first step is to hack someone in a country where their police can't be bothered to look nor cooperate. Next, I launch the attack on the local USA target using the foreign system as a proxy. Some who do this even work for the same company. I have no way of qualifying this, but I am sure it is a major constituent of "foreign" hack jobs.
More sophisticated hackers might use 2 or more proxies making it a real PITA to chase them. But sloppy ones with savvy security t
Not sure that this is as much fun as the summary makes it out to be. I doubt that grandma will be slushing through routing tables or reading through log files to detect the source, but instead the next version of symantec's products will say "You've been pwned! Please provide ALL information to us, including data stolen, connection attempts, and your underwear sizes." and grandma will click "Send" and symantec will have more information to track down cyber-criminals.
The example in the article is even misleading, since it was a Facebook account that was hacked, who knows if the hackers ever touched the system of the user. He may have just used the same password too many places. I'd assume Facebook isn't using Norton Internet Security, so I'm kind of wondering what cases this will really make a difference in. Most worms/viruses even don't come from the creator's PC, but infected zombies.
Hey, so this is like those cure-cancer protein folding things, or like the original find-an-alien-civilization SETI project, except where it's recruiting people to become cyber vigilantes with their spare computing cycles. Awesome! I want to get my computer infected just so my employer's favorite documents can be snagged AND my daughter's school project can be shredded AND I can be implicated in a giant DDoS zombienet counter-attack scandal too. Sign me up!
-- The data sent to Symantec will contain following information:
-- Name: Grandma
-- Data stolen: pictures of cats
-- Underwear size: enormous
-- Thank you for your support.
I think, ultimately, that the internet will never be cleaned up. It is very idealistic to think there are a finite number of hackers and that their methods will not become more and more sophisticated as time goes by.
The kind of "cleaned up" internet that these companies talk about requires STRICT regulation and STRICT monitoring. It is very apparent, from just the audience that posts on Slashdot, that regulation is the exact opposite of what people want.
As far as the approach, the idea of a proactive anti-virus is novel, but I think the idea of recruiting novices to help hunt expert hackers is ludicrous. All it would take is a couple of reprisals from the hackers to permanently deter the said novice from going after a hacker.
Don't know what country you live in, but around here, the only reason people tolerate hackers is because they don't really do anything. If crackers start doing reprisals (what are they going to do, reformat the hard drive? Send a hitman?), it's only going to make people angry. Despite what idiocracy fans might think, people aren't like sheep, and if you try abusing them, it only makes them mad and want to punish you back. A couple reprisals aren't going to deter novices any more than a couple arrests are going to deter crackers, or a couple executions are going to deter murderers. If punishment were a real deterrent, then the fight between Israel and Palestine would be over, because Israel has punished Palestine a lot. Instead, you get things like this [wikipedia.org], where Palestine knows they can never beat Israel, but they are willing to hurt them however they can, even if it means they will be stepped on.
Sorry to bring politics into it, but it's a good example.
While you are arguing semantics (symantecs, lol) between hackers and crackers, I think you strongly, strongly overestimate the ability of the general populace to rise to this specific occasion.
Technology has developed at such an accelerated rate that there are few, at the least, who really know how things work. I think I've stated this before in another article, but to most people, computers are virtually magic. The level of understanding and specific knowledge required to do so is so in-depth that really
Same here. Every few months I download a few of the latest free AVs and ASWs, run them and then wipe them. In over five years the only thing any of them has found is suspicious cookies.
Citizen hunters could also become cybervigilantes and harm bystanders as they pursue criminals but Symantec is betting customers won't mind being disrupted if they can help snare the bad guys.
Hah. You think Joe and Judy are going to be concerned about the big picture when they are trying to order Suzie's birthday party invitations and can't? The big picture is nice and all, but to expect people to act reasonably is, in my experience, a recipe for disappointment.
While it is pretty meaningless to go after spammers themselves in many cases, we could use a similar approach to cut off spammers where it really matters - at the revenue stream. If we made some strategic purchases from spamvertised sites, we could potentially figure out who is making money in the deal. And when we find them, we will find who is funding the spammers. After all, spam isn't sent out just for fun; it is sent out because someone is paying the spammers to send it out. You can use the merchant information to go after the people who are paying for spamvertising - they are often involved in illegal sales of (pirated software / counterfeit drugs / counterfeit property) anyways. If the funding dries up, the spammers will need to find other work.
