Slashdot Mirror
Microsoft Reward Leads to Arrest of Sasser Suspect
tritone writes "According to this article on CNET, it was a reward from Microsoft that led to the arrest of the perpertrator of the Sasser Windows Worm. This is the first success for Microsoft's Antivirus Award Program, a $5 million fund to reward people for coming forward with information about those who release major worms and viruses."
I am amazed, with the number of open access points, that someone ever gets caught.Guess they can't help bragging to their friends.
Any strategy contains the seeds of its own failure. In this case, bribing criminals to hand-over their own is a classic but short-term solution.
Firstly, it sets the stage for blackmail. If one isolated hacker is worth $5m, how much is an unreleased worm worth? Probably much, much more. I'd not be surprised if MS regularly get asked for money upfront before worms are released. Paying out will only make this worse.
Secondly, it is a Darwinian filter. Yes, you can pay to get hold of an isolated criminal. No, you cannot use this tactic against criminal gangs. $5m is not a lot when compared to the value of a large botnet. Setting bounties will eliminate the free-lancers and leave the stage open for more organized criminals who will probably be more agressive in using zombied PCs for criminal acts (child porn, DDoS, etc.)
Thirdly, it is prejudicial and likely to lead to the arrest of innocent people. Given that any zombied PC can be used to launch a worm attack, how can any evidence be trusted? Confessions, too, are unreliable. Bounties are rapidly turned into lynchings.
Lastly, it is a distraction from the real issue: Windows' fundamental security weaknesses. Microsoft must release a secure Windows within the next 12 months or risk permanent damage to their brand. Paying bounties for worm writers fools no-one: Windows remains insecure and there remain an unlimited supply of smart criminals happy to take advantage of that.
Sig for sale or rent. One previous user. Inquire within.
The patch for Sasser was available 3 weeks before the virus was released. I don't know about you, but I'd rather pay an admin to install a patch before the virus hits, than to pay him because he's busting his ass fixing a problem that he should have avoided.
Here's a better way to put it.
If the doors in your house are falty and won't lock at all, then someone breaks in, who is to blame? The intruder, or the company that sold you the defective doors?
I say both.
And because the "door company" is paying to find the intruders after they have broken in does not mean it solves the problem, maybe they should fix the locks first. That sounds like a reasonable idea.
It is like saying that if I leave my back door unlocked at night, I am to blame if someone breaks in.
It's not like a door on your house. It's more like you're a tenant in a large apartment block in a bad neighborhood, and the landlord hasn't installed working locks on any of the apartments.
I say I have a gun, and if someone breaks in, they are getting shot.
But in this case you don't have a gun, nor can you get one. There's just about nothing that you can do as an individual to retaliate or even track down the perpetrators.
It's more like this: After years of complaints, the negligent landlord decided to hire a private investigator. After almost a year, this PI has managed to track down just one out of the hundreds of criminals harassing the neighborhood. BFD.
Maybe if it was not for the virus writers, the cost of Windows would be cheaper.
Maybe if it weren't for thieves, the cost of apartments would be cheaper. They wouldn't need security services or door locks. Unfortunately, that's a pipe dream. In the real world, you're not ever going to avoid paying for security. Deal with it.
Microsoft, the brilliant businessmen that they are, has actually managed to avoid or push off onto others the full costs of security for quite some time. However, even they are not be able to avoid the inevitable forever.
They are going now to pay to fix their mistakes with some fraction of their pile of cash, but more importantly, they are going to have to design security into their software up front. This is going to significantly slow down their pace of churning their software updates. This loss of some of their competetive edge is going to be the real price that they pay.
I think it is horrible for someone to defend a criminal because the criminal had oppertunity to commit a crime.
Likewise, it's bad to defend negligence on the part of those responsible for providing security measures by saying "Sure the security was badly flawed, but if there weren't any bad guys in this world, we wouldn't need security!"