Slashdot Mirror
Researchers Hijack Storm Worm To Track Profits
An anonymous reader points out a story in the Washington Post, which begins:
"A single response from 12 million e-mails is all it takes for spammers to turn annual profits of millions of dollars promoting knockoff pharmaceuticals, according to an unprecedented new study on the economics of spam. Over a period of about a month in the Spring of 2008, researchers at the University of California, San Diego and UC Berkeley sought to measure the conversion rate of spam by quietly infiltrating the Storm worm botnet, a vast collection of compromised computers once responsible for sending an estimated 20 percent of all spam."
The academic paper (PDF) is also available. We've previously discussed another group of researchers who were able to infiltrate the botnet for a different purpose.
How come they don't track down the IP addresses of infected computers and inform the users their computer is compromised? It seems these researchers also are getting a kick out of the botnet at the cost of the victims.
They must be really smart. After all, how are they able to figure out how it is that I'm in need of a bigger schlong, can't get it up w/o viagra and need a new Rolex at bargain prices and I'm looking for a Russian wife. I mean, what kind of research have they been doing to target me perfectly?
HexaByte - he's a square and a half!
I don't have any data to back this up, but it seems to me that people are migrating from small provider companies to big internet provider companies - and their e-mail is going together. And it also seems to me that all those big companies have good e-mail filters (or they're getting one that will be good in a small period of time). If that's true, spam will face a dead end pretty soon.
Even if you stay with a small provider company with your personal e-mail, there are many good solutions to avoid spam. I used Popfile for a long time and it worked pretty well.
Either way, if people will go to their spam box and click that viagra ad, it will be their problem. It doesn't affect me anymore.
Any life is made up of a single moment, the moment in which a man finds out, once and for all, who he is.
You post on Slashdot?
Oh, Spam... right.
When I first read the title, I was thinking more along the lines of:
Bless the Maker and His water.
Bless the coming and going of Him,
may His passage cleanse the world,
may He keep the world for His people.
-- Frank Herbert
-- Working to secure tomorrows technology. Honestly Officer!
I realize this will either be wildly popular with you or you'll hate it, but what I'd like to see someone do is infiltrate the botnet somehow (either by vulnerability or crack their key or whatever) and send a command to the herd to zero the boot sector and shut down their host. (the zombies, not the herder's machines)
Nothing enough to cause data loss, but enough to force the naive owners to take their machines to someone to get them fixed/cleaned up. I'm tired of being a victim of computer neglect en masse.
Not saying there's just one botnet out there, so I'd be greatly entertained to see them fall one by one. Should make a nice spectacle. Wouldn't it be entertaining to get up tomorrow and read front page stories all over the place the likes of which we got with Code Red, that a sizeable chunk of zombies just dropped off the grid and there were long lines at the PC repair shops this morning? Stories of entire businesses being brought to a halt because 95% of the machines in their office were owned? Sorry, but "serves them right", and thank you have a nice day while I go check my mail and see 80% fewer medications for sale.
I work for the Department of Redundancy Department.
Actually, I'd rather they be made to pick up a piece of litter for every spam email they sent, or some other such public service that equates piece for piece to the amount of spam they have sent.
Repaint a house for someone = 100 spam messages
Clean up a city block of litter = 100 spam messages
Well you get the point. Force them to wear bright yellow spandex jumpsuits with the spam logo on it until they have fully atoned.
Whatever the punishment, it should be public, and only mildly degrading.
Something that lets us all remember what they did, and what it costs in reparations.
Support NYCountryLawyer RIAA vs People
the researchers seem to take the legality of their actions under serious consideration. From TFA:
"Measurement Ethics:
We have been careful to design experiments that we believe are both consistent with current U.S. legal doctrine and are fundamentally ethical as well. While it is beyond the scope of this paper to fully describe the complex legal landscape in which active security measurements operate, we believe the ethical basis for our work is far easier to explain: we strictly reduce harm. First, our instrumented proxy bots do not create any new harm. That is, absent our involvement, the same set of users would receive the same set of spam e-mails sent by the same worker bots. Storm is a large self-organizing system and when a proxy fails its worker bots automatically switch to other idle proxies (indeed, when our proxies fail we see workers quickly switch away). Second, our proxies are passive actors and do not themselves engage in any behavior that is intrinsically objectionable; they do not send spam e-mail, they do not compromise hosts, nor do they even contact worker bots asynchronously. Indeed, their only function is to provide a conduit between worker bots making requests and master servers providing responses. Finally, where we do modify C&C messages in transit, these actions themselves strictly reduce harm. Users who click on spam altered by these changes will be directed to one of our innocuous doppelganger Web sites. Unlike the sites normally advertised
by Storm, our sites do not infect users with malware and do not collect user credit card information. Thus, no user should receive more
spam due to our involvement, but some users will receive spam that is less dangerous that it would otherwise be."
However, their premise of "reducing harm" is questionable. How can we be sure that a person who decided to purchase these drugs (against all warnings) really believes that not buying them is the best thing for him? What if this person really wants to purchase a drug that he thinks will enlarge him? Who gives the researchers the right to decide what other people should spend their money on? Under several legal interpretations, forcing a person not to buy something perceived as harmful is not legal: denying to sell cigarettes to a person of legal age may be illegal, under discrimination laws.
The bottom line is that the researchers have a good point regarding the ethics of their study, however this issue is not 100% resolved.
#1. The ISP blocks all outgoing port 25 connections. We've been over this one before. It means more expenses for the ISP so they're not going to do it unless they are forced to do it through law.
#2. The vigilante approach of writing a "virus" that identifies and infects infected computers ... and then removes the existing infection, downloads updates, installs a silent anti-virus app and checks back in at regular intervals for updates. The problem with that is that the people who do it become "criminals" under US law.
Consider it a form of quarantine.
Deleted