Become a fan of Slashdot on Facebook

 



Forgot your password?
typodupeerror
Worms Security The Almighty Buck Spam Technology

Researchers Hijack Storm Worm To Track Profits 128

Posted by Soulskill
from the storm-chasers dept.
An anonymous reader points out a story in the Washington Post, which begins: "A single response from 12 million e-mails is all it takes for spammers to turn annual profits of millions of dollars promoting knockoff pharmaceuticals, according to an unprecedented new study on the economics of spam. Over a period of about a month in the Spring of 2008, researchers at the University of California, San Diego and UC Berkeley sought to measure the conversion rate of spam by quietly infiltrating the Storm worm botnet, a vast collection of compromised computers once responsible for sending an estimated 20 percent of all spam." The academic paper (PDF) is also available. We've previously discussed another group of researchers who were able to infiltrate the botnet for a different purpose.
This discussion has been archived. No new comments can be posted.

Researchers Hijack Storm Worm To Track Profits

Comments Filter:
  • Double standards? (Score:5, Interesting)

    by Anonymous Coward on Saturday November 08, 2008 @10:23AM (#25687533)

    How come they don't track down the IP addresses of infected computers and inform the users their computer is compromised? It seems these researchers also are getting a kick out of the botnet at the cost of the victims.

    • by darkside_al (702437) on Saturday November 08, 2008 @10:30AM (#25687569)
      Because it's useless, most probably, that user in one hour will enter another p0rn site and get infected again. The big problem in securing home computers is user behavior, doesn't matter that you put a lot of warnings, he will hit install in a sec if is searching for pr0n.
      • Re: (Score:1, Insightful)

        by Anonymous Coward

        Ergo, it is ethical to use the botnet for research. Oh, wait...

        • by X0563511 (793323) on Saturday November 08, 2008 @01:01PM (#25688487) Homepage Journal

          Imagine this scenario:

          You have Bob. Bob has a thing about catching STDs. No matter how many times he gets cleaned up, he turns around and does something stupid and gets a new one, and in turn passes them on.

          Is it unethical to study his infections? The subject won't stop getting the infections, nor will he stop spreading them. However, we can use what we learn from studying the subject further on down the line.

          Not quite so black and white is it? I side with the researchers. The botnet will be there either way, and if we actively destroy it a new one will be made in it's place (and possibly improved, preventing study). Might as well learn what we can from it before making a move.

          • Is it unethical to study his infections?

            No. But not telling him about his infections is unethical.

            • Researcher: Your computer is infected.
              User: My computer's working fine.
              Researcher: But you have a virus. You're sending spam.
              User: I've never sent spam!!
              Researcher: Not you....your computer.
              User: My computer's working fine.
              Researcher: Fsck it.

              Now repeat this half a million times.

          • You have Bob. Bob has a thing about catching STDs. No matter how many times he gets cleaned up, he turns around and does something stupid and gets a new one, and in turn passes them on. Is it unethical to study his infections? The subject won't stop getting the infections, nor will he stop spreading them. However, we can use what we learn from studying the subject further on down the line.
            Yes, if you propose to examine or diagnose Bob against his will, it would be medically unethical. He has a right to p
      • by khasim (1285) <brandioch.conner@gmail.com> on Saturday November 08, 2008 @12:19PM (#25688231)

        #1. The ISP blocks all outgoing port 25 connections. We've been over this one before. It means more expenses for the ISP so they're not going to do it unless they are forced to do it through law.

        #2. The vigilante approach of writing a "virus" that identifies and infects infected computers ... and then removes the existing infection, downloads updates, installs a silent anti-virus app and checks back in at regular intervals for updates. The problem with that is that the people who do it become "criminals" under US law.

        • by Intron (870560) on Saturday November 08, 2008 @01:07PM (#25688521)

          I wondered about #1, also. My ISP blocks *inbound* port 25 but not outbound. They don't want to let me run a server on a dynamic home IP address because they want to charge me for a business use. They also block inbound port 80.

          It turns out the reason they don't block outbound 25 is because that would force the spammers to email out through the ISP mail servers which would get them blacklisted. They are fine with letting the home users send spam and get blacklisted. It doesn't cost them anything.

        • by mortonda (5175)

          My ISP, Cable One, does in fact block outbound port 25. Makes it hard to test remote mail servers. :(

          But they do allow inbound port 25, so I can run my own mail server and just set their SMTP server as a smarthost in my own postfix config.

        • Earthlink Network started blocking outbound Port 25 about ten years ago, and AFAIK still does. If you're an Earthlink customer, either you use their SMTP servers or you don't use Port 25. I don't know how much good it does anymore, but at the time, it helped keep down the amount of spam coming out of them because having to use their servers makes it much easier to trace back and prove. Now, of course, they probably just use 587 to reach some foreign server that's set up to relay for them.
        • by RockDoctor (15477)

          The problem with that is that the people who do it become "criminals" under US law.

