Slashdot Mirror
Schneier On Scareware Vendor Lawsuits
Bruce Schneier's blog says "This is good: Microsoft Corp. and the state of Washington this week filed lawsuits against a slew of 'scareware' purveyors, scam artists who use fake security alerts to frighten consumers into paying for worthless computer security software. "
Microsoft is as big a culprit of this as anyone.
Give me Classic Slashdot or give me death!
Sounds a lot like an average Windows advertisement.
Why does this even reference Bruce Schneier's blog? There's no added value from there. Why not just reference the original article?
http://www.schneier.com/images/book-sos-175w.jpg "The closest the security industry has to a rock star" Well, if that's the case, I'll believe anything he says then. I love rock and roll.
If Schneier wants to stop scaring people he should consider trimming his beard. That face-fro looks like it runs Crysis.
scam artists who use fake security alerts to frighten consumers into paying for worthless computer security software
It was an Apple thing I think warning about some company who was pushing some "extra secure" version of its operating system which in fact gave you less performance and kept nagging at you the whole time. Yup I thought so.
Oh wait this is some OTHER companies who use security as a scare threat via nagging messages to get you to buy software.
An Eye for an Eye will make the whole world blind - Gandhi
I'm truly impressed that people can come up with security warnings about Windows that are not true... after all, is there anything as insecure as Windows?
The only thing I think they may have a case with is of course the fake software, as in software that does not do what is advertised. And I'm not even thinking of Windows itself this time.
I'm actually kind of surprised Microsoft has taken this long to take action against those "scareware" guys. It sort of makes one wonder how much of a legal leg they have to stand on. Any lawyers/other legal minds care to weigh in on that?
The Uber
http://www.tulg.org/
http://devurandom.livejournal.com/
Microsoft is as big a culprit of this as anyone.
We're all aware of MS' past and current business practices. Although, MS seams to have been cleaning up their act lately.
I bored a bit with the "MS has done worse." or the "M$ is evil." and etc. It's been done to death here on /. and it really doesn't add anything to the threads - it never did, actually. It was a cheap way to karma whore. And looking at your UID, I would think you're beyond the karma whore stage.
I'm confused, I don't use windows, but surely somebody could just change the desktop colors and then when a warning alert turned up in the old colors they would know it was a scam?
Is that too obvious?
The law referenced "makes it illegal to misrepresent the extent to which software is required for computer security or privacy." This is such a fishy thing that I'm not really sure if I want courts to determine what exactly is required and therefore whether it is being misrepresented.
Now, maybe there's a case for fraud if the program doesn't do what it purports to do in its advertising, but that doesn't seem to be what's at stake here.
There also might be a case for fraud if, perhaps, the advertising pop-ups are being confused for actual Windows messages. But I suppose in the "real world" advertisements mimic other things to be creative, but are still fairly obviously ads.
Just not sure I like the sound of a law that requires a judge or jury to determine what's required for computer security.
--
Hey code monkey... learn electronics! Powerful microcontroller kits for the digital generation.
Sounds like it could be used for Microsoft to take a swing at all of the legitimate anti-virus/scumware/etc apps for advertising how critical their software is because Windows has so many problems.
The only change I can believe in is what I find in my couch cushions.
The issue here isn't so much the users getting taken by scam artists. It's bad bloody design. Windows alerting mechanism is so confusing and broken that users can't tell the real Windows alerts from the fake ones. This is MICROSOFT'S fault. Not the scam artists.
Suing the people who exploit Windows design flaws is not the solution. If you leave a door open, suing people for walking through it is not the right fix. The fix is to close the door.
So, yay for Microsoft recognizing the problem and at least doing SOMETHING. But this is simply not the right response.
The legal 'teeth' for these actions is the RCW. Scumware purveyors are exactly that - scum. It will be fun to see a weasel in the ring with a tag team of 800 lb gorillas.
The law referenced "makes it illegal to misrepresent the extent to which software is required for computer security or privacy." This is such a fishy thing that I'm not really sure if I want courts to determine what exactly is required and therefore whether it is being misrepresented.
What, like WGA (windows genuine advantage) claiming to be a security update that is needed for the safe & secure operation of windows XP?
I smell a big lawsuit coming...
your nerdkits spam is getting really old...
"the law makes it illegal to misrepresent the extent to which software is required for computer security or privacy,and it provides actual damages or statutory damages of $100,000 per violation, whichever is greater."
lol, so all the anti-virus software companies(Norton, NOD32,VET etc) and anyone selling 'personal firewall software' is pretty much screwed.
