CastleCops Anti-Malware Site Closes Down

Fortran IV writes "Volunteer-powered anti-malware site CastleCops appears to have closed shop. As of Tuesday, December 23, the CastleCops home page notes: 'You have arrived at the CastleCops website, which is currently offline. . . . Unfortunately, all things come to an end.' It was reported back in June that Paul Laudanski, founder of CastleCops and its parent Computer Cops LLC, was taking a full-time job with Microsoft and was 'looking for new management' for CastleCops. The site has also long had problems with funding and with hostile action from spammers. The actual shutdown seems to have taken the security community by surprise; as late as Tuesday evening Brian Krebs was still recommending CastleCops on his Security Fix blog."

Comments

Hostile Action from Spammers

[nurb432]

So in other words: they won that battle.

Re:Hostile Action from Spammers

[M1rth]

Basic problem:

Castlecops were volunteers. Spammers do what they do for a living. Eventually, the volunteers have to get back to the real world, while the spammers keep going and going because you're hitting them in the pocketbook.

Either we need a lot more volunteers, or we need to start imposing the the death sentence on convicted spammers and get the root problem solved.

Re:Hostile Action from Spammers

[causality]

Either we need a lot more volunteers, or we need to start imposing the the death sentence on convicted spammers and get the root problem solved.

That'll stop spam about as well as prison terms and (sometimes) death sentences have stopped drug traffickers. What you are dealing with is not a technological problem, which is why spam filters and anti-malware efforts have not ended spam. You're not dealing with a legal problem either because even if new laws to punish spammers somehow worked perfectly, and they won't, that could only change the jurisdiction from which the spam is being sent. Not to mention that if spamming becomes riskier because more spammers are caught and punished, you will actually make it more profitable for the ones that don't get caught (possibly those from other jurisdictions) because you will have removed their competitors.

This is an economic problem. The interesting thing about economic problems is that so long as there is sufficient demand for something, the suppliers will amaze you with both their ingenuity and their willingness to take risks to deliver it. We saw this with alcohol prohibition, we see this now with the War on (Some) Drugs, and we're also seeing it now with spam. The real problem with spam is that the spammers' costs are extremely low and there are enough idiots who buy from them to make it profitable. Punishing spammers amounts to a form of prohibition. Prohibition has never worked (they can't even keep illegal drugs out of prisons) and it's not going to start working now. It really amazes me that so many human beings can understand human nature so poorly that it was ever even tried, let alone that it continues today despite any social costs and that there are still people who would suggest applying this failed idea to more novel problems. When we, collectively, try something and find out that it has never worked and is never going to work, we think the solution to that is to try harder instead of trying something else. It's like a cross between that saying about having only a hammer and perceiving everything as a nail and that saying about the definition of insanity.

If the goal is to catch a tiny percentage of them and feel vindicated while your inbox continues to fill up with spam, the "crime and punishment" approach will do. If your goal is to end spam, then your only real option is to reduce the number of people willing to buy from spammers (the demand) until spamming is no longer profitable. Like many others, I have some ideas but I don't have the solution. At this stage though, I think that what's missing is a sound understanding of the problem.

Re:Hostile Action from Spammers

[j79zlr]

I am [was] a volunteer security expert on CastleCops. I helped hundreds of people, but the task was very daunting. Back in the hayday for malware, there were literally hundreds of new posts everyday with problems that would take more than a canned response and a hijackthis log. There was only a handful of us and to be honest, I am surprised that it lasted as long as it did. I know I would get burned out and disappear for a few months then pop back in and try to help a couple people.

Re:Hostile Action from Spammers

[Zonk (troll)]

Excuse me, but what is the US Constitution's Second Amendment for, exactly?

"No free man shall ever be de-barred the use of arms. The strongest reason for the people to retain their right to keep and bear arms is as a last resort to protect themselves against tyranny in government." --Thomas Jefferson

"That the people have a right to keep and bear arms; that a well regulated militia composed of the body of the people trained to arms, is the proper. natural and safe defense of a free State. That standing armies in time of peace are dangerous to liberty, and therefore ought to be avoided, as far as the circumstances and protection of the community will admit; and that. in all cases, the military should be under strict subordination to and governed by the civil power." --George Mason

"The said constitution shall never be construed to authorize Congress to prevent the people of the United States who are peaceable citizens from keeping their own arms." --Samuel Adams

"Americans have the right and advantage of being armed -- unlike the citizens of other countries, whose governments are afraid to trust the people with arms." --James Madison

