Microsoft To Get Malware Bailout In Germany

hweimer writes "The German government plans on paying to set up a call center to help Windows users with malware infections. I think this has the effect of being a malware bailout for Microsoft, discouraging them and other software companies from writing better code and giving users little incentive to switch to more secure alternatives. How much government money is needed to run the call center is also not revealed." The call center, running in cooperation with ISPs (but not manufacturers), is envisioned to have a staff of about 40.

Comments

Not really

[sopssa]

I think this has the effect of being a malware bailout for Microsoft, discouraging them and other software companies from writing better code and giving users little incentives to switch to more secure alternatives.

I have to disagree with that. Malware problem is usually because of user stupidity. Like any other OS, you can run Windows securely if you don't do stupid things.

The thing is, as we don't care so much about how to properly feed, exercise and clean ponies, normal people don't care so much about computer security. They just want to do their thing. But now they would have a place they know they can seek help from, and who are giving helpful instructions how to not get infected anymore and how to solve their problem. Maybe those hints stick, maybe not, but at least they can get help with the problem (without calling over our fellow slashdotters all the time!)

But what is an interesting piece in the article (and somewhat worry-some)

Before the plans are implemented, however, a decision needs to be made on what sanctions customers who decline to cooperate with their ISP can be subjected to. According to an eco project manager, quoted by the dpa, "Anyone surfing without proper anti-virus software is endangering other web users, in the same way that a car driver driving with faulty brakes is endangering other road users."

I'm sure Symantec will hurray for that, but I don't want someone push an av software down my throat that I don't even need. Even less on my linux server. I really hope it only means those users who have been identified by the ISP to be sending spam out.

But the bottom line is, it's not a "bailout" for Microsoft. Malware goes where the users and money are and any kind of better code or secure alternatives cannot go around user stupidity. Linux is mostly secure from malware because the users generally are more geeky than the casual users on Windows and don't just random stuff from the internet. Repositories also help with this, but if Linux ever gained any actual desktop marketshare and casual users, the 3rd party applications/games/whatever that people want would be downloaded from the internet just the same way as on Windows. But any (good) Linux sysadmin knows there been worms in Linux too and remote hacks are commonplace if the system isn't properly secured (and casual users just wont do that).

Re:Not really

[eln]

as we don't care so much about how to properly feed, exercise and clean ponies

On the contrary, I've had an inexplicable interest, some might even say obsession, with ponies since April 1, 2006.

Re:Not really

[rolfwind]

1. This isn't the role of government.
2. No matter how much the apologists bray, the fact is that Windows has the most infections. The proof is in the pudding! Yes, user stupidity contributes to that... but it ignores deep design flaws in Windows itself! Will the infections ever go toward zero even with the best designs but dumbest users? No. But it sure doesn't excuse it being in the other extreme for Windows.

Re:Not really

[CaseCrash]

Thanks for pointing out something actually interesting from the article and relevant to us /.'ers

As it is, the summary reads "A government decided to do something to help their less computer-savvy citizens. Here's my rant against microsoft with no bearing on reality. Please go to my blog."

Re:Not really

[Shakrai]

1. This isn't the role of government.

I'd normally be the first to agree, but isn't a large portion of malware used for criminal activity? Identity theft, botnets that engage in DDoS extortion attempts, spam relays, phishing, etc, etc. It seems to me that law enforcement (i.e: government) has a legitimate interest in reducing the number of malware infections that are out there.

Of course, a call center filled with follow the script support drones probably isn't the best way to go about doing that.......

Re:Not really

[Locke2005]

If you're a genuine "OMG, Ponies!!!" fan, you may be interested in this

Re:Not really

[gbjbaanb]

Not really, governmental organizations are not so much interested in helping you clean up your malware-PC, but in funding the internet cops to trace and bring the perpetrators to justice.

The callcentre script drones will probably be fine - they'll tell everyone to run spybot, install an AV system, run windows updates and then take it to a repair centre or reinstall if symptoms persist.

Re:Not really

[HaZardman27]

The thing is, as we don't care so much about how to properly feed, exercise and clean ponies, normal people don't care so much about computer security. They just want to do their thing.

So... are you suggesting that you just want to.... "do your thing" with a pony?

Re:Not really

[noidentity]

I have to disagree with that. Malware problem is usually because of user stupidity. Like any other OS, you can run Windows securely if you don't do stupid things.

