Slashdot Mirror
Research Project Pays People To Download, Run Executables
msm1267 (2804139) writes Incentivized by a minimal amount of cash, computer users who took part in a study were willing to agree to download an executable file to their machines without questioning the potential consequences. The more cash the researchers offered, capping out at $1, the more people complied with the experiment. The results toss a big bucket of cold water on long-standing security awareness training advice that urges people not to trust third-party downloads from unknown sources in order to guard the sanctity of their computer. A Hershey bar or a Kennedy half-dollar, apparently, sends people spiraling off course pretty rapidly and opens up a potential new malware distribution channel for hackers willing to compensate users. The study was released recently in a paper called: "It's All About The Benjamins: An empirical study on incentivizing users to ignore security advice." While fewer than half of the people who viewed the task actually ran the benign executable when offered a penny to do so, the numbers jumped to 58 percent when offered 50 cents, and 64 percent when offered $1.
I would run it in a dosbox or VM for a dollar.
Damn_registrars has no butt-hole. Damn_registrars has no use for a butt-hole.
I'll run the executable on some random machine that I've already pwnd.
It is so easy to get distracted these days ...
Security can be so boring.
i remember i read this somewhere before i tought i read it here on ./
I'd be curious how much Bitcoin would it take to tempt people.
1. Set up VM
2. Download all the crap they ask me to
3. Profit
Seriously, what kind of idiot would download an unknown executable on his main PC to earn a fucking dollar?
Where can I apply?
1) Copy fresh VM .exe
2) Boot it up
3) Download and Run
4) 1$ !
5) Close VM
6) Overwrite with fresh (backup) VM
7) Goto 1.
And all that while I'm at work!
Because good is dumb...
for $5!
Please read my Canon EOS tech blog at http://www.everyothershot.com
From what I have seen from some of my relatives, any download related to gambling can inspire similar throwing caution to the wind.
Because it was through Amazonâ(TM)s Mechanical Turk, I'd take any "findings" with a grain of salt.
> 'a paper called: "It's All About The Benjamins: An empirical study...'
> 'cash the researchers offered, capping out at $1, ...'
Because they never offered more than one "George", their paper's title is clearly overstated.
Or perhaps another way ...
1) Go to local library
2) Download all the crap and run
3) $$$
4) Go away and don't come back
From page 5 of the PDF:
Thus, all participants were required to click through a consent form. Beyond the consent form, there was no evidence that they were participating in a research study
Did the consent form say that you agree to allow CMU to do bad things to your computer? If not, then most people know that free money is free money (and sue the university for megadollars if things go bad). All you had to do was raise the price high enough that they believe they're getting paid fairly for their time. Some may have even been hoping for a virus so they could sue.
People were happy to install ActiveX controls to "Punch the Monkey" in 1998. Nothing has changed since then.
It's also why the Android security model is a complete joke and always has been.
Any security model that requires users to make perfect security decisions is an automatic failure because there is no "undo", so one mistake after 10 years of perfect vigilence owns your entire machine.
Natural != (nontoxic || beneficial)
Dancing pigs accomplish the same. Actually, more likely even, because people, despite being used to getting free stuff from the internet, are still kinda wary if you actually pay them to do anything.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
https://www.youtube.com/watch?...
Seriously, what kind of idiot would download an unknown executable on his main PC to earn a fucking dollar?
There are plenty of people for whom a dollar is a lot of money. Don't forget, thus was a world wide study - not one limited to your particular country. The paper states that along with running a program, there was a questionnaire (I wonder what languages it was available in, and also what languages the Mechanical Turk posting was wtitten in - surely that is a tremendous skew to the results?) and that 40% of the survey respondents were from India - where english is quite popular (more english speakers than any other country in the world).
So, since purchasing power of the $1 wasn't taken into account, the results are flawed, since the reward will vary so much depending on the wealth of the individuals taking part.
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
Less than half for .01, 58% for .50, and 68% for 1.0? Seems like the single penny was the best value, possibly followed by the 50 cents. However, even if we assume "less than half" is as low as 40%, $1 is 10000% more payment for less than a 50% increase!
"I opened my eyes, and everything went dark again"
This was done via the Mechanical Turk, so it's already filtered for people willing to do computery things for money. It would be a different story if this was a random website with the author anonymous.
Don't waste your vote! Vote for whoever you want, unless you live in a swing state it won't matter anyways
Do they realize that some of the people may have done it on frozen machines or junk machines? Maybe they have a spare computer that's for nothing but potentially malicious applications.