          And this is a problem because? Oh - this particular bit of research is based in the US.

          OK, so do your research under some more favourable legal system. Problem solved. After all, it's not as if the US is the only place in the world with acceptably high living standards for carrying out asll sorts of research, and if you feel the US's laws are inappropriate in this respect, then moving yourself (and any funding you carry, and

      • Re: (Score:3, Interesting)

        by mixmatch (957776)
        Maybe we should popularize free, safe sites like youporn, porntube, and xtube and this can all go away?
    • by Erikderzweite (1146485) on Saturday November 08, 2008 @10:39AM (#25687599)

      Or they could change the worm to format hard disks on infected machines -- once done, a PC cannot send spam till reinstall. And this time, the user will be a bit more careful about PC security.
      Problemo solved!

      • Re:Double standards? (Score:4, Interesting)

        by Seth Kriticos (1227934) on Saturday November 08, 2008 @11:10AM (#25687779)
        That is a bit harsh, but the basic idea is not that wrong. Users don't care about security because it is a bigger inconviniance than the not doing it. The botnets are quiet and Joe Sixpack can't relate insecure OS / config with spam (don't cares).

        Maybe someone should introduce some inconviniance for spam infected bandwitch usage (i.e. charge money for the potnet traffic)? If people have to pay for compromized systems, then maybe they will get up their ass*s. Just a thought.

        And yes, I know, the idea must be elaborated and gives a whole set of new issues.. Just ment as starting point for a discussion.
        • Re:Double standards? (Score:4, Interesting)

          by wvmarle (1070040) on Saturday November 08, 2008 @11:48AM (#25688033)

          It sure is a point that back in the day, the end user was really inconvenienced by viruses. Internet didn't exist yet for end-users, and software was transfered by floppy or over BBSes. Spamming hadn't been invented.

          The first virus I encountered was relatively benign: displaying fake cursors on your screen, something like that. Irritating enough to realise you're infected and figure out what's wrong and doing something about it.

          At the time many viruses were also designed to wipe/corrupt data - something that keeps you on the edge. That risk is much more direct, and much more costly that a slightly slower computer that tries to send out a lot of e-mail.

          Nowadays I do have to admit being less concerned about these viruses, except where it comes to keyloggers and so. That want to steal your banking data. However considering the profilation of fishing (recently I get dozens of mails for "update your Google AdWords payment information") even that seems to be a low risk issue.

          Besides I'm not using Windows... OS/X and Linux only... and I know not to click on links in spam, and browsing with non-IE browsers blocks 99.9% of the drive-by downloads but not all: I have got some requests for where to save a .exe file to; automatic download function. At least not hidden.

          • I don't realy get, how you relate to my previous post. I'm on Linux too and have no problems with this issue (except the spam sent to me).

            I was actually talking about the smuck next door, that does have no clue about it and also don't want to have it, neighter seeks help from someone how does.
          • by steelfood (895457)

            Ideally then, if you hijack a botnet so that on a certain day of the month (or of the year, like the Michelangelo virus), it corrupts certain system files and displays a message on bootup like "Your computer is infected with a botnet. Please reinstall Windows and apply all relevent security patches," you'd inconvenience a lot of people very quickly and force them to clean out/patch their systems.

            It's not as drastic as reformatting so it will retain data, and it won't secretly hit anybody's wallet so no user

            • by wvmarle (1070040)

              Good idea except for the corruption of file systems: 99% of the people won't notice the difference between that and an actual format/erase. The data is gone for them. Would be good business for data recovery companies.

              Randomly changing the background colour of the Windows desktop will do the job just as well.

        • I don't know that I agree with your spam-tax, primarily because you are going to see a lot of upset customers - A LOT - who will feel as if their ISP has shafted them with shady "you didn't know it but we're charging you for having an infected computer" practices. BUT, it wouldn't hurt ISPs to require user systems to pass a set of tests before getting online. Of course, that also raises questions and concerns - my reply would be "I paid for it now let me online!" ISPs hate it when you get irate - they ha
        • That is a bit harsh, but the basic idea is not that wrong. Users don't care about security because it is a bigger inconviniance than the not doing it. The botnets are quiet and Joe Sixpack can't relate insecure OS / config with spam (don't cares).

          What about Joe the Plumber? Some regular Joes understand a bit about how these maverick programs run in the background to do nefarious things. Do these people come to me all the time for help, because they think something may be amiss but aren't sure exactly wha
    • Re: (Score:3, Insightful)

      by Bokononist (1355095)

      The best they could really do with the addresses would be to track down the ISPs of the users. The ISPs would then be faced with spending time (== money) to link an IP and time-window to an actual user, and then inform that user.