I'm convinced we can clean up the Internet in 10 years...
Bwahahahahahahahahahahahahahahahahahahahaha!!!
Oh gawd, that's rich. One of the funniest jokes I've read in a long time. Hysterical. Hopefully I'll see this guy at next year's Montreal Comedy Festival. Awesome comedian!
How do people like that get into the position of VP of anything? A bold statement that indicates such a complete and utter lack of possibility... Unreal.
As long as an ISP values their customer's privacy and rights to step on other people more than they value the integrity of the Internet, we are going to have problems.
Right now, it is not illegal, wrong, immoral or forbidden to have a computer owned by a botnet. This means that if my computer at home is infected nothing will stop it from doing whatever its little botnet commander wants it to do. And my ISP will not do anything to prevent or deter this computer from stepping on the rights of others in any way possible.
Similarly, if your computer is intruded upon and you find an IP address that has been used to vandalize your computer, good luck. The ISP owning that ISP address will certainly not release any information about their customer without your suing the ISP or involving law enforcement. Law enforcement isn't interested until you have lots and lots of financial damages.
All in all, this absolutely assures that "script kiddies" will get away with anything until they do something really big. Similarly, fraudsters and credit card thieves will get away with it until they do something really, really big. So what if you track them down to an IP address? It doesn't help. Nobody cares because it is just the "Internet" and law enforcement is still caught up with the idea that the only people that lose anything are nerds and geeks or people that have been foolish trying to get rich quick - so they deserve whatever they lost.
Right now, it is not illegal, wrong, immoral or forbidden to have a computer owned by a botnet. This means that if my computer at home is infected nothing will stop it from doing whatever its little botnet commander wants it to do. And my ISP will not do anything to prevent or deter this computer from stepping on the rights of others in any way possible.
Maybe 7 years ago, my sister's computer got caught into a botnet. Someone had loaded mIRC and a bot, and her computer was off trying sequentially to find more machines to infect. We got dropped offline, and our modem was blocked from reconnecting.
That evening, I called the ISP tech support, explained what was going on, and explained why we were disconnected. He turned our connection back on, and a couple seconds later, the scans started up again. He then proceeded to walk me though telneting into the modem, watching the NAT states to see which internal IP was causing the behavior, and then tracing that back to the machine that was infected so I could clean it.
Well, someone finally someone is doing something about it. I can't even remember how many hacked computers I got my hands on and I could clearly see the spam bots / irc bots processes, who controls them, how they are controlled, etc, but nobody would help me bring down the whole network. I've sent countless emails to companies who had their computer hacked, their ISPs and about 90% of them got replies from postmaster@ and the other 10% didn't get any reply. I sent logs and all the information they needed to
So, if I'm reading the summary correctly, there's this program where you can go and hunt down the bad guys, and these bad guys like to do bad things (intrusions?), and there might be bounties on the best/worst ones, and there's even a way to have bragging rights (TOP 10/killmail?), and you can collect a crazy amount of data to get this done...
I'm confused, are we talking about the next Eve-Online expansion, or is this a different MMORPG?
Aside from what buggy bloatware their crappy AV is, the last time I worked on a new computer with a "trial" verison of Norton, I discovered that I couldn't completely uninstall their crapware even in safe mode. So where do I sign up? I want to report Symantec for distributing malware.
Symantec doesn't want to shutdown the criminals who create demand for Symantec's products. This is all PR bull. Why this is on Slashdot's front page is beyond me.
A few years ago over the space of a week I got several phone calls from irate people telling me computers I owned were attacking them. They gave me the IP address it was coming from. Hmm, that's one of our NTP servers... I asked what port they were being attacked on. "Port 123". "Hmm, I see that the only packets flowing out from this IP address to yours are in response from a packet from your network. In other words, one of your systems is requesting the time from us and you are seeing the responses t
This doesn't make any sense... why would Symantec want to catch the bad guys, when the very existence of those bad guys is the bread and butter of the corporation? Biting the wretched hand that feeds it?
