Slashdot Mirror
Microsoft Slaps $250K Bounty On Conficker Worm
alphadogg writes "The spreading Conficker/Downadup worm is now viewed as such a significant threat that it's inspired the formation of a posse to stop it, with Microsoft leading the charge by offering a $250,000 reward to bring the Conficker malware bad guys to justice. The money will be paid for 'information that results in the arrest and conviction of those responsible for illegally launching the Conficker malicious code on the Internet,' Microsoft said today in a statement, adding it is fostering a partnership with Internet registries and DNA providers such as ICANN, ORG, and NeuStar as well as security vendors Symantec and Arbor Networks, among others, to stop the Conficker worm once and for all. Conficker, also called Downadup, is estimated to have infected at least 10 million PCs. It has been slowly but surely spreading since November. Its main trick is to disable anti-malware protection and block access to anti-malware vendors' Web sites."
2. Give it to a bunch of script kiddies anonymously in bulletin boards.
3. ...
4. Turn them in to MSFT for the bounty.
5. Profit
sed -e 's/Chuck Norris/Rajnikant/g' joke > fact
Pirates of the Indian Ocean were asking for multi-millions. 10 million zombie PC's are worth more than $250K. Dig deeper MS.
Until you know who launched this, under what circumstances, and in which jurisdiction, don't assume that it's illegal. In other words, innocent until proven guilty.
These guys abuse a problem but they also raise awareness for a security problem Microsoft has put into existance through its operating system software. This company should pay and offer its customer to remove the worm for them and compensate them for all the costs caused by their defect software. The guys just exploited the weakness.
Though Microsoft offered a patch I don't remember that Microsoft actively informed its customers about the defects of its software and apologised to me or that my hardware vendor recalled the hardware.
I think they meant DNS not DNA.
Heh M$ pay anything, I don't think so. Like that Simpsons' episode where M$ buys Homer's company: "...you don't think I made money by writing checks ...break 'em up boys....."
"The Brady Bunch is back...working homicide"
Microsoft, release a mandatory update to turn off auto-run/play, and show a reoccuring opt-out prompt on login that explains that auto-run is turned off, and the risks of turning it back on.
At least make XP's version of the patch that allows GPO auto-run disable to work properly a mandatory update. If no one's in a GPO, it won't break anything. If they are in a GPO that turns autorun off, then it should be turning auto-run off!
Actually making a decent OS?
NO SIG
Since when has ICANN been providing DNA?
-Bucky
'information that results in the arrest and conviction of those responsible for illegally launching the Conficker malicious code on the Internet,'
Has Conficker done anything malicious yet? Last I heard it all it has done is to extend and protect its installed base and has not yet been used to do any attacks. It may yet only be used for SETI@Home, Folding@Home, winning a decryption contest, or analyze other spam-producing bot nets to identify their controllers and get them shut down.
Oh, say does that Star-Spangled Banner entwine / The myrtle of Venus with Bacchus's vine?
I didn't know that part of ICANN's charter was providing DNA. I don't recall my ISP demanding a cheek swab from me when I signed up, so from where is ICANN getting the samples?
"as you wisshh"
intellectual property law is philosophically incoherent. it is your moral duty to ignore it or sabotage it
US$398 to fix security problems with their software...
"Not an actor, but he plays one on TV."
They need to offer upwards of 5 to 10 million dollars. With a bounty of $250,000 I don't think they will be caught. And $10 million is chump-change for Microsoft... they buy laws for more than that.
One of the first things I do whenever I have to install Windows is turn off the AutoRun, because there's nothing more annoying than putting a CD/DVD/USB flash/USB harddrive in a machine and either having some software automatically run (when most of the time you don't want it to run) or a window popping up saying "oooh, you've got lots of pictures/videos/music on this device, let me play them all for you pleeeeeeeeeese"
So back to my post title, if a Skynet equivilant does decide it wants to rule us, it will have been able to gain the necessary power over us through the human race's apathy towards hands-on involvement of computers - having everything automated is not a wise choice, as the Conficker worm is so aptly demonstrating.
To do something right, you often have to roll up your sleeves and get busy.
Here's how it works: I accuse you, you take the fall, and we split the reward. You just have to sit in jail for whatever period of time. Of course, keep in mind that there will probably be hefty fines that will meet or exceed your portion of the reward.