Agreed; Mac users are no more bright, so they should set up a call center for Mac OS X malware infections too, though they could staff it less, perhaps with one person. Oh wait, Mac OS X doesn't have the malware level as Windows, even given the same level of user carelessness.

Re:Not really

[natehoy]

No, the article is pretty clear that the ISP will use patterns (not the existence or presence of antivirus, which they really couldn't detect effectively anyway) to determine if a computer is infected with a bot.

The first step will be to contact the infected user and/or put up a custom web page that they will default to letting them know about the infection. That will be done by the ISP. The ISP will then refer them to the new advisory center to get the infection cleaned up.

I think part of the advice would be "get some antivirus software in place" but I doubt they'd enforce it. Though I imagine there may be some sort of action taken against people who refuse to fix their malware issues and are sending out spam or attacks, which affect other people on the network and the Internet as a whole. That was where the worrisome part you referred to came in - but the German government hasn't decided IF they are going to impose sanctions, much less what form they would take.

It may be as simple as shutting off their connection and mailing them a disk containing a free antivirus solution (AVG-Free, Avast, etc), then having them call to have their connection turned back on once the software is installed, or giving them access to a more limited set of URLs they could use to download anti-virus/anti-malware software then unlock the rest of the connection once the user called and stated that they had antivirus in place.

Re:Not really

[LWATCDR]

For the most part I tend to agree. Any user installed Trojan is the users responsibly.
If the malware gets installed through an exploit then it is the OS/Applications fault.
In a good amount of cases it is no longer Microsoft's fault.

Re:Not really

[sopssa]

Do you know what you're talking about? What prevents a keylogger to log a user password on windows that do not prevent it in Linux?

Well UAC is built-in to the system. Windows just disables sending the keys to other apps while user is presented with UAC dialog.

But what about when you're running a terminal screen on your X desktop in Linux and sudo to root. Linux kernel nor sudo can't disable the equivalent api's because X, terminal window and several other hooks need to be able to get them. That is a problem with a system build from blocks.

Re:Not really

[bhtooefr]

There is one platform out there that's resistant to the dancing bunnies problem.

The iPhone.

Unfortunately, that's the only way to be resistant to it - don't allow third-party software unless it's been inspected by real people whose job it is to inspect it.

Re:Not really

[Tom]

Like any other OS, you can run Windows securely if you don't do stupid things.

Like any car, you can parallel park an 18-wheeler, if you are careful enough.

Sure, you can do it. Some OSes just make it easier, and some make it a challenge. I dare say Windos (any version) is in the later category. Heck, it usually comes with a fine selection of ad- and spyware pre-installed thanks to your friendly OEM.

Re:Not really

[sopssa]

But what do you need sudo for? Most malware that is trying to steal your info, send spam or whatever runs perfectly happy in user base.

You only need root access if you're trying to get control over the box, which is more of a hacking thing than what malware does.

Re:Not really

[dave562]

That does seem to be the case. Most of the in the wild exploits these days are targeting applications like Acrobat and Flash because the underlying OS has been hardened to the point that remote exploits are becoming harder to come by.

Re:Not really

[Stormwatch]

The role of a democratic government is precisely what the voting citizens define it to be. No more, and no less.

The full extent of that reasoning: if 51% of the people say the other 49% should be enslaved, the ballot makes it right.

Hell no, that can't be right. The purpose of the government is to uphold every citizen's inalienable rights; and it must be as small as it can be while remaining capable of fulfilling that purpose. No more, no less -- with emphasis on the "no more" bit.

Re:Not really

[shutdown -p now]

The full extent of that reasoning: if 51% of the people say the other 49% should be enslaved, the ballot makes it right.

Not really; note that I said "citizens", not "majority of citizens".

In any case, show me a democratic government in which, if N% of people say that other 100-N% should be enslaved, they can't make it happen by legal means, for any value of N (keeping in mind such things as referendums, constitutional amendments, etc). U.S. is definitely not in that list, as its Constitution can be arbitrarily amended, given a supermajority - you could get slavery back tomorrow, or install absolute monarchy, if there was sufficient public support for it.

