Slashdot Mirror
Malware Attribution: Should We Identify the Crooks Who Deploy It?
Brian Krebs asks: What makes one novel strain of malicious software more dangerous or noteworthy than another? Is it the sheer capability and feature set of the new malware, or are these qualities meaningless without also considering the skills, intentions and ingenuity of the person wielding it? Most experts probably would say it's important to consider attribution insofar as it is knowable, but it's remarkable how seldom companies that regularly publish reports on the latest criminal innovations go the extra mile to add context about the crooks apparently involved in deploying those tools.
[nt]
Seriously, if someone is running around breaking windows (pun intended) in your neighborhood, they're outed in the local crime report.
If they did it to 1.5 million homes, I'd bloody well expect that yes, they should be identified.
I personally wouldn't object to having them branded, either.
Or, if you're more Adam Smithy, just suspend their ability to file civil lawsuits allowing people to do whatever they want to them that doesn't actually rise to criminal activity.
-Styopa
Did Conficker's authors DDOS trafficconverter.biz? What was the big picture of owning several teraFLOPS of power of hacked home PCs? Probably more than selling SpyProtect 2009.
or at least it sometimes jumps you into an android apk installation page.
also the ads on the mobile make the mobile slashdot site pretty much unusable. they're so bad. they not only take the whole screens worth every few articles but also run some javascript that makes the browser crawl and jerk. in addition some of the ads are friggin videos.
world was created 5 seconds before this post as it is.
We could "ID" them in the obituaries...
“He’s not deformed, he’s just drunk!”
Anti-malware companies try to appear as experts.
Malware authors try to be anonymous, leaving minimal personal signature in the malware. Malware authors also share code and reverse-engineer each other's code and use the result, so even style may be misleading. So even experts would have difficulty attributing it to any particular person,
That means any attempt to identify the author - as a real person, an alias, or a label under which to group multiple products of the same author, will be very error prone. With law-enforcement and other security types attempting to defend against and/or apprehend the authors, and the authors trying to hamper the anti-malware people and companies some of these errors would come to light. This would reduce the reputation of the anti-malware workers and companies, without regard to their success at malware defence.
So it is no surprise to me that andi-malware people and companies don't publish the results of any attempts they may make to identify the authors in the course of their work. Why should they take a risk like that for no perceivable gain? The risk/benefit ratio says don't even speculate.
Bantam Dominique roosters crow a four-note song. Once you've heard it as "Happy BIRTHday" you can't NOT hear it that way
How much malware is produced by government/military organizations vs. criminals vs. corporations. There is probably plenty of overlap.
For many of these folks, they don't see themselves as being the bad guy. But Innovative entrepreneurs, or activist for some cause.
They don't seem to realize, how much harm they are actually causing.
This notoriety, could be similar to the notoriety a sex offender has. Not of a lone rogue, fighting the good fight while bucking the system. But as that creepy guy who has access all your personal data, and will use it to profit off of it, and causing people like your grandmother to suffer, during their golden years.
If something is so important that you feel the need to post it on the internet... It probably isn't that important.
It's no longer fashionable to associate human character, judgement, and action with unpleasant results. Malice? There is no malice. There is only the problematic tool or technology, against which we should rage. It's not murder, it's a "gun death." It's not a reckless jackass badly flying a GoPro in a crowded place, it's a "drone incident." It's not a bad driver, it's another "SUV death." It's not a criminal trying to steal your savings or reputation, it's "malware."
Talking out loud about how actual humans are responsible for the stupid or evil shit they do is no longer acceptable. That would mean assessing their intelligence, or making a considered moral judgement, based on some sort of, you know, identifiable value system. We can't have that! We'd need to post Trigger Warnings near any discussion that might result in the horrifying prospect of recognizing that not everyone is as smart as everyone else, or calling an evil actor evil, because, you know, judging. Much better to talk only about the scary tools, never about the people. Hey, Russian credit card scammers and bot farmers are really the victims, here - the malware made them use it. Probably of some sort of western patriarchal influence and whatnot.
Don't disappoint your bird dog. Go to the range.
Most malware is hosted and served out by businesses most people consider "legit". This is second only to Governments who infect millions of devices often inadvertently.
In both of those cases, there is no use in reporting. Oh yeah, some schlep will probably be made to be a fall guy but the shit storm will still be there churning out shit.
Report when the correct people can be, and are, held accountable for their actions. Until then, all men are created equally and have the same rights under due process. If one class of people puts themselves above the law, the laws are invalid. Unfortunately this is a cyclical problem in history. Expect vigilantism to increase until things are put back into balance.
-The wise argue that there are few absolutes, the fool argues that there are no probabilities.
typically, the first step in convicting someone of a crime is to identify who did the crime. Second step, arrest that person. So it makes sense to try to identify the person who made the malware.
non sequiter, it was kinda funny that the silk road guy went by the name 'dread pirate roberts', but nobody came along to pick up the name and keep it going. Ruins the point?
None of the "Dread Pirate Roberts"es were in fact caught. They all retired on their riches, passing the title down to a successor in the process. So the situations aren't the same.
Of course they should be identified. How else can we hunt them down and castrate them?
Some mornings it's hardly worth chewing through the restraints to get out of bed.
For malware, attribution can be inferred by looking at code similarities among the malware.
attribution would backfire and just create competition for who could become the most notorious.
... Some git who manages to do a bunch of harm (scamming retirees) is only going to be looked at in a good light in a Robin Hood scenario. Or it will be looked like a P. T. Barnum... and even though he was noted for using people, he was quite well respected for being able to put one over on others. ...
That has been true for thousands of years ... in some circles.
I prefer not to travel in those circles. They are a disaster waiting to happen, stand clear or be collateral damage!
Should We Identify the Crooks Who Deploy It? Yes. Thanks for asking.
--- Say something clever. Pretend it was me. Thanks.