Can "The money will be paid for 'information that results in the arrest and conviction of those responsible for " be contrued as fine print?
OK. Say I know where these guys live and have some preliminary evidence and turn that in. This leads to an arrest. But later, the lawyers screw up or whatever and these guys are NOT convicted. What happens then? Do I get 50%, 20% or 0%?
Has bounty hunting always meant "we will get you your cheque after the convition?" Wasn't like that atleast in Do Androids Dream of Electric Sheep.
Ramanujam
When MS learns how to write secure code for less money than what they offer to catch the script kiddies they would do the former. I wonder what happens to the MS coder/team that is responsible for the exploit?
Hallowed are the Ori
DNA providers such as ICANN, ORG, and NeuStar
Hey, I'm a DNA provider too, baby.
Boba Fett, I choose you!
but does this run on Linux?
$250 Large? - My mother did it!
Given the secretive, highly technical, and often nasty nature of the people that may be involved I am not sure that this is enough of a reward.
How long till we have ex-con guys with arms as big around as a SAN busting into peoples houses and apprehending them for both money and the entertainment of people who love to watch skinny jerks try to wrestle with a human tank?
The musings of just another geek and his junk.
Mean... "Do Not ASK!" As in, "We really cannot tell you this is a ruse by the various world government bodies to throw you off the track that it really is them, and that this is an extension of and a fallback to the untimely exposure of government AT&T affiliate offices that snooped traffic everywhere."
But, maybe my thinfoil hat is unpossibly tooned...
Previously: "Linux... Toward the Sunrise..." Now: "Linux... Toward the-- No, now, part of Every Sunrise"
"The spreading Windows 7 worm is now viewed as such a significant threat that it's inspired the formation of a posse to stop it, with Public Sanity Service (PSS) leading the charge by offering a $250,000 reward to bring the Windows 7 malware bad guys to justice. The money will be paid for 'information that results in the arrest and conviction of those responsible for legally launching the Windows 7 malicious code on the Internet,' PSS said today in a statement, adding it is fostering a partnership with Internet registries and DNA providers such as ICANN, ORG, and NeuStar as well as security vendors Symantec and Arbor Networks, among others, to stop the Windows 7 worm once and for all. Windows 7, also called Windows Vista SP2, is estimated to have infected at least 90% of all PCs worldwide. It has been slowly but surely spreading since January. Its main trick is to also malware installation and authorize access to malware vendors' Web sites."
EULA : By reading the above message, you agree that I now own your soul.
Guess big A/V companies don't like the competition because we all know who makes the viruses...So they pay Microsoft to put up a bounty. I applaud these guys.
I was thinking about this, and thought of a way to counter this threat...
Patch the vulnerability!
Who do I see about dropping off my resume?
After logging in slashdot still does not take you back to the page you were on. It's been that way for 20 years.
The worm authors made just one mistake... they were far too successful. They wanted a botnet. Maybe a few thousand computers. Maybe 10 - 20 thousand.
Instead, they wrote a fast spreading worm that infected millions of computers.
What's the difference? The guys who infect 10,000 computers are small fries, and no one is going after them. Infect millions of computers though, and every computer crime agency on the planet will be after you...
Symantec, which is contributing its malware-analysis expertise to the group, believes there are two main versions of Conflicker, "Flavor A" and "Flavor B,"
The flavors were determined using LOLCATS. True story.
Show me on the doll where his noodly appendage touched you.
Botnets, global botnets.
What kind of boxes are on botnets?
Compaq, HP, Dell and Sony, true!
Gateway, Packard Bell, maybe even Asus, too!
Are boxes, found on botnets.
All running Windows. FOO!
Guaranteed! This comment 100% Anthrax free!
The MS bounty program has been running since 2003. Thus far they have paid out only one award of $250.
Help stamp out iliturcy.
Hey, I GOT HIM. Even made a photo for you.
Now sack him and send the bounty to my paypal please.
This is the guy who is currently officially responsible for windows being vulnerable to worm and malware attacks.
There have been others in the past but your bounty explicitly asks for the person responsible for this current "conficker" worm, so here you go.
We'll find the terrorists.