"Are we at last brought to such a humiliating and debasing degradation that we cannot be trusted with arms for our own defense? Where is the difference between having our arms under our own possession and under our own direction, and having them under the management of Congress? If our defense be the real object of having those arms, in whose hands can they be trusted with more propriety, or equal safety to us, as in our own hands?" --Patrick Henry

"[A]rms like laws discourage and keep the invader and the plunderer in awe, and preserve order in the world as well as property. The balance of power is the scale of peace. The same balance would be preserved were all the world destitute of arms, for all would be alike; but, since some will not, others dare not lay them aside. And while a single nation refuses to lay them down, it is proper that all should keep them up." --Thomas Paine

Re:Hostile Action from Spammers

[causality]

I am [was] a volunteer security expert on CastleCops. I helped hundreds of people, but the task was very daunting. Back in the hayday for malware, there were literally hundreds of new posts everyday with problems that would take more than a canned response and a hijackthis log. There was only a handful of us and to be honest, I am surprised that it lasted as long as it did. I know I would get burned out and disappear for a few months then pop back in and try to help a couple people.

I should preface this by saying that your efforts are noble and should be commended. I am encouraged any time I see people like you who are willing to selflessly try to do something about a problem especially against what must seem like impossible odds. What I would like to see this world become has a lot more of that spirit than the real world does.

I'll be honest with you and hope that how I genuinely feel about this doesn't appear to you to contradict what I just said. I don't really believe in this kind of solution, not because it's labor-intensive but because it addresses a symptom or a result instead of addressing the underlying problems that keep causing it. In other words, it is damage control and not real prevention.

If you study computer security, one (very sound) idea you will come across is the notion that once a machine has been compromised, the only way to ever trust that machine again is to reformat the hard drive and reinstall the operating system from known good media. To our detriment, the way security is generally handled flies in the face of this observation. There is a plethora of virus removal tools and spyware removal tools provided by what has become quite the cottage industry. These tools operate by detecting and attempting to remove known malware from a system that has been compromised. After the malware is removed, the system continues to be used even after it has been both compromised and proven to be configured/operated in an insecure fashion. This is perfect for the antivirus companies because the job can never be finally completed. Under this model, there will always be work in the form of finding, analyzing, and creating signatures and heuristics for new malware. Work that someone will have to be paid to do. What was a volunteer effort that caused burnout for you equates to $$$ dollar signs for them.

What is needed is a proper security system built into the OS that can prevent the compromise from happening in the first place. Windows can be found on the vast, vast majority of computers and Windows has no such security system (whether anyone else has or does not have such a system is not my point; this isn't intended to be a Unix vs. Windows debate). Further, no one in the security industry is really interested in providing one because by doing so they would kill their own market. If Microsoft tried to implement something like that, something far more effective and less of a "band-aid" than UAC, they would receive tremendous pressure to desist from an entire industry. What further complicates the problem is that there is a very large and very ignorant userbase which does not understand these issues and does not care to learn about them. Because of that, they have come to accept this as normal and "just the way things are done", as though entering into an malware vs. antimalware arms race that cannot possibly be won is an inherent feature of computing.

I hate to say it but I think this will have to get worse before anyone will be truly interested in making it get better. Call me cynical for saying so if you will, but as a culture we're not very big on dealing with foreseeable problems while they are still relatively small and managable and prefer to ignore them until they become a crisis first. I have said for some time that perhaps the best thing that could happen would be a wake-up call in the form of a virus/trojan/worm that infects a machine, spreads itself rapidly to other machines, and then destructively formats

All things?

[Tubal-Cain]

Unfortunately, all things come to an end.

Even Microsoft?

the community

[gandhi_2]

When looking for information about this or that virus, I would sometimes come across CastleCops.

The website looked a lot like all the superwindowsvirussmasher scam websites....You may have trojan.dropper.w32, free scanner here! with all the ads, color, and layout.

It's possible that it just never presented a legit-looking or professional experience. I'm no the only one who thought this...the community let it die too.

Ditto

[coryking]

The look of that site always made me nervous and I could never really tell if it was legit. Correct me if I'm wrong, but isn't CastleCops the ones who distribute HijackThis? I think so, because I'd always get nervous about downloading it from that website.

It must be hard to use AdSense on a security site like that because most of the ads would be "you may have blah blah blah". One of the flaws in AdSense, I suppose.

Re:Ditto

[DigiShaman]

Autoruns by sysinternals is a much better program. Microsoft keeps it updated here http://technet.microsoft.com/en-us/sysinternals/bb963902.aspx

Process Explorer is also another good program for killing running spyware and viruses prior to their removal (to unlock files for deletion). http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx

Not really

[an.echte.trilingue]

Being volunteer has nothing to do with it. Lots of successful anti-spam/malware projects are or were run largely by volunteers. See ClamAV and SpamAssassin.

