Britney is #1 Virus Celebrity

No France writes "The two ways for an email virus to spread is to use an exploit, or entice the user to click the link/executable. Of course the latter is the easiest, and is the most effective when used in conjunction with a celebrity's name. Despite the recent Jackson suicide emails, Britney Spears is the one to recently edge out Bill Gates as the top virus celebrity. The top 10 (in descending order): Britney Spears, Bill Gates, Jennifer Lopez, Shakira, Osama Bin Laden, Michael Jackson, Bill Clinton, Anna Kournikova, Paris Hilton, and Pamela Anderson."

Comments

A little ironic...

[ChrisF79]

Isn't it ironic that to trick a user into clicking a fake email, they use the fakest of all celebrities?

Re:A little ironic...

[/ASCII]

Britney is not fake, she is really smart person. Check out her guide to semiconductor physics, if you doubt her abilities. I actually read some of her work while studying for my semiconductor finals.

Re:A little ironic...

[roman_mir]

You are probably wrong. I don't listen, but I am sure she is not a fake celebrity. She is a real celebrity, people like to talk about her and know more about her and such.

She is a fake musician/singer, that is probably true.

Link, please?

[cuzality]

Please post a link where we can read these emails.

No big surprise

[moz25]

Well, if I have to choose between "see Britney Spears naked" and "see Bill Gates" naked, I'll pick the first worm any day!

More intelligent software or users?

[Crimson Dragon]

These kinds of stories, while making the majority among us cringe at the stupidity of the user that falls for this, underlies an important point.

THIS IS WHAT YOUR IT DEPARTMENT HAS TO DEAL WITH!

Millions of man hours and hundreds of millions of dollars go down the tubes to user ignorance. As these costs spiral, the IT sector diminishes. At some point, we will have to stop the patchwork of protecting the users from themselves and engage in the proactive education from these people so they don't hurt themselves and cost their companies, ISPs, and our economy in lost man hours and dollars. How to do this merits exploration, as for every new procedure we establish to protect the user, the user seems to find a way to break it somehow.

Re:More intelligent software or users?

[jalefkowit]

These kinds of stories, while making the majority among us cringe at the stupidity of the user that falls for this, underlies an important point.

THIS IS WHAT YOUR IT DEPARTMENT HAS TO DEAL WITH!

... at some point, we will have to stop the patchwork of protecting the users from themselves and engage in the proactive education from these people so they don't hurt themselves and cost their companies, ISPs, and our economy in lost man hours and dollars.

You're talking about educating human nature out of people. Good luck with that.

The lesson of stories like this one are not that we need to somehow engineer smarter users -- it's that modern information systems are not designed around users to begin with. They're designed around lists of features and ship-by dates.

A system should behave in a way that one would expect it to. Certain operations -- deleting things, say -- are obviously risky, and I've never met any user who didn't get that. But who would expect opening an e-mail to be a risky proposition? The fact that it undeniably is (in some environments) doesn't mean that people are stupid for not knowing which e-mails to leave closed, it means that e-mail is broken for many millions of users. The fact that e-mail as a medium can be exploited like that is a weakness of the medium, not the user.

You can lament human nature all you want, but it is what it is. A well-designed system should be able to deal with that. Having to train users to do alien things should be taken as a sign that your system may not be so well-designed, not as a sign that we need to get cracking on Human Being 2.0.

Re:More intelligent software or users?

[jalefkowit]

Good points... a few thoughts:

Antivirus software, malware removers, spam-reducing solutions.... these are not designed around users?

Nope. No, they're not. They're palliatives to problems that we have inflicted upon users, not systems designed with users in mind. How many users understand what "malware" is -- even those that run Spybot? Is a malware remover something that a user would choose to run, if they weren't forced to by imminent threat from exploitation of broken systems by malicious parties?

(None of which is to belittle the heroic work that people have done on products like Spybot to help patch these holes. It's hugely important. But can we depend forever on heroes?)

