Researchers Hijack Storm Worm To Track Profits 128
An anonymous reader points out a story in the Washington Post, which begins:
"A single response from 12 million e-mails is all it takes for spammers to turn annual profits of millions of dollars promoting knockoff pharmaceuticals, according to an unprecedented new study on the economics of spam. Over a period of about a month in the Spring of 2008, researchers at the University of California, San Diego and UC Berkeley sought to measure the conversion rate of spam by quietly infiltrating the Storm worm botnet, a vast collection of compromised computers once responsible for sending an estimated 20 percent of all spam."
The academic paper (PDF) is also available. We've previously discussed another group of researchers who were able to infiltrate the botnet for a different purpose.
Re:I've previously been ridiculed for (Score:3, Informative)
So far it's hard to pay random people on the internet. For instance if I want to pay you USD1, it'll cost me more than USD1 in time and money to do so.
Re:I've previously been ridiculed for (Score:1, Informative)
Joe Dumbass signs up for Bass Fisher Extreme News letter.
Bass Fisher Extreme sending him his weekly email.
Joe Dumbass forgets he signed up for this and hits the 'Report SPAM' link instead of the 'unsubscribe' link.
Bass Fisher Extreme loses money.
Re:Ethics of the study (Score:2, Informative)
However, their premise of "reducing harm" is questionable. How can we be sure that a person who decided to purchase these drugs (against all warnings) really believes that not buying them is the best thing for him? What if this person really wants to purchase a drug that he thinks will enlarge him? Who gives the researchers the right to decide what other people should spend their money on? Under several legal interpretations, forcing a person not to buy something perceived as harmful is not legal: denying to sell cigarettes to a person of legal age may be illegal, under discrimination laws.
The site that the spam normally points to actually sends placebos or mislabled painkillers instead of the actual drugs, so I don't think this is really an ethical issue. However, even if the site did send the real drugs, it is *not* difficult to find an alternative website willing to sell the same items. Not to mention the fact that the sending of the spam was illegal in the first place.
Re:the vigilante approach (Score:3, Informative)
The problem is most of them are "fast flux" - the C&C servers move around daily. There's no stationary target to hit. Even if you go after a host channel somewhere etc, they just move to a different IP and change domain name records.