      Their reward for this effort would be to have one of their technical support people spend an hour on the phone explaining to a clueless and scared someone that they needed to reinstall their XP & applications. This, they ultimately would not do.

      • Re: (Score:2, Insightful)

        Informing users? How? Most of them don't get how to use a door bell, not to mention complex computer concepts.

        How about some countermesures? I mean, if they can infiltrate the botnet, then is it not possible to track it's traffic? I mean, if the ISP's would do that, then they could block it (the control packages) and the spam clients may loose the spam to send out and idle around?

        Well, they probaby also must replicate and send a "Shut up" command to the clients.

        Messing with the users is mostly bad (no
        • Educate them. You don't need to teach them advanced computer concepts, just teach them safe browsing habits and a healthy paranoia of the vectors used for social engineering attacks. Users may still get worms and such from not having up-to-date systems, but user misaction is a bigger cause of problems than user inaction.

          There's enough people needing said education that you could run basic one hour classes for them. And the regularly spurted 'cost to the economy' figures for the fruits of stupid behaviour co

          • User: A free basic computer class? I don't have the time. Besides, I know how to download my pr0n, and my computer's running fine.
            ISP: But you're sending spam.
            User: No I'm not. I don't even use email.
            etc.etc.

    • Zap the partition table.

       

    • by mapkinase (958129)

      I anticipate legal problems for researchers. By some kind of exotic formulation of the Murphy's law, the first ones among those who break a law are the most innocent ones.

    • by qkan (89307)

      As some smart, responsible and otherwise nice people learned the hard way, one of the possible outcomes of reporting a security issue to the affected entity is being sued for illegal activity, reported to the feds etc. by the said entity. After reading some of these horror stories (and seeing no change in the trend over the last decades), I can say for myself that the only situation where I would report a security issue is to my employer since this is, well, my duty as a loyal employee. Or to a "known sane"

    • by plover (150551) *

      How come they don't track down the IP addresses of infected computers and inform the users their computer is compromised? It seems these researchers also are getting a kick out of the botnet at the cost of the victims.

      I think that would have been a responsible end to the study, but there was no mention in their paper of a "cleanup" phase. They did, however, take great care to follow an ethical code and "strictly reduce harm". To them, that meant: do not send victims actual malware, do not send victims to actual spammer sites, and do not collect credit card information. The spammers' victims were never "worse off" for having participated in the campaign.

      Of course, contacting these people saying "you were identified

    • This is what the study had to say on ethics:

      4.5 Measurement ethics

      We have been careful to design experiments that we believe are
      both consistent with current U.S. legal doctrine and are fundamen-
      tally ethical as well. While it is beyond the scope of this paper to
      fully describe the complex legal landscape in which active security
      measurements operate, we believe the ethical basis for our work
      is far easier to explain: we strictly reduce harm. First, our instru-
      mented proxy bots do not create a

      • by doob (103898)

        The BBC story on this [bbc.co.uk] says the site "...always returned an error message when potential buyers clicked a button to submit their credit card details". Surely it would have been more useful to display a message along the lines of "You idiot, you've just been duped by some spam. If this had been real we would have just stolen your credit card details. Please learn from this".

  • Spam protection (Score:4, Interesting)

    by Andr T. (1006215) <andretaff&gmail,com> on Saturday November 08, 2008 @10:41AM (#25687609)

    I don't have any data to back this up, but it seems to me that people are migrating from small provider companies to big internet provider companies - and their e-mail is going together. And it also seems to me that all those big companies have good e-mail filters (or they're getting one that will be good in a small period of time). If that's true, spam will face a dead end pretty soon.

    Even if you stay with a small provider company with your personal e-mail, there are many good solutions to avoid spam. I used Popfile [getpopfile.org] for a long time and it worked pretty well.

    Either way, if people will go to their spam box and click that viagra ad, it will be their problem. It doesn't affect me anymore.

    • Re: (Score:3, Insightful)

      by lysergic.acid (845423)

      that's a good point. i'm guessing part of the reason why Gmail has such a good spam filter is because they implement collective filtering by allowing users to easily mark spam messages, and also because with such a large user-base they can implement statistical filtering techniques much more effectively.

      what i don't get is why ISPs big and small don't just cooperate with each other and trade/pool information needed to fight spam. it would improve everyone's quality of service, so why not work together to ac

    • My email provider has good spam filters, so why do I have them turned off?

      I am on a mailing list. I had the mailing list domain on my whitelist and had the setting activated to 'block spam and send me a summary every 24 hours'.

