Slashdot Mirror
McAfee Exaggerated Cost of Hacking, Perhaps For Profit
coolnumbr12 writes "A 2009 study (PDF) by the McAfee estimated that hacking costs the global economy $1 trillion. It turns out that number was a massive exaggeration by McAfee, a software security branch of Intel that works closely with the U.S. government at the local, state and federal level. A new estimate by the Center for Strategic and International Studies (and underwritten by McAfee) suggests the number is closer to closer to $300 billion (PDF), but even that much is uncertain. One of McAfee's clients, the Department of Defense, has used the $1 trillion estimate to argue for an expansion of cybersecurity, including 13 new teams dedicated to cyberwarfare. Despite the new data, Reuters said McAfee is still trying to exaggerate the numbers."
The $1 trillion study has seen other criticism as well, so the new data is a step in the right direction.
McAfee Exaggerated Cost of Hacking, Perhaps For Profit
... perhaps?
"Perhaps"...?
Department of Defense, has used the $1 trillion estimate to argue for an expansion of cybersecurity, including 13 new teams dedicated to cyberwarfare.
What exactly is this "cyberwarfare" that I keep hearing about?
Who are we fighting? What are the objectives? When will it end?
If I get this correct, this is the original study being challenged:
And here is the new evidence:
So this is two different McAfee-funded studies dueling it out?
10 PRINT CHR$(205.5+RND(1)); : GOTO 10
Along with $1 trillion != $1 trillion and Cost to the economy != Cost to the economy.
Got it?
These numbers are like those from the Drake's equation but plugging data for commercial profit of both, AV companies and defence contractors.
mcafee is POS software anways
Further on they say global losses are "probably" in the "range" of $300 billion.
These are the losses - data loss, the costs of identity theft and notification. If you want to count the cost of the Windows malware ecosystem you have to include both the losses and the cost of defense. That's all the costs of data losses, the entire revenues of all antivirus, firewall, next-gen endpoint sofware companies including the (now Intel) McAffee. These things cost money, and without the Windows monoculture they could not persist.
I have long said that the cost of the Windows malware ecosystem far exceeds Microsoft's own revenues. This is proof. The cure is easy: Don't run Windows. You can choose to not have this problem. You can opt out. Google did. If someday your choice of other OS becomes also so infested because it has become too popular and its developers lose track of security you can choose another. The OS isn't really that important anyway.
Help stamp out iliturcy.
The real number might be closer to the $1T if we allow for the cost of losses that have not been released due to the very existence of the project being secret. They never would have admitted it at the time if a spy had compromised the Manhattan project. Do you think it is any different today?
Cyber war needs cyber casualties, $300 billion is hugely inflated too.
Take out the cost of basic security, which should already be part of business, you don't count the cost of the locks on your doors as losses due to theft, yet these inflated numbers always count the cost of basic security as a loss due to hacking.
The reason this number is hugely inflated is because it's part of the cyber-war justification. If you want a big budget (NSA gets $10 billion? $20 billion? 30?) then you need to be able to inflict casualties. They need to exaggerate a threat from script kiddies to justify that.
Credit card and bank fraud is about 1% of online sales, so it won't be much bigger than that. So 1% of 250 is $2.5 billion:
http://techcrunch.com/2010/03/08/forrester-forecast-online-retail-sales-will-grow-to-250-billion-by-2014/
Submit the problem to the what-if blog and Randall will have it figured out - probably more accurately - by next Tuesday.
It must have been something you assimilated. . . .
Peanut vendor caims peanuts can cure cancer! News at 11!
Python: 'And then suddenly you have a language which says "we're all stuck with whatever the whiniest coder wants".'
Law enforcement's take on drugs which often (always?) values things based on the sale of minimal quantities. Busted a couple of tons of pot? Value it based on the highest value of selling joints on the street.
It's all lies, meant to justify their existence.
"National Security is the chief cause of national insecurity." - Celine's First Law
New study proves peanuts cause cancer...
Which is to be expected since McAfee pulled them out of their ass.
The big virus scares in the 80s were media frenzies partly promoted by the big antivirus producers.... including one John McAfee, who, if you study his history will realize is a very good huckster.
Its also the entire history of the govt, where every bureaucracy studies itself to say that it needs more money and is of utmost importance.
Funny how there is no branch of govt that is in charge of making sure the govt doesnt go bankrupt.
But nobody can exaggerate how crappy their bloated, pile of dung, machine slowing, worst-possible-time pop-up, fear mongering, computer newb fooling, circle of garbage really is.
In the future when people are writing case studies about the PC industry they are going to point a huge finger at the bloated trialware business model that has ruined the experience of buying a new computer. Basically consumer PCs are sold profitless. Then the companies hope that a certain percentage of the fools buy one of these piles of snot software packages of which the manufacturer gets a significant cut. Profit.
But the end result is that non-tech people unwrap their shiny new machine only to find all kinds of confusing icons for music services, media services, a trial for MS Office, and the worst... some AV pile of vomit. The AV vomitus will then tell them that they need to subscribe to their service otherwise the machine will be more infested than a street-walking Bangkok lady-boy.
Some defenders will scream, "If they don't want it then they can uninstall it." But the simple reality is that your average computer buyer from Staples is 100% unable to uninstall it thus will have this software threatening them every time they look at the screen.
I don't know how many giant screens or kiosks that I have seen screaming about the subscription running out.
But then the next layer of pain is that nobody hardly trusts these popups. With people like myself saying, "For the love of all that is good don't buy that crap." So now how can they distinguish between some AV crap trying to scam them and just their OS telling them that they should install the update.