I'm so sick of how anything that criticizes microsoft on slashdot gets modded up on slashdot, and...oh, nevermind.
Well maybe they should make a decent OS. Or stop partnering with companies for the purpose of killing them for the secondary benefits. Or suing their customers. Or stealing ideas like Stacker. Or paying Gartner to release "studies" that exclaim their new products are taking off like a rocket. Or taking a perfectly good webmail like hotmail and turning it all greasy. Or trying to kill decent software companies like Netscape, Corel and Adobe. Or launching disinformation campaigns like "get the facts" and "Mojave Project". Or generally puking all over everything in IT. Or paying folks like SCO to sue decent folk who are just trying to use decent software. Or... oh screw it. None of that is ever going to happen. Never mind.
Slashdot is never going to like Microsoft.
Help stamp out iliturcy.
This program, which has been in place since 2003, has paid out a grand total of $250. All of it in one whopping check to the college mates of the Sasser programmer. Presumably they split it and bought some beer. The program manager must be quite proud of himself.
In related news, Microsoft is working with ICANN and others to prevent the registration of the domain this thing calls home to. It probably hasn't even occurred to them that the programmers ran their random name generator out a long way in advance, registered the domain in the name of some perfectly innocent third party long ago and that they're too late because launch day for downadup is tomorrow since they always kick these things off of the eve of a holiday weekend.
If you admin Windows desktops, I wouldn't invest too much in your plans for this weekend.
Help stamp out iliturcy.
When MS learns how to write secure code....
Apparently Microsoft hires the brightest minds on H1B visas from around the world, draining the IQ of the planet on their way to spending $9 Billion a year on research and development. One must presume that they know how and that they don't care.
Help stamp out iliturcy.
Then the cure will be worse than the disease.
Help stamp out iliturcy.
It has been slowly but surely spreading since November.
If 4 million installs a month is slow then what is fast? Vista? ORLy?
Help stamp out iliturcy.
250K ought to be enough for anybody.
*ducks*
Blaming an operating system for getting infected by a virus or an attacker of some sort is like blaming the victim for getting mugged when he's not allowed to shoot back.
It's time to get serious about going after botnets and the control network is the key. Follow that baby back to its origin, and shoot the guy holding the switch. If the network crosses into a country that doesn't allow that sort of thing, cut it off. It's not right to subject plenty of law abiding companies and people to this false ideology of passive defense.
Passive defense has failed, and its time to go on offense. The more hackers you have up rotting at the end of a rope at various computer fairs, the less likely people will be willing to attack. Now is not the time to be squeemish about the death penalty. If you can convince yourself a fetus isn't human, convince yourself that criminals aren't either, and kill them.
This is my sig.
1. Write an operating system and spend seven minutes making it secure ...
2. Sell it to a bunch of VPs, CTOs and OEMs from arm's length.
3.
4. Offer seven minutes worth of earnings to whoever catches "the bastard" that tried to rain on their parade
5. Profit!
I am literally 3000 tokens away from the chaotic crossbow --Stephen
Girls who want intelligent babies pay more than that for my sperm. Only the half-wits at Microsoft could imagine that the guilty parties (and the people who know them) carry less than $250,000 in their wallets.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
Sorry, but this one is definitely your operating system's fault.
And get lawsuits from John Scherer the Video Professor who's lessons play on your screen like a VCR?
Imagine if the worms generated botnet become a global A.I.
âoe/. archives registered that botnet accessed to autonomous conscience April the 1st, 2009 ADââ¦
That IBM report does not state anything about MS patch time, and it was not what I wrote about.
The GP was talking about "writing secure code". By that I assume he meant writing it secure in the first place.
And in that area - contrary to popular myth - Microsoft seems to lead the pack. If you don't consider those who didn't even make the list, like the BSDs.
Why don't you read the report? There is more in there than mere operating system security, although that is probably the part that will ruffle feathers on /.
Microsoft comes out as the vendor with most vulnerabilities (across all products) overall. No surprise there, as their product portfolio is quite large. That IBM and Oracle are also on the list is also no surprise. They also have huge software portfolios.
But Apple makes it to 2nd spot, that was a bit surprising. They produce much fewer software products than the others.