A big LOSS for no acceptable reason

[Anonymous Coward]

This seems to have been such a badly handled shutdown. I've been tracking it since Dec 24th. and I was wondering if anyone at slash-dot would even comment. Now finally there is a thread.

By just shutting down CC, Paul Laudanski has destroyed the work of many many volunteers. All the reference pages on malware, illegitimate & legitimate dll's etc are just GONE. Additionally pages on specific projects like proximotrom (sp?), etc have just been vaporized. From what I have been able to find NO ONE was offered even the chance to archive any of these items.

It's a pretty BAD act by Paul. And while people have speculated on the reasons, Paul has not even had the decency to post any explanation. The reports of his being forced to close CC by MS, having pressures of a third child are all just speculations by others. And his defenders get very aggressive. BUT No response from Paul.

Additionally the choice of Dec 23rd to shut the site off, sure looks like it was planned for a time when fewer people might be watching.

So as to the once respected Paul Laudanski, it seems that he has displayed an arrogance adn a total disdain for DD'd supporters, volunteers and the work a lot of us contributed. Cc was a valuable resource and to have it sneakily destroyed with out any recourse is not acceptable. Paul might have had the right to do this but that does not make his actions the right thing to do.

This would definitely damage any credibility he might have had. Perhaps we should remember this ifs he ever puts his head up again. No credibility. But plenty of arrogance and disdain for others. Not very good additions to his resume.

But some will say that he may have had good reasons. OK. But that does not count unless he discloses what why. By saying nothing publicly, he has now negated the value of any good reason he might have had.

And on top of it all he managed to block any archiving. Even getting the site out of the "way back machine"

A very disgusting set of events. All done by the formerly respected Paul.

but this is just one "unbiased" opinion. :(

Re:Buy out?

[Chapter80]

Microsoft bought a controlling share in Apple

I'd hardly call $150 Million a controlling share. Microsoft bought about 8 Million shares, and there are about 800 million shares currently outstanding. So approximately 1% of current - or 4% accounting for the 2000 and 2005 2:1 splits (each).

* figures based on cnet article linked above ($150M/$19) and current stock price and market cap. This doesn't take into account new issues or share buybacks, which likely do not materially affect my case.

Your premise is wrong

[coryking]

Spamming V1aG4 isn't were the money is at. The big money is in identity theft, espionage and pump & dump schemes. These crimes are committed by using botnets that host phishing sites, send out phishing spam, and use scripts to log into bank accounts and broker accounts.

It is an economic problem, yes. It is *not* analogous to prohibition. This stuff *is* criminal and the crimes committed cost tens billions of dollars each year. The solution is *not* to just toss your hands up and say "we give up", the solution is to lock these fuckers up and toss the key. We, as a society, need to clamp down on these fuckers before they do something that really screws with us. And don't kid yourself either, these people are sitting on top of some of the most powerful distributed computers on the planet.

Chicken Bone Spammers, V1agr4 and R0l3x W4tches is old school 1998 thinking. That crap is the little leagues. The big money is in "professional," massive, highly organized, sometimes government funded crime. This is the big leagues and the assholes playing in it need to be stopped.

Re:Your premise is wrong

[causality]

Spamming V1aG4 isn't were the money is at. The big money is in identity theft, espionage and pump & dump schemes. These crimes are committed by using botnets that host phishing sites, send out phishing spam, and use scripts to log into bank accounts and broker accounts.

It is an economic problem, yes. It is *not* analogous to prohibition. This stuff *is* criminal and the crimes committed cost tens billions of dollars each year. The solution is *not* to just toss your hands up and say "we give up", the solution is to lock these fuckers up and toss the key. We, as a society, need to clamp down on these fuckers before they do something that really screws with us. And don't kid yourself either, these people are sitting on top of some of the most powerful distributed computers on the planet.

Chicken Bone Spammers, V1agr4 and R0l3x W4tches is old school 1998 thinking. That crap is the little leagues. The big money is in "professional," massive, highly organized, sometimes government funded crime. This is the big leagues and the assholes playing in it need to be stopped.

But that's exactly why new laws aren't going to work. What you're talking about there is fraud. Fraud is fraud; it's not something new just because the means of communication was a networked computer. Fraud is already universally illegal (everywhere or nearly everywhere) and this hasn't stopped the type of spam that you mention. Why? Because these criminals are finding it to be very profitable.