What do you think that most of those websites sends you the surveys to fill out for a few cents running ? Flash ? How much do you know about flash, unless you are a web developer of course, to say if what you are downloading is secure enough, not to steal your identity ? Or when you click on coupons.com etc. coupon printer apps the get downloaded. Once you download and run them, you are giving the app, free rein of your computer. Once run, they are no longer governed by the security controls of your browser. This is how they get to stop you from printing unlimited number of free coke coupons, by hiding the information, somewhere on your storage, even you don't know how to find and delete. It's all about the Benjamins baby.
Anecdote: Do you sleep with me if I paid you $100,000 ? She answers "ummm, yeah, for 100K, I'd sleep with you"; how about if I paid you $10. She answers angrily "what do you think ? you think I'm a whore ?". Oh yes, we have established you are a prostitute. I am just trying to figure out your price.
This ain't anything different. Pay me few bucks and I will surrender my security to you. Then call the IT support, when my computer is running slow and acting weird. No harm to me.
__________
The more I know people, the more I love animals
Thank you. I've wanted to run an experiment like this for years, but couldn't figure out to get a good sample audience.
The result is completely non-surprising. Security Awareness training is 90% pointless waste of money, and I regularily make enemies at conferences when I say it, because there's a ton of money in this snake oil, mostly because you can repeat it ad infinitum, once you've sold a client you can do one every year or twice a year or even get a whole "ongoing awareness process" going.
There are a big number of problems with the whole thing, most of them more psychological than technical. But both from the experience of people doing social engineering pentesting and from empirical data on actual breaches, it is clear that training or not makes not very much difference. Most companies would be a lot better off with extreme basic training to a) satisfy regulatory requirements and b) give the employees the absolute essentials, basically the IT security equivalent of "don't look into laser with remaining eye". Everything beyond that is a waste of money.
If you want help convincing your boss, CISO, etc. to spend that money on something that actually has an effect, and you're in Europe, let me know. Consulting companies out of instead of into pointless expenditures is great fun.
Assorted stuff I do sometimes: Lemuria.org
Asking participants to download and run software is a violation of Mechanical Turk terms. I know, because I do tasks there and I think I may have turned this task down! Unless they have some way of knowing how many people turned the task down once they knew it involved downloading software (I didn't read the whole paper), I would question the usefulness of the results.
What would you download for a Klondike Bar?
A quick 50 cent or $1 task on mturk could be the highlight of someone's afternoon, when one is stuck thinking in terms of relative value, after tens or hundreds of nickel and dime (or less) tasks.
a lot of the programs for offering money up to $1 to do simple tasks, have their own rules... like people have to complete at least $1 worth of tasks every day for 10 days to prove they aren't a bot and to prove that the first 9 people don't complain about your work.
so the users of those systems are already being incentivized to do something... if they don't do something, they lose their account... so i think this study is more about the economics of the "small task for small pay" sites.
the people who are full timers on those sites are probably smart enough to do everything in VM sandboxes.
We already have "incite".
When I read the paper, I didn't see anything to suggest a date after 2010. And as the paper says, this only covers workstation computers - Windows/XP through Windows/7. No tablets or smart-phones, or other app-store like environments.
I suspect that if anything, current behavior - influenced by app-store like environments - is even worse. You could probably get someone to run your mystery app just by promising them access to another mystery app.
There's a fairly decent community of people who make money using Mturk. They've been doing these types of jobs for years now and have systems in place to stop malware, generally through a blacklisting process. There is also a widely accepted rule that low paying work is to be shunned - nobody wants to work for a sweatshop, whether it be online or otherwise. The general lowest people will work for is 10 cents a minute. It's very much like a union, people depend on Mturk for money and want to make the most out of their time as possible. I don't see mention of any of this in the article, which pretty much invalidates the entire study for me.
I bet you can get the percentage way higher by instead of a cash incentive, promising the user a video of dancing bunnies.
http://blogs.msdn.com/b/larryosterman/archive/2005/07/12/438284.aspx
Excerpt: ... what happens when a user receives an email message that says "click here to see the dancing bunnies".
The user wants to see the dancing bunnies, so they click there. It doesn't matter how much you try to disuade them, if they want to see the dancing bunnies, then by gum, they're going to see the dancing bunnies. It doesn't matter how many technical hurdles you put in their way, if they stop the user from seeing the dancing bunny, then they're going to go and see the dancing bunny.
... so people do stupid things for money? Gosh.