The only western country I can think of in which the ballot does not ultimately rule supreme is Germany with its "immutable" Constitutional provisions (that guarantee the "fundamental democratic character" of the system of government and certain basic human rights). It's fairly obvious, however, that with sufficient support, Constitution is just a piece of paper - it won't help you against a revolution by an armed mob, and then whatever laws they establish will become the law of the land. So in the end, pragmatically, it's always tyranny of the majority - it may be just more or less veiled.

The purpose of the government is to uphold every citizen's inalienable rights

Who determines what rights are inalienable? What if 51% and 49% disagree?

Re:Not really

[Capsaicin]

And I'm not sure where you've got the "liberal" part from, since it wasn't in my OP.

Well the 'liberal' part usually goes with liberal-democratic, so as to distinguish it from "democratic" as it is used in the sense the "German Democratic Republic" or the "Peoples Democratic Republic of Korea," 'liberal,' in this context referring to the support of private property rights and markets.

That being said, I agree with you almost completely when you write:The role of a democratic government is precisely what the voting citizens define it to be. Though I would stress that limitations are imposed by whatever the terms of the "social contract" under which that government obtains its legitimacy may be. Practically this usually means it is subject to constitutional limitations as to legislative power.

Where I strongly agree is that the "role of a (liberal)-democratic government" is not what some particular citizen (or even some foreign "thinker") defines the role of government to be in their personal philosophy in opposition to the right of the majority to determine that role. A society must be free to chose a way to organise itself even at the expense of offending a particular citizen's ideological purity.

Re:Not really

[FlyingBishop]

Well UAC is built-in to the system.

Yes, but it's almost completely ineffectual

Re:Not really

[Xtifr]

Setting the execute bit is not difficult...

Yes, but it has to be done. Which means you have to persuade someone to do it.

if someone emails someone else a binary the execute bit will probably already be set.

Set where? The mime type doesn't define "executable bit" anywhere. And even if it did (which it wouldn't because it's not tied to a particular family of OSes), any unixish mail user agent which honored that instruction and set the executable bit would be blasted out of the sky by thousands, if not millions, of irate users who know what a security risk it is, and the program would never be allowed in the repositories of any reputable distribution.

And even if that weren't true, and commonly used unix MUAs did generously set the executable bit for you (which, I reiterate, they don't), that still wouldn't help, because, unlike with MSDOS or its horrid descendents, the current directory is not in the executable PATH! And no MUA will save to anywhere where a program could normally be executed, so you'd either have to persuade the user to modify their path or specify a path designation when they try to execute your malware, so we're back to social engineering, even in our contrafactual universe.

Apparently, the "weird thing" you've never heard of is UNIX (or Linux or BSD). :)

Re:Not really

[symbolset]

Thanks for joining the discussion friend. Now go back and review what he and I have shared on the subject to get some context on what I said. You may have to subscribe to slashdot to get the good bits.

Windows still has autorun even in W7. They've limited it, but it's still there.

Re:Not really

[jipn4]

I'd normally be the first to agree, but isn't a large portion of malware used for criminal activity? Identity theft, botnets that engage in DDoS extortion attempts, spam relays, phishing, etc, etc. It seems to me that law enforcement (i.e: government) has a legitimate interest in reducing the number of malware infections that are out there.

So they should go to the source of the malware infections: Microsoft. Microsoft needs to be held responsible for selling software that is so susceptible to malware. They should not be allowed to disclaim responsibility in their contracts, and they certainly should not get financial support from the government.

If Microsoft were held responsible for the damage they are causing with sloppy and badly thought out security, market forces would already have taken care of the problem: either they would have been sued into non-existence, or they would fix their software.

Re:Dumbfounded

[MichaelSmith]

This is one of the dumbest things I've ever heard. Is this just a government make work project or something?

My income is based on government make work projects you insensitive clod!

Re:Dumbfounded

[Cyrus20]

and my income is based on "that is one of the dumbest things I've ever heard." yep I work in a call center

Re:Dumbfounded

[Shakrai]

My income is based on government make work projects you insensitive clod!

So do you work for DOT and vote Democrat or for a defense contractor and vote Republican? ;)

It doesn't say "for Microsoft"

[Bert612]

The press release doesn't mention Microsoft. In fact it states that this new service is for all users with all operating systems. So while indeed 99% of all users run Microsoft, niche systems like Linux and Mac will be helped too. A good idea which will hopefully help improve internet safety for those users who just don't understand the technology they are using, but want to be on the net just like everybody else.