The laws that imprison or execute people for things like rape and murder have some deterrent effect on would-be criminals because there is generally no enormous economic incentive to rape and murder people and the desire to do those things is widely recognized as aberrant and pathological. Contrast that with spam (any kind) where there is a strong economic incentive (it's only getting worse so it's obviously profitable) and the desire to make money is generally valued and encouraged by our society -- the problem with spam is the destructive method by which that desire is satisfied, not the desire itself. In my mind, that's the difference between enforcable laws and unenforcable laws.

I believe that my previous point was sound and still applies here. The only thing your clarification changes is the application of the term "demand". Whereas before, demand constituted people who purchase items from spammers, now it also describes people who want to connect a computer to a network that is known to be hostile without learning how use it securely (botnets), people who want to make transactions without careful authentication (phishing), and people who want to get rich quick or who think that some random spammer with a stock tip really has their best interests at heart (scams). Whether such people are genuine victims or merely suffering the consequences of poor decision-making makes no difference to the spammer. A large (enough) number of people who keep doing these things despite all of the warnings against them and all of the information available is indistinguishable from the usual sense of the word "demand" as far as spammers are concerned.

What I am telling you is that so long as this is the case, you can make the penalty for this type of fraud as severe as you like and it will make no difference, for all of the reasons I have outlined in my previous post. It is prohibition because there is a large enough demand to make $ACTIVITY profitable and you are trying to eradicate $ACTIVITY by punishing $SUPPLIER in an effort to destroy $AVAILABILITY. It will fail for all of the reasons why more traditional forms of prohibition have failed.

Remember that you don't need perfectly knowledgable users running perfectly secure systems so that online fraud is completely impossible; you just need knowledgable enough users running secure enough systems to make fraud difficult enough that it's no longer profitable. Accomplishing this is merely very difficult; catching, prosecuting, and punishing enough spammers to achieve anything resembling "stopping spam" is utterly impossible.

Re:I agree

[causality]

I always appreciate such a well-reasoned response.

My only concern is, and I doubt you are part of this, sites like Slashdot seem to carry a strange attitude that because something takes place on a computer, it is immune from law.

I think much of that comes from the "artificial scarcity" nature of copyright and the repeated extensions to both the duration and severity of copyright law. Our legislators are not carefully evaluating whether or not technology has made this model obsolete and using the results of that evaluation to make any necessary adjustments. Instead, they are applying more and more "brute force" to the law by turning formerly civil matters into criminal matters to appease various monied interests, as though such complex problems could be solved so easily. Not surprisingly, the reaction to this has not been a good one.

You sometimes see comments from people who whine about a spammer getting 10 years in jail--"they didn't hurt anybody". You'll get a story about some fuckhead getting 5 years for hacking a corporate network and some comments will bitch "they were just learning, and besides people should lock their doors better". All of it silly nonsense that has no place in our industry.

Part of it too is that the reason why you should have reasonable laws that are not weighted too heavily in favor of any particular group is because when people lose respect for the law, they tend to lose respect for the entire institution. It is trendy these days to "make an example of" people who commit certain crimes and sometimes the question of whether the punishment fits the crime is well-founded. There is also the possibility that a free-for-all network where all forms of computer intrusion are legal will result in more secure systems than would a regulated network where such people are prosecuted. This boils down to a form of Darwinian natural selection. I'm not saying it's a good or desirable possibility, only that it may be true regardless of anyone's personal feelings about it. A spammer getting 10 years doesn't bother me, so long as this is for actual fraud/ID theft and not merely because otherwise legitimate business offers were unsolicited, and so long as we aren't releasing violent offenders early to make room for them like we do in the War on (Some) Drugs. I am not agreeing with or defending the views you mention. I simply find it edifying to understand where viewpoints come from, especially those with which I disagree.

Tossing your hands up and saying "we give up" means we just blame the user, blame the system admin, or blame anybody but the criminal. Often times they won't even be labeled as criminals, worse they'll manipulate language to make them sound like some kind of modern hero (Hacker vs Cracker is nothing more then straight Orwellian doublespeak). I think such talk is a form of denial and worse a form of insidious propaganda. It is also a byproduct of a more innocent time in our computing history.

Let's just say for the sake of argument that an Ultimate Solution to the Spam Problem has been found and that this Solution can be absolutely rigorously proven with 100% confidence. If it turns out that the Solution is for the users to alter their computing habits, would you say someone was "blaming the user" if they advocated it? I believe that too much concern for who is at fault, for at whom we can point the finger, is counterproductive. There's a certain visceral satisfaction to it if you need that but it's not good problem-solving, especially if your goal is prevention. It can cause good ideas to be discarded for no reason except that they affect someone other than the perpetrator.

Look no further then how nature deals with nasty stuff. Study our own immune systems. Study the immune systems found in nature. The two are very similar. How we combat AID's or the common cold are good starting points for how we combat online crimi