Slashdot Mirror
The Internationalization of Malware
Ant brings us a write-up from a former malware analyst about the difficulties in fighting malware as it expands beyond English-language targets and into societies with different standards for privacy and security. Quoting:
"One of the most fascinating facets of the increasing internationalization of malware is the cultural assumptions around such software. What is considered malware in the US may be commonly accepted in China or Japan, and this is largely due to the society that it exists in. Anti-cheating rootkits are very common in games released in these countries. What is considered to be invasive in the North American or European world is acceptable there. These anti-cheating rootkits would hook into the kernel space in a very invasive way, and have the behavioral characteristics of malware such as hooking into the keyboard driver. This made it very difficult from a purely technical standpoint to distinguish them."
Oh lord, what's next, people being executed for blogging?
The country lives and dies on activeX. Trying to do anything other than read basic text on most korean websites requires the installation of several activeX controls, which means IE only for a lot of sites. And if you want to create an account on one as a foreigner and don't have your foreign registration with immigration you can just give them copies of your passport..
I installed NCSoft's 'Exteel', a localized version of a Korean game, complete with the Game Guard nanny app that's nigh-ubiquitous when it comes to Korean games. While it probably wasn't intentional, Game Guard did disable the interface for my uninterruptible power supply when it ran, and wouldn't allow the service to reactivate until after it shut itself down.
The best response in this aspect seems to be a little of what is so irritating in windows, the barrage of popups. This is probably one of the most sensible bitter pills in windows. OK if the software manufacturers are going to be completely retarded or write malware, we are going to harass the user continually as long as the software is running. Since we cannot make them change, and only the consumer's dollar is going to help.
Sucks to be us, but that's what it takes to make developers clean up their act. Give them the choice to do it right or turn their software into something totally obnoxious.
Lets say windows had a way to detect the root kit. Code it in. Make a popup come up every 5 minutes that the rootkit was detected. Cannot be disabled. (period) First thing the developers would do is mod it to hide better. A small war starts. Microsoft being the OS author, WILL win that war eventually. And the enraged customers will force them to remove the rootkit. (all the while the devs are blaming MS of course) Such is life. I wish they'd do that. It'd be messy, but effective.
There are other fun responses to someone rootkitting your os. Make intelligent, targeted updates, that do something like wreck the registration scheme of the rootkitter. Do something that forces the customer to call the vendor for help. Make it such a sever PITA to the developer that they stop doing it.
Or simply target the error message. Imagine this popup once an hour: "Windows has detected the installation of ROOTKIT_SUPERSHOOTER3v4. This software has damaged your Windows installation and compromised the security of your computer and your personal information. Please contact the software vendor SuperCoders (link/phone number) for assistance in repairing your Windows installation, or perform an erase and install to repair the damage." That would rock.
I work for the Department of Redundancy Department.
1. Most people dont know about it. For example the South Korean nProtect Gameguard is included over 80% of online games in Asia. Only after something went wrong and the games wont load, I investigated it and found out that it acted like a rootkit, then I stopped playing online games altogether.
2. It was marketed as "anti-cheat". It wasnt supposed to be malware, right?!
3. Online-Games companies are sick and tired of fending off cheaters themselves. On top of that you have online-cash suppliers that deploy millions of bots to collect cash, selling items, inflating prices and selling online-cash to gamers. So they turned to these "anti-cheat" software.
4. Selling online-cash is lucrutive. That is why so many malware target gamers' account. Cheating tools are rigged with trojan that wont be recognised by virus scanner, they wait for a few months and then start to steal your stuff.
Gamers like us are really pissed to see entire army of bot all over the map on every server.
5. On average, anti-cheat is about 50-60% effective, but they update it weekly. It also present a challenge. It is effective to stop a gamer to cheat, however, the cash-suppliers are in the cracking contest since it is highly lucrutive.
6. The anti-cheat tools like Gameguard is language-natural, it will look for cheating tools based on Unicode/Wide-char strings, in theory it will work for any online-games. Not to mention Punk-buster is also in the same league. Just that Gameguard is particularly nasty with hiding, extremely intrusive and difficult to un-install.
What is happening is ugly and convoluted. Especially when 90% of "characters" are bots. It is very easy to spot a bot, especially when the entire group is in action. I even had fun luring big bosses (some mmorpg has big boss on each map) to ruin their party. Some mmorpg even supply their official version of "automated tools" to run your own bots, just to keep the players in the game. What fun left when the entire map is occupied by bots, and the game is basically reduced to a chatroom with only a handful of human players?
It might happen to WOW, only a matter of time.
They are a bunch of militaristic and racist bigots.
Right, unlike everyone else.
We Americans are far better than those chinks, we should'v f**k'n killed 'em all the last time we were there!
</sarc>