There's something else far more sinister going on here. Will Symantec make up the profit lost from having fewer bad guys from whom to "protect" people by milking the people themselves somehow? Of course it might be argued that's been done all along, but....
Why would someone use a possibly infected computer with their real info?
Why not set up a Honeypot system and create a fictional name via free web mail and then sign up for some web sites. When a scam email comes in click on the attached file or link, which will install malware on the system that Symantec can track back to the system that is accessing it. When the scammer/hacker/cracker has the fake info, you'll know that they stole it and the infected system can have a history of IP connection that leads ba
1. Users are mostly idiots. An educated idiot is still an idiot. 2. Despite lame excuses about "market share" that MS uses for their frequently exploited vulnerabilities, there isn't a system that CANNOT be hacked. 3. The best standards and coding practices can probably only hope to reduce exploits by about 80 to 90 percent. 4. Damn good idea. Next time you meet a marketer, shoot him. We don't need his genes in the pool.
You have a ROM based computer? You should submit a slashdot story of it, because it'd be interesting to hear how you got it working.
Unless your talking about an Amiga or something, where viruses spread on floppies. Even if you rebooted from ROM, as soon as you put in the floppy, you have your virus again.
Well, i was actually thinking of my Atari ST ( with applications on cartridge ), but there are thousands of embedded machines that boot from ROM that run anything from DOS to QNX.
You can even buy ix86 style motherboards with linux in ROM.. or just boot off a CDROM or read only flash usb.
And depending on how you manage your PC, having infected floppies wont matter much. ( and what is a floppy?:) )
If 'a minimal OS' isn't your thing, you could run a VM and restore it from snapshot every time you 'reboot' it.
Hacked, in the context of TFA, and in the context of my post, would mean "exploited for the purpose of gaining valuable information and/or taking advantage of exploits on other computers".
I think it's fairly safe to say that any machine capable of browsing the internet can be taken advantage of, by one means or another. A ROM based machine may not be capable of hosting a trojan, virus or worm between boots - it is still a potential target for social networking, man in the middle, and other attacks. Boot u
Define hacked. My ROM based computer is pretty damned immune to being hacked, in the traditional definition of the word.
A recent paper [ucsd.edu] reports on hacking a voting machine that could only execute out of ROM. Interesting paper. I hadn't read about the technique they used before--it's quite ingenious. Turns out, being ROM-based didn't make
it unhackable at all.
1. Impossible. There is no way to both have "computing for everyone" and have educated users. Users are going to be, well, users always.
2. Sorry, not really possible either. If I can convince the user to run a program, grant security authorization to this program and do whatever it takes to take over their computer, the operating system is irrelevent. And yes, we are there today. Windows is plenty secure but it, as Linux does, requires an Administrator. When that is the "user" you no longer have security.
3. The criminals aren't interested in having their code reviewed.
4. I'm glad we have some unrealistic utopian folks here. It is always refreshing to see people that simply do not understand that all human activity since the beginning of time has revolved around "commerce" and "commerce" is, by its nature, marketing.
Dogs are not involved in commerce. Dogs do not experience "marketing". If everyone was more dog-like we wouldn't have problems like this. We would, however, have masters.
That is why you fail. Most people can barely multiple 12 * 12 or write a coherent letter, and you want them to learn the intricacies of an electronic machine? It. Won't. Work. You might as well ask them to fix their own cars, which is impossible since most people can't even change the oil.
Who is going to "educate" users? What will be taught? Where will it be taught, and to how many people? How do you deal with the differing systems that people would need to be "educated" on (remember there are still people using OSes that are 10+ years old)?
More importantly, who will pay for it?
It is easy to talk about "educating users", almost as easy as it is to blame the current problems on "uneducated users". But there are too many unanswered questions related to the statement.
create hardened operating systems that may never need antivirus
Wow, you should have at least put "educate users" lower on the list, so you wouldn't fail right off the bat like that. I have been building, repairing, and selling boxes since the Win3.x days, and educating users=UBERFAIL. Why? Because of what i call "the Velma problem". You see all you have to do with Velma is send her something that says..ohh I don't know...."Happy_Puppy_Pics.scr.exe" and guess what Velma will do? If you said turn off her AV because the email tells her she has to before running her new screensaver/malware, you are right.