Then people like myself come along and see that they are about 3 years behind on their updates because they were to scared to ever OK the updates. Their Adobe Flash is 4 versions out of date and their browser is running a beta of this new Javascript thing. So the fear caused by the bloatware AV has now caused them to allow their machine to become woefully insecure.
The alternative is that they blindly trust everything that seems helpful resulting in so many toolbars that they are left with around 1 inch of working browser and their machine takes 5 minutes and 8 casino ads to boot up.
So to me these AV types are not just the scum they obviously are but an insidious destroyer of the PC industry.
The best part is how people have been leaping to smart-phones to get away from desktops that scare them only to find many of the Telcos have installed "Helpful" software that points to obscure music/ringtone services, custom search engines, and other things that no doubt send a kickback their way.
Clearly the DoD, when its job would clearly seen to be Defense, should march first towards cyberwarfare. I mean, who cares that the US Government's handling of cybersecurity is a joke? Nah, we need to attack those Chinese hackers now and hard. Because surely we can use highly paid, low in number hackers in the US--but only those that can hold onto a security clearance, not do drugs, and stomach actually working for "the man"--against a population 3x the size and with salaries a fraction of the cost per hacker with clearly a regime more interested in getting things done and looking the other way than simply finding yet another excuse to bloat the departments budget--presumably because that's handle different in China (ie, political and personal maneuvering to get funds with little focus on "reports"--although on second thought, that sounds awfully familiar).
But, then, I guess maybe the DoD is just really stupid? They think they can defend US computers with cyber-soldiers and cyber-tanks? They don't understand that a well constructed computer [fire]wall or access [panel] is basically indestructible (although there's always DDoS attacks)?Nah, it's hard to believe they're that stupid.
Eurohacker European paranoia, gun rights, and h
You must be kidding.
What does it mean, "appended to the end of comments you post"
We're cyberfighting cyberterrorists to cyberkill them before they cyberkill us. More seriously: Think of the spygames of the cold war, with the punch that you don't need to physically be in the location you're attacking. The objectives are as diverse as they ever were: gather intel, sabotage, manipulate data and the public. So we're targeting any device worth spying on (that is, all of them, prioritized), any infrastructure, any database, any public (foreign or otherwise). And we (our devices, infrastructure, database and public) are being targeted by any half-assed hacker with a laptop, and several armies of fully-assed ones. It ends when the cyberwarring governments sign a non-proliferation treaty, or at least a non-aggression pact, so that their interests shift from offense to defense. Then you'll see companies suddenly becoming liable for their vulnerabilities, and soon after the net will be much more secure. A warning, though: a side effect may well be a much less free net, in the same sense that The West is not as free as when it was Wild.
I used their PCI compliance program once. My server did not comply, but complaining to my account manager with McAfee got rid of all the warnings and errors. They care about the money only.
(Note: I never did store any customer information on this server. The goal of the PCI certificate was simply to see if it would benefit sales.)
The price people pay for McAfee and its competitors as well as the lost productivity and power consumption of McAfee and its competitors needs to be figured into that total.
Seems to me being off by a factor of 3 is not a "massive" mistake in calculating economic _estimates_.
;-)
There's a lot of guesswork involved.
The fact that everybody guesses in the best direction for their employer is not strange.
How many of the top 500 economists predicted the 2007 recession?. Many of them even said we weren't in a recession when we actually were.
btw, if you haven't disabled advertising, this particular thread on slashdot sends you wonderful offers from McAfee
Thinking McAfee's security products are consumer virus scan is like thinking all Dells products are Best Buy laptops.
The simple fact is the majority of the product line up are non consumer and invisible to you. I'm not just talking about enterprise malware, I'm talking about IDS, IPS, SIEM, Solidifiers, Risk and Compliance, Encryption, etc.
The majority of the product line up and business model is corporate and government customers monitoring and blocking threats on the wire. Little or nothing to do with some rinky dinky bloatware on your walmart laptop.
Have you read a news article that says police busted a weed house and got rid of $30 millions weed? Usually that $30 millions is the price of all grown up weeds selling at the top street price. They may only confiscated a few baby plants.
For the informed, and most IT minded individuals, AV is one of the most useless pieces of crap that most on here have clearly pointed out. However, for the average "dumb" user that is more than happy to click those links that come from people they don't know, it is absolutely one of those pieces of protection that is required. It certainly will never been a full proof system, but something is going to be exponentially better than nothing.
In the enterprise, McAfee does do a lot of things beyond just AV protections, many use it for their forensic investigations because of it's ability to get to a lot of the data that others don't have access to. When you talk about the usefulness of the product as well, we have to remember that it is very difficult to show how many "attacks" have been stopped simply by having AV there. At the end of the day, each line of defense that you put in place means that the adversary has to change their attack and look for another way in. AV is going to at least cause them to change their attack, that doesn't mean that AV is useless.
Take AV off, an most end users are going to popped within a few hours because they do everything they shouldn't.
Intel's one is also estimate. There is no way to validate either one of them. And, they of the same order of magnitude, so it really is unfair to stipulate that McAfee exaggerated theirs.
Say my home network gets hacked and all my data gets released into the wild. There's a tangible cost in time it would take me to change passwords, but how do you quantify costs of embarrassment or damage to your reputation? Say I've got some scathing criticisms of a family member or reprehensible views on some issue.
Can you put a price tag on the damage to Anthony Weiner from the leaked sexting conversations?
I swear to God...I swear to God! That is NOT how you treat your human!
After ripping McAfee's infestations from the guts of many a PC, and watching even the wingnut McAfee trash talking his own old company, I think I'll pass on anything not only from that company but anything that even were to rhyme with McAfee. To me there is never just one cockroach.
Micrsoft research has debunked Mcafee's work of fiction a while ago.
http://research.microsoft.com/pubs/149886/sexliesandcybercrimesurveys.pdf