The 'Malware Economy' Evolves

superglaze writes "ZDNet UK has a feature on how the malware economy is turning into a recognizable traditional IT economy. Leasing botnets? Malware support? Welcome to the new age of computing. As the piece suggests, it's all gone Darwinian. 'One indication of the maturity of the black economy, according to Telafici, was the recent case of a hacker who wrote a packer [software used to bypass antivirus protection], "threw in the towel recently as it wasn't profitable enough -- there's too much competition. They opened the source code and walked away."'"

Comments

Re:Oblig..

[CaptainPatent]

So you're saying the editor is a slacker and the hacker who wrote the packer should be a cracker?

Malware and ex-emailer

[deviated_prevert]

As I receive spam my conclusion is that the majority of bot nets are created by people like my Aunt. She thinks she is safe because she uses some obscure malware and e-mail detection system that seems to have appeared like magic to rescue her from the perils of the net. However her windows 98 kernel has obviously been rooted and she does not even know it.

I keep getting spam traffic from her that is reassigned from a myriad of outlook express ex-emailers. I have told her that she will have to get her OS reinstalled but she just won't listen. I am afraid that the windows OS and the Microsoft way of computing has done little more than create a shit load of computer using zombies and little old ladies (like my aunt) who in blissful ignorance just keep up the status quo. The result of this blissful ignorance is that bot nets have become almost impossible to kill.

Re:Malware and ex-emailer

[myvirtualid]

Your post advocates a
( ) technical (X) legislative ( ) market-based ( ) vigilante

approach to fighting spam.

Furthermore, your approach appears to require a level of international cooperation akin to
( ) Passing a meaningless UN resolution
( ) Negotiating a world wide free trade agreement
( ) private, i.e., commercial and civil, law
( ) Banning land mines
( ) Adding a permanent member to the UN Security Council
( ) Achieved balanced copyright reform
( ) Censuring Cowboy Neal
(X) Doing anything truly useful about climate change
( ) Eliminating Britney Spears

Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from jurisdiction to jurisdiction before a useful treaty can be negotiated.)
( ) Spammers can easily use it to harvest email addresses
( ) Mailing lists and other legitimate email uses would be affected
( ) No one will be able to find the guy or collect the money
( ) It is defenseless against brute force attacks
(X) It will stop spam for two weeks and then we'll be stuck with it
(X) Users of email will not put up with it
( ) Microsoft will not put up with it
( ) The police will not put up with it
( ) Requires too much cooperation from spammers
(X) Requires immediate total cooperation from everybody at once
( ) Many email users cannot afford to lose business or alienate potential employers
( ) Spammers don't care about invalid addresses in their lists
( ) Anyone could anonymously destroy anyone else's career or business

Specifically, your plan fails to account for
( ) Laws expressly prohibiting it
(X) Lack of centrally controlling authority for email
(X) Open relays in foreign countries
( ) Ease of searching tiny alphanumeric address space of all email addresses
(X) Asshats
(X) Jurisdictional problems
(X) Unpopularity of weird new taxes
( ) Public reluctance to accept weird new forms of money
( ) Huge existing software investment in SMTP
(X) Susceptibility of protocols other than SMTP to attack
( ) Willingness of users to install OS patches received by email
(X) Armies of worm riddled broadband-connected Windows boxes
( ) Eternal arms race involved in all filtering approaches
( ) Extreme profitability of spam
( ) Joe jobs and/or identity theft
(X) Technically illiterate politicians
(X) Extreme stupidity on the part of people who do business with spammers
(X) Dishonesty on the part of spammers themselves
( ) Bandwidth costs that are unaffected by client filtering
( ) Outlook

and the following philosophical objections may also apply:
(X) Ideas similar to yours are easy to come up with, yet none have ever been shown practical
( ) Any scheme based on opt-out is unacceptable
( ) SMTP headers should not be the subject of legislation
(X) Blacklists suck
( ) Whitelists suck
( ) We should be able to talk about Viagra without being censored
( ) Countermeasures should not involve wire fraud or credit card fraud
( ) Countermeasures should not involve sabotage of public networks
(X) Countermeasures must work if phased in gradually
( ) Sending email should be free
(X) Why should we have to trust you and your servers?
( ) Incompatiblity with open source or open source licenses
(X) Feel-good measures do nothing to solve the problem
( ) Temporary/one-time email addresses are cumbersome
( ) I don't want the government reading my email
( ) Killing them that way is not slow and painful enough

Furthermore, this is what I think about you:
( ) Sorry dude, but I don't think it would work.
( ) This is a stupid idea, and you're a stupid person for suggesting it.
( ) Nice try, assh0le! I'm going to find out where you live and burn your house down!
(X) uh, come to think of it, I have no particular opinion of you nor any desire to form one.