I had one customer that brought in a Toshiba laptop that had over 3400! viruses. The final count IIRC was something like 3467. It took nearly two hours under power to get to the desktop, but the boss wanted to see if it "broke the record" of 2700+ he found on one machine. Turned out you could put the word "lesbians" on just about anything and he would click. Lesbian_xxx_passwords.txt.exe, Hot_lesbians.avi.exe, etc. You get the picture.
So you see, education=UBERFAIL. It will always equal fail because the malware writers know about this thing called "social engineering" which will make otherwise normal and sane people do incredibly dumbass things, just by waving the right prize in front of them. For some it is sex, for others greed, for Velma it is cuteness. pretty much the ONLY way to remove the "Velma problem" would be to give them locked down thin clients with no rights to do much of anything, and Joe Average ain't gonna put up with that. Oh, and FLOSS guys PLEASE don't say "Linux Security" would fix it, as I tried that once with one of the porn guys, with either PCLOS or Mepis, can't recall which. He managed to complete bork the machine in less than 3 days. The poor thing wouldn't even boot anymore. How? He decided he didn't like that package manager thingie, so instead googled "Linux software" and ended up in dependency hell from a bucnh of crap he downloaded and installed from Freshmeat. Like the movie said "Stupid is as stupid does". All you can do is try to minimize the damage they can cause and clean up the mess afterwords. Sad but true.
The World is America? (Score:4, Insightful)
How many of these scams and hack originate in the US anyway? Will their customers really have information to share?
Re: (Score:2)
@flymolo: "How many of these scams and hack originate in the US...?"
Probably at least as many as originate in China and Russia.
Re:The World is America? (Score:5, Insightful)
And the countdown to a DOS via spoofing a report to symantec of malware propogation..... Begins.
Parent
Re: (Score:3, Insightful)
How many of these scams and hack originate in the US anyway? Will their customers really have information to share?
Lots actually. If I wanted to hack you my first step is to hack someone in a country where their police can't be bothered to look nor cooperate. Next, I launch the attack on the local USA target using the foreign system as a proxy. Some who do this even work for the same company. I have no way of qualifying this, but I am sure it is a major constituent of "foreign" hack jobs.
More sophisticated hackers might use 2 or more proxies making it a real PITA to chase them. But sloppy ones with savvy security t
Hmm, tip line? Vigilante? or just more info? (Score:2)
And everyone will live happily ever aft
Re:Hmm, tip line? Vigilante? or just more info? (Score:5, Insightful)
The example in the article is even misleading, since it was a Facebook account that was hacked, who knows if the hackers ever touched the system of the user. He may have just used the same password too many places. I'd assume Facebook isn't using Norton Internet Security, so I'm kind of wondering what cases this will really make a difference in. Most worms/viruses even don't come from the creator's PC, but infected zombies.
Parent
vigilante@home (Score:2)
Hey, so this is like those cure-cancer protein folding things, or like the original find-an-alien-civilization SETI project, except where it's recruiting people to become cyber vigilantes with their spare computing cycles. Awesome! I want to get my computer infected just so my employer's favorite documents can be snagged AND my daughter's school project can be shredded AND I can be implicated in a giant DDoS zombienet counter-attack scandal too. Sign me up!
Re: (Score:2, Funny)
-- Name: Grandma
-- Data stolen: pictures of cats
-- Underwear size: enormous
-- Thank you for your support.
Cleaning the uncleanable? (Score:3, Interesting)
I think, ultimately, that the internet will never be cleaned up. It is very idealistic to think there are a finite number of hackers and that their methods will not become more and more sophisticated as time goes by.
The kind of "cleaned up" internet that these companies talk about requires STRICT regulation and STRICT monitoring. It is very apparent, from just the audience that posts on Slashdot, that regulation is the exact opposite of what people want.
As far as the approach, the idea of a proactive anti-virus is novel, but I think the idea of recruiting novices to help hunt expert hackers is ludicrous. All it would take is a couple of reprisals from the hackers to permanently deter the said novice from going after a hacker.
Re:Cleaning the uncleanable? (Score:4, Insightful)
Sorry to bring politics into it, but it's a good example.
Parent
Re: (Score:2, Insightful)
While you are arguing semantics (symantecs, lol) between hackers and crackers, I think you strongly, strongly overestimate the ability of the general populace to rise to this specific occasion.