Re:It doesn't say "for Microsoft"

[earlymon]

In fact it states that this new service is for all users with all operating systems. So while indeed 99% of all users run Microsoft, niche systems like Linux and Mac will be helped too.

I like the way you think.

It's very different from the support centers that I call with hardware problems - like when an update bricked my router - that suggested I:

a) re-install Linux to fix the problem,
alternately, b) don't use a Mac, because they don't do REAL networking,
c) if I were only using Windows, I wouldn't be having this problem,

and my favorite -

d) I must be lying because no one has three operating systems in their house - and if I do, then maybe that's what bricked my router.

But - as I said, I like the way you think, and I wish them many good lucks with this endeavor.

Re:Windows is vulnerable because that is profitabl

[schon]

Does that mean users of Apple computers are far smarter than users of Windows computers?

Well duh. They picked Apple, didn't they?

/me ducks

Re:Someone translate to German...

[d34dluk3]

Step 1: Back up your data. Step 2: Install SUSE Linux. Step 3: Profit? Step 4: Laugh at Microsoft. [schadenfreude here]

schadenfreude

I got this part:

schadenfreude

Lost in translation

[mseeger]

Hmmm..... Neither headline nor summary fits the news. Nothing in the quoted article mentions windows. The article itself is focussing on a small aspect of what is being discussed. Some parts of the discussion would be very negative for Windows users. E.g. it is being discussed to disconnect users from the Internet who don't fix their PCs when attacks originate from them. I don't agree with a lot of things discussed, but they didn't do anything to deserve a /. summary like this.

CU, Martin

Re:wrong funding strategy

[earlymon]

The ISPs should be free to charge end users rates based on the OS the end user is doing.

Are you completely insane? (And I'm asking that in the friendliest voice.)

Do you have any idea just how quickly that would turn into unprovable organized crime?

Because after all, this scenario could happen very quickly: OS Company A goes to the ISP X, and cites incentives, rebates or outright kickbacks for lower rates for OS A - while OS B and OS C are surcharged. An especially effective scenario if OS Company A just happens to be the one with the most trouble - and the most cash to throw around to shore up market share.

And OS Company A even helps the ISP with metrics to show that they're product is better / safer - whether it is or not. Example - 80% of all of one ISP's malware troubles come from OS A. (In the pretend-reality of my example, it could be coming from a handful of lost souls). But - OS A has a 90% market share - so it's mal-rate of 80% being less than the market penetration of 90% makes it .... better.

And how would OS B or C make up for the other 20% of hits? OS A would simply have to put a purposefully-infected - heavily infected - OS B or OS C machine on that ISP's net - and the lie with statistics is complete.

Like insurance rates for different drivers of different cars as end users present threats to the net based on their OS and experience the rates charged to support a malware elimination office should depend on what is being connected.

You get much better insurance than I do. In the USA, they tell us that that's what the rates are based on - but in reality, nothing I drive never ends up with an insurance reduction.

They take you for every nickel that they can imagine ways to justify and get from you.

Re:Too small a staff

[natehoy]

This is not an open support desk, at least that's not what the article describes. This is a "referral of last resort" from an ISP to this support desk. In your case, you'd probably still field most of the calls, but your friends and family would say "my Internet people just called me and said I have worms or a cold or something, and that they'll stop my Internet unless I fix it. Help!"

Based on what I'm reading in the article, here's how a general fix would go:

1. ISP detects malware patterns coming from one of their users.
2. ISP contacts customer, says "you appear to have a virus that is doing bad things on the network. Please fix it." or pops a web page with the same message and probably a link to an antivirus solution.
3. (assuming user doesn't know how to install AV software) ISP refers customer to government call center.

If the customer refuses to fix the problem or turns out to be unable to do so even with help, then the German government needs to figure out what they want to do. Shut the user off? Attempt to have the ISP block the malware with port blocking? Some interesting and perhaps disturbing possibilities there.

Re:What I heard

[Anonymous Coward]

If you actually RTFA (not the blog one, which is from the submitter himself), it never mentions Microsoft anywhere. Nor do the german press releases.

Re:"Hello, Malware center"..

[shutdown -p now]

"Hi, I'm calling about malware on my PC"?

"Buy a Mac". *click*

Same caller a while later:

"Hi, I've bought a Mac and installed XP on it, but, ugh... it seems to be slow again..."