But perhaps most alarmingly is the fact that several PHP based single-product vendors made it on to the top-10 list by virtue of their single products.
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
..but i would never turn him in, not even for 100 millions. it's just more fun to watch american war ships unable to navigate because of a little well designed program. developers, developers, developers do the monkey dance. mahahaha!
Ballmer found a worm in his tequila bottle and asked me to look into it. No prob Steve. Don't let the chair hit me on the way out!
Say hello to my little sig.
This plan needs a name. How about calling it "The Quicker Picker Upper"?
Say hello to my little sig.
I support this like I support putting police bullets into gang members. Excellent use of tax dollars, but problematic to ensure power is not abused.
Yes, indeed. But does the average l33t skr1pt k1dd1e know this ? Very unlikely.
Most of them will probably think : "OMGLOL PWNIES ! Fast'n'easy bucks FTW ! KTHXBYE !" (or something along these lines)
and then try to pull a Joe job.
Net result : even more compromised machines everywhere as script-kiddies try to enact their "perfect plan to quickly earn money".
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
Whenever I see updates available on Linux, I know there is probably a fix or an improvement waiting on me.
For whatever stupid reason, on Windows, I always wonder what the next update is going to take away.
Doctors destroy health, lawyers destroy justice, universities destroy knowledge, religion destroys spirituality
Once again I tell Slashdotters, turn them over to me. I will make an example of them and post it to youtube for as long as they will carry it.
I will do things that make the Hellraiser series look like Disney films. You will see up close just how inhumane man can be and all for my own personal entertainment.Well, o.k. I also have a thing for vandals,thieves and pedophiles.
Send them to me.
*Repent!Quit Your Job!Slack Off!The World Ends Tomorrow and You May Die!
for his company was listed as #5.
nice try.
Here we are in the middle of a thread discussing how a recent one of the million pieces of Windows malware has zombied 12 million computers around the world, and you're here to remind us that Windows is more secure because somebody somewhere said so.
Nice. Thanks.
Help stamp out iliturcy.
The GP I replied to suggested suing Microsoft because of all of the vulnerabilities.
I then pointed out that according to a normally respected organization (IBM) who did their homework, other OSes have far more vulnerabilities, alas we could sue Apple 3 times over and, well, Linus? 2 times over.
But then you jump in and once again equates vulnerabilities with exploits. And on top of that calls me a troll?
Get a clue will you? There is a difference between a vulnerability and an exploit. In case you don't know the difference is exploits are created by attackers taking advantage of vulnerabilities.
If you want to sue some company on the basis of something they did or failed to do, you may try to sue on the basis of vulnerabilities.
Your reference to exploits created by attackers is totally and utterly out of context here.
Or are you again trying to use the number of exploits that exist for Windows as "proof" of the perceived vulnerability of that OS when we actually have much better real data (vulnerabilities).
Or is your problem that some other OSes appear to have more vulnerabilities?
Reading slashdot one-liner: (irm http://rss.slashdot.org/Slashdot/slashdot).rdf.item | fl title,desc*
And on top of that calls me a troll?
Not quite. I was calling the post a troll. And a good one. If that wasn't your intent, well, I'm sorry - I take back the compliment.
Thanks for the laugh though. I needed one today.
Help stamp out iliturcy.
The IBM report shows that Microsoft has actually improved *a lot* since the sasser, nimda, code red disasters.
You're right of course. It's so much better now. I should have posted my snarky comment in that thread about the twelve million zombied macs and linux machines. Odd... Google isn't being very helpful on this one. Could you help me out with a link to that discussion?
Help stamp out iliturcy.
Yes, but we haven't seen a "cheap" exploit which were remotely exploitable against any of the OSes in the latter years.
What was the article we're talking about again? Was it a mac worm that's owned 12 million computers? Or was it a worm that uses as one vector a remotely exploitable vulnerability in the Server service on Microsoft Windows computers, including all versions of Microsoft Vista?
Look, why mac and linux software aren't the malware ecosystem crudfest that Windows is is irrelevant. They're not, and that should be enough for most people.
And pdfs are so dry. Here: have a video. Not a Ric Roll, I promise.
Help stamp out iliturcy.
But that would require them to admit to a mistake they made.
Everybody knows that's impossible.