Technology has developed at such an accelerated rate that there are few, at the least, who really know how things work. I think I've stated this before in another article, but to most people, computers are virtually magic. The level of understanding and specific knowledge required to do so is so in-depth that really
They've hired a marine? (Score:3, Informative)
Marines aren't like cops at all. A marine knows that the best defense is a good offense. Go get 'em, before they come to get you!
False leads? (Score:3, Interesting)
How difficult would it be for an enterprising "computer criminal" to leave a trail of breadcrumbs leading to someone else?
IF this is easy to do, Symantec knows it, and this effort amounts to nothing more than a publicity stunt to sell more licenses.
Re: (Score:2)
The funny thing is...
Same here. Every few months I download a few of the latest free AVs and ASWs, run them and then wipe them. In over five years the only thing any of them has found is suspicious cookies.
more of the same (Score:2)
Hah. You think Joe and Judy are going to be concerned about the big picture when they are trying to order Suzie's birthday party invitations and can't? The big picture is nice and all, but to expect people to act reasonably is, in my experience, a recipe for disappointment.
I need a job ... (Score:5, Funny)
I'd like to see it applied for anti-spam as well (Score:3, Interesting)
Clean It Up? (Score:2)
I'm convinced we can clean up the Internet in 10 years...
Bwahahahahahahahahahahahahahahahahahahahaha!!!
Oh gawd, that's rich. One of the funniest jokes I've read in a long time. Hysterical. Hopefully I'll see this guy at next year's Montreal Comedy Festival. Awesome comedian!
How do people like that get into the position of VP of anything? A bold statement that indicates such a complete and utter lack of possibility... Unreal.
Vigilante Cyberjustice? (Score:2)
Advocated by a guy name "Trollope"?
<looks at calendar>
It's not April 1st; what's up with that?
Re: (Score:2)
I presume they like English Novelists from the Victorian era.
And no, I'm not sure how I know that
#1 threat to the internet (Score:2)
customers won't mind being disrupted? (Score:2)
*I* mind, and will sue any responsible party or anyone that is encouraging it.
Huh? Clean up the Internet? (Score:3, Insightful)
As long as an ISP values their customer's privacy and rights to step on other people more than they value the integrity of the Internet, we are going to have problems.
Right now, it is not illegal, wrong, immoral or forbidden to have a computer owned by a botnet. This means that if my computer at home is infected nothing will stop it from doing whatever its little botnet commander wants it to do. And my ISP will not do anything to prevent or deter this computer from stepping on the rights of others in any way possible.
Similarly, if your computer is intruded upon and you find an IP address that has been used to vandalize your computer, good luck. The ISP owning that ISP address will certainly not release any information about their customer without your suing the ISP or involving law enforcement. Law enforcement isn't interested until you have lots and lots of financial damages.
All in all, this absolutely assures that "script kiddies" will get away with anything until they do something really big. Similarly, fraudsters and credit card thieves will get away with it until they do something really, really big. So what if you track them down to an IP address? It doesn't help. Nobody cares because it is just the "Internet" and law enforcement is still caught up with the idea that the only people that lose anything are nerds and geeks or people that have been foolish trying to get rich quick - so they deserve whatever they lost.
Re:Huh? Clean up the Internet? (Score:5, Interesting)
Right now, it is not illegal, wrong, immoral or forbidden to have a computer owned by a botnet. This means that if my computer at home is infected nothing will stop it from doing whatever its little botnet commander wants it to do. And my ISP will not do anything to prevent or deter this computer from stepping on the rights of others in any way possible.
Maybe 7 years ago, my sister's computer got caught into a botnet. Someone had loaded mIRC and a bot, and her computer was off trying sequentially to find more machines to infect. We got dropped offline, and our modem was blocked from reconnecting.
That evening, I called the ISP tech support, explained what was going on, and explained why we were disconnected. He turned our connection back on, and a couple seconds later, the scans started up again. He then proceeded to walk me though telneting into the modem, watching the NAT states to see which internal IP was causing the behavior, and then tracing that back to the machine that was infected so I could clean it.