...and that is all I have to say about that.
http://jessta.id.au
So, the State's Attorney actually understands and wants to do something about scareware. A judge recently ruled that under Washington law Cingular's forced arbitration concept was unconsionable.
A state with a clue!
[...]scam artists who use fake security alerts to frighten consumers into paying for worthless computer security software.[...]
Isn't most computer security software useless anyway? I GOT NORTON YOU CAN'T TOUCH ME!
nonconformity at work
Obviously something needs to be done, but of all people to file a lawsuit, what gives Microsoft the right to do this? Either way i hope something gets done, such software is not only pointlessly malicious, but it also turns people away from computers and the internet. Maybe it is a good thing, if anyone has the resources to tackle this Microsoft does.
Garrett
It kinda looks like this law is written almost exactly with WGA and other nasties in mind.
How we know is more important than what we know.
Or, you know, it could be used to take down the people behind malware software such as XP Antivirus.
Understandable, exusable but bad nonetheless.
When will these ultra-liberal, extremist zealots realize that more regulation just doesn't work? It is no suprise to see that the term "worthless security software" should be bandied about by such out-of-touch elitist snobs. We all know that the free market should determine what is "worthless" and what is not. Why do socialist thugs like Microsoft and the Washington State Attorney General's Office get off, trying to bully patriotic, tax-paying, small computer security businesses this way?
but surely somebody could just change the desktop colors...
It's worse than that, because it's even more obvious.
This is where the end-user epic fail really is:
Security Alert - Windows Internet Explorer
Or
Security Alert - Mozilla Firefox
End users have so trained themselves to not actually read dialogs that they simply can't tell something they've seen before from something they have not.
It doesn't take a genius to sit at a computer for hours, and hours, and hours on end, every day, at work and at home, to recognize that your "Security Alert - Windows Internet Explorer" causes the cursor to turn into a pointing finger, just like a hyperlinked picture does on the web.
It's the inability of people to grasp these kinds of subtleties, despite years upon years of on-hands experience, that makes security a nightmare and things like UAC such a necessity.... Of course, then we get back to the whole not reading dialogs bit.
Also, predatory software programmers really have culpability. [badanalogy] But to similarly say that it's not your fault you got mugged because you flashed $2000 in cash at 1:00 AM in a biker bar that you've been going to every night for drinks for the last 6 years makes you similarly sound like an idiot.[/badanalogy] Common sense has not much prevalence in the average end-user. Or mugging victim.
Boot Windows, Linux, and ESX over the network for free.
I wouldn't anger him... Bruce Schneier can get identity information from an unpowered, unconnected remote machine, just by glaring in its general direction. If he's feeling particularly good, he doesn't need the direction.
I'm glad someone is finally taking action against these malware scammers. I do tech support part time and 95% of my recent virus removal jobs have involved these nasty little programs.
What actually happens is a lot of these people will go to visit porn sites (or sometimes this is not even necessary). They'll get a pop up from the site saying that they're infected, and that they should download the program. That infection can then lead to more serious malware coming on to the computer, and in some cases, will load that fake BSOD with crap BSOD messages while the infection is doing it's bidding in the background. I think the main reason microsoft is part of this is because alot of what I see in the field is stuff like XP Antivirus 200x or Vista Antivirus 200x. Of course, simply uninstalling these programs does nothing. One would really need to get a program like ReVo Uninstaller to remove it, or remove the program manually. Then what happens when people, like some of my client's have done, call Microsoft complaining that microsofts program is not removing the viruses it found after they paid their money...
"makes it illegal to misrepresent the extent to which software is required for computer security or privacy."
Why stop with software?
A majority of the work of doctors and lawyers is just misrepresenting the extent to which their services are required. Why not make a law to stop them. Seriously, most business is just tricking someone ignorant of your expertise that your services are necessary.
I'm actually not sure what you're trying to say... Your comment vaguely appeals to \. sentiment, but what exactly are you getting at? MS spreads FUD is somewhat off-topic...
Are you suggesting that MS scares users with security alerts into purchasing their software, which is legendary for being secure?
An important update to your software is available! Please download and install "Windows Genuine Advantage" now!
He's well known for his symmetric cipher work, but this is generally considered a hard subject by CS types and considered easy by mathematicians. AES is good, but there were lots of good runner ups, including Schneier's. But it's not that hard. It's basically the newspaper jumble. I agree he is a bit of an over rated blowhard, who's reputation rests largely on a terrible book that is popular with computer scientists who mostly don't know cryptography, only network security.
You know, every new version of Windows gets advertised as "OMG SAFEST WINDOWS EVAR" and every new version of Windows seems to have more security holes than the previous version.
While not on the same level as the scareware vendors, it's certainly similar.
