Slashdot Mirror
Hackers Offer Subscription, Support for Malware
Stony Stevenson writes "Organised gangs are taking a page out of security vendors' books and setting up their own websites that offer support and subscriptions for malware and spyware. From the article: 'For subscriptions starting as low as $20 per month, enterprises can sell fully managed exploit engines that spyware distributors and spammers can use to infiltrate systems worldwide, said Gunter Ollmann, director of security strategies at IBM's ISS X-Force team. Many exploit providers simply wait for Microsoft's monthly patches, which they then reverse engineer to develop new exploit code against the disclosed vulnerabilities, Ollmann said. "Then all you've got to do is just subscribe to them on a monthly basis.'"
When I first read the title, I thought it meant that hackers were now selling "protection" from malware in much the same way organized gangs have sold "protection" in the past. Perhaps a better title would be "Hackers organize, sell exploits as business"
Couldn't they make more money by offering a 'Patch Wednesday' kind of service which updated Microsoft products and protected against the next round of vulnerabilities? Seeing as no one else is able to do this there's a very obvious gap in the market here for someone who knows a bit about exploiting MS products!
...then kill them.
Erm, if you're daft enough to sign up and give them your credit card details directly, doesn't that mean they no longer need bother writing the malware?
When I saw the summary, I was half-certain it had to be a delayed April 1 submission. Then I looked at the article. And thought about it.
It actually fits a pattern we've seen with viruses, trojans, spyware, other malware, cracking, even spam. They've gone from small shops, often one programmer trying to make a name for himself, to full-on organized crime using businesslike structures and tactics.
How long before we see a defection and find out that N.Korea or some other evil empire's government is sponsoring this type of activity. All that malware out there isn't just annoying you with spam, a lot of it is trying industrial espionage.
Support NYCountryLawyer RIAA vs People
$20? What a rip off. I get the latest malware and spyware for free every day courtesy of my coworkers.
The next step is obviously to protect their IP, so look for patents such as:
:)
"a method of injecting code into a web-browser to steal credit card details.... on the internet"
"a method of using many remote controlled computer's, without the owners express consent* to send unwanted advertising material, to many, many people... on the internet"
After that expect to see Exploit Genuine Advantage programs to ensure that the stolen data you are using is from genuinely advantageous exploits, and not from some half baked knock off malware or virus, duplicated by a disreputable individual.
Obviously the last step will be the mergers, (after all the above should ensure a profitable market is created and grows). Symantec will merge with EvilCode PLC, to produce Evil-Symantec, McAfee will merge with McNasty, to produce McNastfee. These new entities will be able to leverage both the illegal exploit market and provide protection services simultaneously, probably all in one product... , Finally Microsoft will change its OS so that it no longer "works" with all these wondrous exploits and... hell will freeze over
erm, ok, maybe not. Anybody whose job it is to track such things who thinks this is news, well, they're not doing their homework.
The exploit ecosystem has evolved an organism that appears to be self-aware.
If only there were an environment that was safe from such evil organisms, where they could not thrive...
Help stamp out iliturcy.
The site they're writing about, found by searching with Google for phrases in the article, isn't quite what the article says it is.
It's really yet another slimy "affiliate" program. "We give our code to your and you need to setup it to your websites. We pay for installs and for trusted webmasters for traffic if they want that." They're not selling malware with support. They're buying traffic to install their malware via drive-by installs. That's not exactly new. CometCursor, BonzaiBuddy, and Zango come to mind.
From the original article, someone else may be selling "fully managed exploit engines", but it's not these guys.
ie isn't a virus development tool. It's just an installer.
Help stamp out iliturcy.
How about a study that hasn't been thoroughly debunked? The Linux vulns count includes applications that provide functionality that Windows doesn't provide, and the Windows vulnerabilities are on average open longer and more likely to be a remote root hole.
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Yes, and we all know how organized, monolithic, and connected "the underground" is.
*rolls eyes*
Wow, wouldn't it be wonderful if Microsoft finally got it and made Windows really secure?
No, it wouldn't It wouldn't sell, nobody would use it and it would be a complete flop.
Windows is designed to be usable by people without one little bit of computer knowledge. It therefore does things "for you" in the background that can be good and helpful. If they are subverted, they are bad and insecure. Take all of this away and leave just the command line and Windows would be much more secure, but it would be unusable by most people.
If it is programmable and the programming can be added to or modified in the field, it needs controls on who can modify that programming. If the inexperienced user can, it isn't secure. Period. When users run programs to install games they purchased they are using the same resources as when the click on an email attachment to install some bit of malware. They have no way of knowing the difference and it would seem no amount of education is going to fix that problem.
What most people need is a locked-down appliance that cannot be modified in the field without extraordinary effort. And certainly cannot be modified over the Internet. This could be user friendly and secure, but you wouldn't install software on it, ever.
Windows is trying to be user friendly and general-purpose. This has no choice but to fail to be very secure. The user cannot tell the difference between a program that is from Microsoft that is something they want and a program from microSoft that isn't something they want at all. Or from MircoSoft. Or really, anyone else at all. Sure, you can try to give them a chance to tell the difference - and Vista does try - but it isn't going to work. People gave up reading messages from computers and just click OK beginning in 1979 with CP/M and they aren't about to change now.
I contend that there is no material difference between the security present on a Macintosh or Linux and Windows in the hands of a user that doesn't understand how the system works. If they get an email that says to run some program, they are going to run it if they want what the email says they are going to get. If this requires using sudo to get root authority, they will do so if they have the ability to do it.
So how do you have security in that environment? You don't. You can't ever be secure against the naive user in charge of their own computer.