Parent
Finally! (Score:2)
Well, someone finally someone is doing something about it. I can't even remember how many hacked computers I got my hands on and I could clearly see the spam bots / irc bots processes, who controls them, how they are controlled, etc, but nobody would help me bring down the whole network. I've sent countless emails to companies who had their computer hacked, their ISPs and about 90% of them got replies from postmaster@ and the other 10% didn't get any reply. I sent logs and all the information they needed to
New game in town? (Score:2)
So, if I'm reading the summary correctly, there's this program where you can go and hunt down the bad guys, and these bad guys like to do bad things (intrusions?), and there might be bounties on the best/worst ones, and there's even a way to have bragging rights (TOP 10/killmail?), and you can collect a crazy amount of data to get this done...
I'm confused, are we talking about the next Eve-Online expansion, or is this a different MMORPG?
Cross-functional delusions (Score:2)
The strategy has its risks...
Interesting that the first thing Edwards (Business Week) thinks of are the cliché arguments for gun control.
war on drugs, war on crime, (Score:2)
Symantec trying to stop malware? That's a laugh (Score:2)
Aside from what buggy bloatware their crappy AV is, the last time I worked on a new computer with a "trial" verison of Norton, I discovered that I couldn't completely uninstall their crapware even in safe mode. So where do I sign up? I want to report Symantec for distributing malware.
Theater (Score:2)
This reminded me of previous attack reports I got. (Score:2)
How does Symantec monetize this? (Score:2, Troll)
This doesn't make any sense... why would Symantec want to catch the bad guys, when the very existence of those bad guys is the bread and butter of the corporation? Biting the wretched hand that feeds it?
There's something else far more sinister going on here. Will Symantec make up the profit lost from having fewer bad guys from whom to "protect" people by milking the people themselves somehow? Of course it might be argued that's been done all along, but....
Clean up the Internet? (Score:2)
Disconnect from the 'Net every computer running Windows operating systems. Hell, we can have this place spic-n-span overnight!
I am Vengeance! I am the Night! (Score:4, Funny)
So how does this work? (Score:2)
Why would someone use a possibly infected computer with their real info?
Why not set up a Honeypot system and create a fictional name via free web mail and then sign up for some web sites. When a scam email comes in click on the attached file or link, which will install malware on the system that Symantec can track back to the system that is accessing it. When the scammer/hacker/cracker has the fake info, you'll know that they stole it and the infected system can have a history of IP connection that leads ba
Re:such a john wayne (Score:5, Insightful)
1. Users are mostly idiots. An educated idiot is still an idiot.
2. Despite lame excuses about "market share" that MS uses for their frequently exploited vulnerabilities, there isn't a system that CANNOT be hacked.
3. The best standards and coding practices can probably only hope to reduce exploits by about 80 to 90 percent.
4. Damn good idea. Next time you meet a marketer, shoot him. We don't need his genes in the pool.
Parent
Re: (Score:2)
2. Despite lame excuses about "market share" that MS uses for their frequently exploited vulnerabilities, there isn't a system that CANNOT be hacked.
Define hacked. My ROM based computer is pretty damned immune to being hacked, in the traditional definition of the word.
Re: (Score:2)
Unless your talking about an Amiga or something, where viruses spread on floppies. Even if you rebooted from ROM, as soon as you put in the floppy, you have your virus again.
Re: (Score:2)
Well, i was actually thinking of my Atari ST ( with applications on cartridge ), but there are thousands of embedded machines that boot from ROM that run anything from DOS to QNX.
You can even buy ix86 style motherboards with linux in ROM.. or just boot off a CDROM or read only flash usb.
And depending on how you manage your PC, having infected floppies wont matter much. ( and what is a floppy? :) )
If 'a minimal OS' isn't your thing, you could run a VM and restore it from snapshot every time you 'reboot' it.
Re: (Score:2)
Hacked, in the context of TFA, and in the context of my post, would mean "exploited for the purpose of gaining valuable information and/or taking advantage of exploits on other computers".
I think it's fairly safe to say that any machine capable of browsing the internet can be taken advantage of, by one means or another. A ROM based machine may not be capable of hosting a trojan, virus or worm between boots - it is still a potential target for social networking, man in the middle, and other attacks. Boot u
Re: (Score:2)
My definition is more of a long term thing, which would be negated if i reboot every day, or before i did something 'sensitive'.