A person who has any idea that a computer is a general purpose machine... Why should anyone be surprised when it does something new or malicious?

See, this is the problem. The average user does not see their computer as a general purpose Turing device -- they see it through the prism of whatever application they happen to be using at that moment. If they're reading e-mail, the computer is an e-mail terminal. If they're browsing the Web, it's a Web terminal. If they're in Word, it's a word processor.

You and I know that the computer is a general purpose machine, infinitely reprogrammable, but the average person does not think that way. They approach the computer through a series of metaphors ("desktop", "mail", "pages"), and the vast majority expect it to follow those metaphors as closely as possible. When it doesn't -- when the abstractions start leaking -- it creates opportunites for malicious parties to exploit the user's resulting confusion.

Which is exactly what has happened with e-mail -- in certain cases it can behave in a very un-mail-like way. This behavior is being exploited to confuse users into doing the wrong thing. You can try to educate people into not doing the wrong thing, but as long as the underlying metaphor is "mail" it will be very hard to make significant progress.

Why must the responsibility be placed solely on the software developer... ruling out one possible angle that you can't disprove and blaming a group of people who, by and large, strive to produce workable solutions is an insult to the good work many among us have done.

Don't look at it as placing blame (my apologies, I didn't mean to come across as blaming you for the problem) -- look at it as opportunity. Apple's recent success in taming UNIX, and Firefox's success in taming Mozilla, should be a lesson to developers everywhere that you can really make it big by reducing complexity, locking down unnecessary options, and streamlining the user experience.

Biggest, most effective spam celebrity of them all

[ScentCone]

Is, of course, ourselves. My experience with phishing and other social-hacks-by-email suggest that the ones that seem to really trip people up are the ones that recipients think are about themselves. I have seen the enemy and he is us.

Virus Drills

[bigtallmofo]

I've said this many times before, but my idea is to stage virus drills. Every week or so, the IT department should send fake viruses to a random population of the corporate environment. It will have an attachment that will only report to the IT department who opened it. Once a user opens the fake virus attachment, they must watch a 2-hour video on their own time on the subject of "safe email habits".

Pretty soon, they'll be too paranoid to open any attachment.

Re:Virus Drills

[xMilkmanDanx]

Nope, pretty soon they don't check their email at all and productivity skyrockets!

Re:Toxic

[Simon for $1]

http://www.google.com/jobs/britney.html

You come in at number 2. Well done.

Isn't this obvious?

[J Barnes]

There's some sense of satisfaction I get in knowing that every time a person ogles, clicks, downloads or otherwise interfaces with that pizza-faced mess known as Brittany Spears, there's a good chance their computer will catch the clap.

Re:sad

[Filip22012005]

i never get any e-mail viruses, but when I do [...]

erm...

I find it rather disturbing...

[EphemeralPhart]

in that I recognize every one of those individuals. I can even put a face to most of them !

What gamut of innate garbage must my brain contain beyond that...

I'm disgusted by the cesspool that is my mind and, for once, very conscious of the torrents of crap being sluised into it every moment.

And here I am reading slashdot.

At the CIA

[jdepons]

Agent: "Cheif, we interceped another email from Osama Bin Laden"

Chief: "We got him this time. Open it asap"

Agent: "I don't understand, all it did was change my home page to xxxarabia.com"

Chief: "Damn you Bin Laden!"

Re:You almost have to love virus writers...

[m50d]

Yes, they did. Back in "the day" viruses were often written in hand-coded assembly. That was craftsmanship, that was /misty eyes. Seriously, visual basic is used mainly for two reasons. Firstly, most virus writers are fairly immature (except those trying to get botnets for money) and visual basic is often the first language they learn. Secondly, visual basic scripts include their source, thus if you want to base your virus on an existing one, it's a lot easier to do with a visual basic one than decompiling a virus and trying to make sense of it. Any other dynamic language would work for this, but windows ships with visual basic interpreter wheras it doesn't include one for perl, python etc. (and dos scripting is too useless)