Slashdot Mirror
Symantec Wants To Use Victims To Hunt Computer Criminals
Hugh Pickens writes "Business Week reports that security experts plan to recruit victims and other computer users to help them go on the offensive and hunt down hackers. '"It's time to stop building burglar alarms to keep people out and go after the bad guys," says Rowan Trollope, senior vice-president for consumer products at Symantec, the largest maker of antivirus software. Symantec will ask customers to opt in to a program that will collect data about attempted computer intrusions and then forward the information to authorities. Symantec will also begin posting the FBI's top 10 hackers and their schemes on its Web site, where customers go for software updates and next year the company will begin offering cash bounties for information leading to an arrest. The strategy has its risks as hackers who find novices on their trail may trash their computers or steal their identities as punishment. Citizen hunters could also become cybervigilantes and harm bystanders as they pursue criminals but Symantec is betting customers won't mind being disrupted if they can help snare the bad guys. "I'm convinced we can clean up the Internet in 10 years if we can peel away the dirt and show people the threats they're facing," says Trollope.'"
How many of these scams and hack originate in the US anyway? Will their customers really have information to share?
"Sometimes it's hard to tell the dancer from the dance." --Corwin Of Amber in CoC
That's true. This is a huge mistake of Symantec's because they are tacitly admitting that people are paying them for nothing. "Give us your money and do the job that you paid us to do in exchange for an even slower computer!" Way to go Symantec!
1. Users are mostly idiots. An educated idiot is still an idiot.
2. Despite lame excuses about "market share" that MS uses for their frequently exploited vulnerabilities, there isn't a system that CANNOT be hacked.
3. The best standards and coding practices can probably only hope to reduce exploits by about 80 to 90 percent.
4. Damn good idea. Next time you meet a marketer, shoot him. We don't need his genes in the pool.
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
The example in the article is even misleading, since it was a Facebook account that was hacked, who knows if the hackers ever touched the system of the user. He may have just used the same password too many places. I'd assume Facebook isn't using Norton Internet Security, so I'm kind of wondering what cases this will really make a difference in. Most worms/viruses even don't come from the creator's PC, but infected zombies.
1. educate users
Who is going to "educate" users? What will be taught? Where will it be taught, and to how many people? How do you deal with the differing systems that people would need to be "educated" on (remember there are still people using OSes that are 10+ years old)?
More importantly, who will pay for it?
It is easy to talk about "educating users", almost as easy as it is to blame the current problems on "uneducated users". But there are too many unanswered questions related to the statement.
create hardened operating systems that may never need antivirus
That is a great dream until someone goes to wal-mart and buys some nifty USB gadget from the $10 bin that only works in windows.
promote open web standards and good coding practices open to scrutiny for flaws exploits and bugs
That is a very good idea. Unfortunately getting it to go anywhere is another challenge altogether. If you know a good way to eliminate Flash from the web, I'm all ears...
stop letting marketing drive the internet bus
Good luck with that. Remember that a serious portion of all web sites are looking to make money. Which means they need exposure to bring in customers. While marketing droids seldom know much about web standards, they still have to be invited to the table.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
As long as an ISP values their customer's privacy and rights to step on other people more than they value the integrity of the Internet, we are going to have problems.
Right now, it is not illegal, wrong, immoral or forbidden to have a computer owned by a botnet. This means that if my computer at home is infected nothing will stop it from doing whatever its little botnet commander wants it to do. And my ISP will not do anything to prevent or deter this computer from stepping on the rights of others in any way possible.
Similarly, if your computer is intruded upon and you find an IP address that has been used to vandalize your computer, good luck. The ISP owning that ISP address will certainly not release any information about their customer without your suing the ISP or involving law enforcement. Law enforcement isn't interested until you have lots and lots of financial damages.
All in all, this absolutely assures that "script kiddies" will get away with anything until they do something really big. Similarly, fraudsters and credit card thieves will get away with it until they do something really, really big. So what if you track them down to an IP address? It doesn't help. Nobody cares because it is just the "Internet" and law enforcement is still caught up with the idea that the only people that lose anything are nerds and geeks or people that have been foolish trying to get rich quick - so they deserve whatever they lost.
Don't know what country you live in, but around here, the only reason people tolerate hackers is because they don't really do anything. If crackers start doing reprisals (what are they going to do, reformat the hard drive? Send a hitman?), it's only going to make people angry. Despite what idiocracy fans might think, people aren't like sheep, and if you try abusing them, it only makes them mad and want to punish you back. A couple reprisals aren't going to deter novices any more than a couple arrests are going to deter crackers, or a couple executions are going to deter murderers. If punishment were a real deterrent, then the fight between Israel and Palestine would be over, because Israel has punished Palestine a lot. Instead, you get things like this, where Palestine knows they can never beat Israel, but they are willing to hurt them however they can, even if it means they will be stepped on.
Sorry to bring politics into it, but it's a good example.
Qxe4
While you are arguing semantics (symantecs, lol) between hackers and crackers, I think you strongly, strongly overestimate the ability of the general populace to rise to this specific occasion.
Technology has developed at such an accelerated rate that there are few, at the least, who really know how things work. I think I've stated this before in another article, but to most people, computers are virtually magic. The level of understanding and specific knowledge required to do so is so in-depth that really, the only people who do so are those in the computer field. While that is a generalization, it also happens to be a fairly accurate one.
On to your politics argument: this is not a life or death scenario where the driving force is necessitated by a resolution. I'm not sure that the internet has reached a specific state of critical mass that requires the general populace to solve this issue. And as such, the majority of people will remain ignorant so long as they can check their email and post their tweets.
As I said, it is a novel idea to be proactive, but the suggested method is akin to trying to catch the wind with your bare hands.