Re:such a john wayne (Score:4, Interesting)
A recent paper [ucsd.edu] reports on hacking a voting machine that could only execute out of ROM. Interesting paper. I hadn't read about the technique they used before--it's quite ingenious. Turns out, being ROM-based didn't make it unhackable at all.
Parent
Re: (Score:2)
Well, sure, if you have physical access anything is possible.
Re:such a john wayne (Score:5, Funny)
Hack mah abacus, n00b!
I kick the table your abacus is on causing the beads to shuffle about randomly.
next.
Parent
Re:such a john wayne (Score:4, Interesting)
1. Impossible. There is no way to both have "computing for everyone" and have educated users. Users are going to be, well, users always.
2. Sorry, not really possible either. If I can convince the user to run a program, grant security authorization to this program and do whatever it takes to take over their computer, the operating system is irrelevent. And yes, we are there today. Windows is plenty secure but it, as Linux does, requires an Administrator. When that is the "user" you no longer have security.
3. The criminals aren't interested in having their code reviewed.
4. I'm glad we have some unrealistic utopian folks here. It is always refreshing to see people that simply do not understand that all human activity since the beginning of time has revolved around "commerce" and "commerce" is, by its nature, marketing.
Dogs are not involved in commerce. Dogs do not experience "marketing". If everyone was more dog-like we wouldn't have problems like this. We would, however, have masters.
Parent
Re: (Score:2)
>>> 1. educate users
That is why you fail. Most people can barely multiple 12 * 12 or write a coherent letter, and you want them to learn the intricacies of an electronic machine? It. Won't. Work. You might as well ask them to fix their own cars, which is impossible since most people can't even change the oil.
Re: (Score:3, Funny)
Re: (Score:3, Funny)
Don't worry. If you haven't changed it in long enough, there might not be.
nice pipe dream.... Re:such a john wayne (Score:3, Insightful)
1. educate users
Who is going to "educate" users? What will be taught? Where will it be taught, and to how many people? How do you deal with the differing systems that people would need to be "educated" on (remember there are still people using OSes that are 10+ years old)?
More importantly, who will pay for it?
It is easy to talk about "educating users", almost as easy as it is to blame the current problems on "uneducated users". But there are too many unanswered questions related to the statement.
create hardened operating systems that may never need antivirus
That is a great d
Re:such a john wayne (Score:5, Informative)
Wow, you should have at least put "educate users" lower on the list, so you wouldn't fail right off the bat like that. I have been building, repairing, and selling boxes since the Win3.x days, and educating users=UBERFAIL. Why? Because of what i call "the Velma problem". You see all you have to do with Velma is send her something that says..ohh I don't know...."Happy_Puppy_Pics.scr.exe" and guess what Velma will do? If you said turn off her AV because the email tells her she has to before running her new screensaver/malware, you are right.
I had one customer that brought in a Toshiba laptop that had over 3400! viruses. The final count IIRC was something like 3467. It took nearly two hours under power to get to the desktop, but the boss wanted to see if it "broke the record" of 2700+ he found on one machine. Turned out you could put the word "lesbians" on just about anything and he would click. Lesbian_xxx_passwords.txt.exe, Hot_lesbians.avi.exe, etc. You get the picture.
So you see, education=UBERFAIL. It will always equal fail because the malware writers know about this thing called "social engineering" which will make otherwise normal and sane people do incredibly dumbass things, just by waving the right prize in front of them. For some it is sex, for others greed, for Velma it is cuteness. pretty much the ONLY way to remove the "Velma problem" would be to give them locked down thin clients with no rights to do much of anything, and Joe Average ain't gonna put up with that. Oh, and FLOSS guys PLEASE don't say "Linux Security" would fix it, as I tried that once with one of the porn guys, with either PCLOS or Mepis, can't recall which. He managed to complete bork the machine in less than 3 days. The poor thing wouldn't even boot anymore. How? He decided he didn't like that package manager thingie, so instead googled "Linux software" and ended up in dependency hell from a bucnh of crap he downloaded and installed from Freshmeat. Like the movie said "Stupid is as stupid does". All you can do is try to minimize the damage they can cause and clean up the mess afterwords. Sad but true.
Parent