So AAA is a bailout for Ford Motors?

[meerling]

Sorry, but helping the clueless or unfortunate users from something that wasn't created, distributed, or sanctioned by Microsoft isn't a Microsoft Bailout even if the users are running MS Windows.

If Macs were the big dog in the OS world, would you then be calling it an Apple Bailout?

By the way, don't buy into the apple myths. They have malware and bugs aplenty, they just don't have enough population density to encourage easy transmittal, or even be a tempting target for malware creators. Those scum want to get as many machines as possible, so only niche diehards or those who want to prove a point bother to infect anything with less than a 40% market share. Guess what that means... yeah, that's right, they go after Windows. If you flip-flop the percentages, you'll see a total shift in what they target. And that's not guesswork or rhetoric.

Personally I know of many reasons to complain about Microsoft, and Apple, and the Linux community. None are perfect, and all have nuts, fanatics, and total wackjobs. Pick your poison and learn how to use it safely.

Re:So AAA is a bailout for Ford Motors?

[Penguinisto]

They (Macs) have malware and bugs aplenty,...

Please list all non-trojan malware for OSX. Even a small sampling will suffice. Hell, even one would suffice.

(Bugs? Certainly. Trojans? There have been roughly a handful of variants that require a user to find a shady pr0n website, download the trojan, then enter an admin password in spite of all warnings telling them that it might not be a good idea... one simply cannot fix stupid).

Anyrate - let me know what you find.

Will it actually work?

[dave562]

I've been cleaning up other people's infected Windows machines for longer than I have wanted to. It seems like nine times out of ten, the only way to ensure that the computer is clean after it gets infected is to do a complete pave and rebuild of the OS. That level of complexity isn't something that a tech support person can walk an average user through over the phone. Forget about backing up the data beforehand, or re-installing the applications after the fact.

I like the idea. The way that the article is worded is complete flamebait though. I think we can all agree that steps need to be taken to reduce the number of malware infected Windows boxes on the internet. Doing so makes the internet a better place for everyone. It just seems to me like the Germans are taking on an impossible task. Once a Windows box is owned, it stays owned.

On a related tangent, I think things could be better if ISPs institute the equivalent of a "good driver discount". Give the owners of clean computers a discount on their monthly service fee. I'm not an economist, but it seems like it would need to be enough of a discount to cover the cost of having a "professional" setup the computer right in the first place. I see advertisements where I live that claim to clean malware infected computers for $30-50. So a discount of $5 a month seems about right. On the other hand, if the discount isn't high enough, then the incentive won't be strong enough to encourage people to keep their computers clean. At that point maybe the ISPs need a stick, instead of a carrot. Perhaps throttling the connection, or re-directing to a subset of URLs for how to deal with malware infections.

Re:"Hello, Malware center"..

[selven]

Smart call center:

"Hi, I'm calling about malware on my PC"

"Ok, install this weird Linux distro from the 1990s"

  (the next day) "Tried the Linux, but the internet isn't working"

"Good, that means your computer is secure now"

An alternative mission for government

[jonaskoelker]

The purpose of the government is to uphold every citizen's inalienable rights; and it must be as small as it can be while remaining capable of fulfilling that purpose. No more, no less

I propose a different mission for government: in economist-lingo, to maximize social welfare (that is, the sum of how happy the population is).

And of course, the population should value freedom of {speech,assembly,press,etc.} very highly.

But---pregnant pause---there is such a thing as a market failure, and I think it makes good sense for the government to step in and make regulations that makes the market more competitive.

Observe that the societal material benefit of a free market comes about not because the market is free but because it's competitive.

If you're free to enter a market where you'll most certainly be crushed by the incumbent monopoly, what does that freedom really buy the society? But if the monopoly is prevented from using its monopoly status to crush you and has to compete reasonably fairly with you, you might have a shot at getting your better/cheaper product out to consumers.

If you're an American, you'll laugh at "I'm from the government, and I'm here to help you." I don't. I know there's something shady going on, in particular with travel funds for the EU which the MEPs aren't held much accountable for [long story, but the point is if you-an-MEP travel not-extremely-extravagantly, you can pocket a large wad of my tax money at the end of the year. Some politicians do.]. But I also believe politicians (from time to time) genuinely want to do good for the people and the nation.