Slashdot Mirror
Cybercrime Is a Franchise Model That Scales
Presto Vivace notes a report from the RSA conference on the cybercrime economy, and it's not an optimistic one. Part of the problem is that in many places cybercrime pays much better than legitimate work, including security research. "As the panelists explained, a single spam message might be tied to as many as 10 separate organizations and perhaps five suppliers. Every task in the criminal economy has become a separate specialty. Some people sell e-mail lists, others sell lists of compromised IP addresses, there are sellers of credit card numbers, and those who sell access to bot nets. Then there are those who handle product fulfillment for spammers, and those who specialize in laundering money."
Not all botnets are the fault of insecure operating systems. People who exclaim "Oh, look, somebody I don't know emailed me a file called CutePuppies.exe! I think I'll click on it!" pretty well destroy any sort of security scheme. Vista tried to solve that by preventing users from running programs (under the guise of User Account Control) but that just led to rebellion because people don't want to have to explicitly grant access to every program that wants to read to disk or connect to the Internet. When I install the new Firefox I don't want to have to authorize each and every operation it performs (write to disk, read from disk, connect to Internet, etc).
We need the FBI Baltimore office taken out of the business of distributing child porn and put on this problem. After ten years of work, they've arrested over 6,000 people.
How many computer criminals have they arrested? The Department of Justice doesn't seem to provide useful statistics, but it looks like the number per year is in the 10-100 range.
This is backwards, given the relative size of the problems.
Part of the problem is that the FBI has a measurement bias against white-collar crime. See the FBI Crime Statistics page. Violent crimes are counted if they are reported; white collar crimes are only counted if there's an arrest.
They keep parroting that "crime doesn't pay" but it obviously DOES pay, and it pays well. Most crimes are not solved. Most criminals are not caught - only the stupid ones and the unlucky ones get caught.
In fact, society should be damned glad that most slashdotters are honest and have conscienses (no that's not spelled right, so jail me) because if most of us were dishonest we could do one hell of a lot of damage!
Some times I wish I could be dishonest, I'd be a rich man. But it's just not in my nature.
mcgrew's razor: Never attribute to stupidity that which can be explained by greedy self-interest
It probably has less to do with actually selling a particular product than it does with saturation advertising which is designed to bypass the natural mental defenses that people have built up to advertising in general by so completely saturating the mind with brand image, logo, slogan, etc...that when the decision to make a purchase finally does come it is made on an almost subconscious level (i.e. you drop the item in your shopping cart without even thinking about it really). That is the angle that most spammers are working for their clients these days. They know you hate it, they know that you would never buy anything directly from them, but they and their clients don't care because they do not require your active cooperation in any way for their strategy to work because they are attempting to manipulate your subconscious through information overload to short circuit the rational decision making part of your brain the next time you have to make a purchase so that you will buy their brand without remembering specifically where you heard of it or even if you have seen it before. That explains the client of the spammer, but the spammer is simply a mercenary who cares about getting paid and he doesn't give a crap either way as long as he gets paid (by his clients) to run the spam campaigns on their behalf.
Not all, but most definitely are:
- Unpatched Windows XP (and below) PC's
- patched but already infected Windows PC's
- patched but rootkitted Windows PC's
- patched Windows PC's just infected this week with a zero-day exploit.
So the rest of the botnets would be shared webservers running insecure PHP bulletin boards, and servers running unpatched MS SQL, but these are a tiny fraction.
As you can see, Microsoft's greed is largely responsible for most of the world's botnets. This has to stop. The US government could as well take these steps:
a) Force Microsoft to release a new version of XP but with Vista's security features (but please replace the cancel/allow with administrator password dialogue), so that all processes run in userspace and no changes can be done to the registry/configuration without user authorization.
b) Force Microsoft to release the patches and upgrades *FOR FREE*, even for pirate copies
c) Make a "Disinfect your PC" campaign, making a census of all computers, and running antivirus/antirootkit software (or possibly formatting, with previous backup of course) on such machines, at the same time upgrading the PC's to the newest Windows version (FOR FREE). When the campaign is over, we could as well declare the US virus-free (for now
According to the UK government my family live well below the poverty line (about two-thirds of a poverty level income), so I feel I can offer some insight!
>>> Can they save any for a rainy day, or would that make them no longer poor and ineligible for the next payout to the poor from Robin Hood?
If you're a medieval peasant (probably a serf) given enough money to buy a sack of flour you won't go hungry for a few weeks. You'll still be in need, with more money you could buy vegetables, more still you could have meat, more than that land that you could use to feed yourselves from (assuming you're not debarred from owning land by not being a part of a noble family).
>>> If poor people constantly spend every cent they receive, whether from assistance or earned to remain poor, is that moral behavior?
We spend every penny we earn on housing, food, utilities, clothing (if we're lucky, though mostly we get clothes as gifts). We work and are raising a child (both consider moral goods for the community by most). I can't see how it's immoral to spend all you earn - with more money we could afford to eat a little more healthily and maintain our property better which in turn would reduce economic strains in the long-term. We have a national health service and someone will have to conduct repairs in the future which wouldn't have been necessary could we afford to maintain our property.
I'd love to hear how you think this could be immoral living?
To some extent it's the system - capitalism is a predatory system in which those who have money make more by exploiting those who don't. And to some extent it's personal choice: we believe our business is a worthwhile part of the community even if as a whole the community don't value it as much as we do.
>>> Robin Hood would steal from the rich to give to the poor. Was this a moral act?
In his circumstances (assuming the tales to be true) then I think it is moral to steal from those with excess to prevent those with nothing from dying of starvation. It's not capitalist morality but it works for me! Moreover Robin Hood probably does the landowners a service by stopping them (the landowners) from killing off the people who are growing their food and keeping them in their luxury.