Oh, did you pay for Windows Genuine Advantage? If so, please go buy a Mac ASAP.
That these programs claim to fix something for you but actually don't or even worse are Trojan Horses themselves. And yes, I know that some people think that Windows is a Trojan Horse, phlyambaeit away.
Hmm...I've never heard anyone criticize Schneier's book before.
Please give us your recommendation for a book on cryptography that is highly regarded by people who know cryptography (perhaps in addition to knowing network security).
*sigh* back to work...
Stinson
Sounds like it could be used for Microsoft to take a swing at all of the legitimate anti-virus/scumware/etc apps for advertising how critical their software is because Windows has so many problems.
In that case, can we use the bit that says "illegal to misrepresent the extent to which software is required for computer security or privacy" to sue Microsoft for advertizing "the most secure version of Windows yet" and claiming that the likes of XP and Vista are designed in a security concious way (implicit in the above) as opposed to implementing the likes of UAC?
... the one you got while trying to run Windows on DRDOS?
Have gnu, will travel.
Somewhere, Microsoft's explicit statements of non-warranty of fitness and non-warranty of merchantability for its products has got to come into play here (http://en.wikipedia.org/wiki/Implied_warranty).
In some ways, Microsoft uses its own lack of built-in security features in its products to sell its own other products that provide said security functionality...
This lawsuit seems to be bound a bit in circular logic, and I don't think really benefits the consumer in the end at all.
Microsoft making their products (i.e., Internet Explorer) resistant to the paths some of these popups, on-line ads, etc. use^h^hexploit to install their stuff "on behalf of" the user, well...would that benefit the customer? Yeah...
every new version of Windows seems to have more security holes than the previous version.
Really? XP had more holes than ME? Vista had more holes than XP? You're clearly letting your opinion dictate the facts, and not the other way around.
Similes are like metaphors
Actually, you're thinking of Chuck Norris, not Bruce Schneier. Don't feel bad though, people make that mistake ALL the time...
I work at an IT Help Center at a university, and I see this as a method of infection and scam sales all the time. A whole ton of people install the trial ware that these advertisements push, and I've seen a few even buy the fake antivirus software. We offer virus cleanings, and one quick way to see if a machine is infected during an initial assessment is to see if there is fake antivirus trialware installed.
Modern commercials rely on one of two things to sell a product or service. One, you will improve your chances of having sexual intercourse with a desireable mate if you purchase our product/service. Two, you are in danger and you need to purchase our product/service to be safe. Over the past couple of years the "scare" meme has turned into more of a direct threat. The best example is those horrible, evil free credit report dot com commercials, where they come out and say if you don't buy our product you'll lose all your money and have to work at a crappy seafood restaurant and drive a shit car (the fact that they're selling something is only to be discerned in the fine print at the bottom of the commercial and the last few words, quickly rattled off, at the end of the commercial). "Buy our product or be poor" is a threat. Auto insurance companies do this a lot too... I just saw an Allstate ad that showed a family losing all their money due to a car accident because they didn't have Allstate insurance. None of these threats is a legitimate concern for consumers. There's nothing different about saying consumers have a security problem on their computers and need to buy software to fix it. "Buy our product or hackers will destroy your computer and steal your private data." It should be illegal to threaten consumers. Such commercial speech should not be protected by the First Amendment.
Stupid people make stupid things profitable.
Except the numbers seem to mostly back me up here.
Windows 2000 Professional: 182 Secunia advisories, 165 vulnerabilities. http://secunia.com/advisories/product/1/
Windows XP Professional: 219 Secunia advisories, 202 vulnerabilities. http://secunia.com/advisories/product/22/
Windows ME: 35 Secunia advisories, 21 vulnerabilities. http://secunia.com/advisories/product/14/
Windows XP Home: 199 Secunia advisories, 184 vulnerabilities. http://secunia.com/advisories/product/16/
I'd say it's too early to tell whether Vista has more holes than XP, but it certainly could. Currently, there are 40 Secunia advisories and 63 vulnerabilities.
Except that you'd have to evaluate whether these are cumulative. Not saying they are, but does ME also have the holes that are shown for XP Home, but is simply not evaluated anymore? Does XP pro cure the ills of 2000 pro, and just have new, different holes?
I'm not any of this gets us anywhere, but I'm always suspicious of simple counts.
I was taught to respect my elders. The trouble is, it's getting harder and harder to find some.
"Your comment vaguely appeals to \. sentiment,"
There's a Slashdot equivalent for Windows fans?
being sued. Someone should sue M$ for selling such a shit OS that can't prevent this sort of stuff from happening in the first place. M$ should do the world a favor and get out of the software business. They clearly suck at it.