      They sent me a summary every 24 hours listing a couple mails they were apparently not sure about and silently ate the rest - including all list traffic. Thank you guys. Now I am back to 25 spams a day.

      That was gmx.net in Germany.

    • by houghi (78078)

      The summery talks about 1 single response makes spam profittable. As long as that is happening, you pay for spam. Many people think that if they have a good filter that they have solved the spam problem. That is not true.

      Spam is solved if we don't need a filter anymore. A filter takes away the symptoms, not the desease itself. Better filters will change the 12 million to a higher number. So instead of 12 million, they send out 24 million spams.

      The best bet to actualy solve it will be to abandon SMTP complet

  • Storm Worm (Score:4, Funny)

    by phazux (752351) on Saturday November 08, 2008 @11:18AM (#25687821) Homepage

    Oh, Spam... right.

    When I first read the title, I was thinking more along the lines of:

    Bless the Maker and His water.
    Bless the coming and going of Him,
    may His passage cleanse the world,
    may He keep the world for His people.

    -- Frank Herbert

    • May the maker produce a spiced canned meat
      Bless the coming of him and curse his going for it is unpleasant

  • How about just raising the penalty for guilty spammers. You know, forcing them to read spam for 8 hours / 7 days a week for several years. Maybe that would help?
    • How about just raising the penalty for guilty spammers. You know, forcing them to read spam for 8 hours / 7 days a week for several years. Maybe that would help?

      That however does nothing to rehabilitate the spammer nor does it prevent relapse (See Spamford Wallace). I propose that we go directly to the death penalty and kill two birds with one stone.

  • by v1 (525388) on Saturday November 08, 2008 @11:24AM (#25687875) Homepage Journal

    I realize this will either be wildly popular with you or you'll hate it, but what I'd like to see someone do is infiltrate the botnet somehow (either by vulnerability or crack their key or whatever) and send a command to the herd to zero the boot sector and shut down their host. (the zombies, not the herder's machines)

    Nothing enough to cause data loss, but enough to force the naive owners to take their machines to someone to get them fixed/cleaned up. I'm tired of being a victim of computer neglect en masse.

    Not saying there's just one botnet out there, so I'd be greatly entertained to see them fall one by one. Should make a nice spectacle. Wouldn't it be entertaining to get up tomorrow and read front page stories all over the place the likes of which we got with Code Red, that a sizeable chunk of zombies just dropped off the grid and there were long lines at the PC repair shops this morning? Stories of entire businesses being brought to a halt because 95% of the machines in their office were owned? Sorry, but "serves them right", and thank you have a nice day while I go check my mail and see 80% fewer medications for sale.

    • by mdmkolbe (944892) on Saturday November 08, 2008 @11:34AM (#25687931)

      No need to zero the boot sector, just pop-up a window that says "you have been infected by the Storm worm" every two minutes. The machine is still functional so it is easier to fix, but recovery is easier and less likely to result in data loss.

      (This all is based on the assumption that doing so would be ethical which I don't think it is, but thought experiments don't hurt.)

      • by Anpheus (908711) on Saturday November 08, 2008 @12:22PM (#25688253)

        And so next time when malware like that damn Antivirus 2009 trojan is installed, they'll be more likely to follow the instructions: "Your computer is infected, click here to scan your computer."

        • by mdmkolbe (944892)
          Ok, so maybe we say "All your base are belong to us" and display I nice big red skull and cross bones along with the sound of a menacing laugh in the background. Like you say we don't want a "click here to fix", but all we need is to increase the visibility of the virus to the user. Once discovered viruses get removed (one way or another), the biggest problem is getting them noticed.
          • How about sending all their recently used URLs to everyone in the address book cc themselves? That should raise the profile a bit and send most people scurrying off to the nearest AV software.
      • Either is likely to result in data loss. Most people do not have the resources or the knowledge to handle a virus not caught by their scanner. And of the handful of technical support providers who support the software at all, I don't know any who will help with viruses beyond wiping and starting over.

    • by kvezach (1199717) on Saturday November 08, 2008 @11:50AM (#25688045)
      How about turning the machines on them? As far as I understood from the scientific paper, the proxy hosts are contacted by the botmasters (through servers run on bulletproof hosting). Thus it would seem pretty easy to just substitute the send spam command (when the workers ask) with a "DDoS this target" command, where the target is the botmaster server you got the original spam command from. The stronger the botnet, the harder it falls, and while bulletproof hosting servers may scoff at threats of police action, they sure won't like being DDoSed up the wazoo.
      • Re: (Score:3, Informative)

        by v1 (525388)

        The problem is most of them are "fast flux" - the C&C servers move around daily. There's no stationary target to hit. Even if you go after a host channel somewhere etc, they just move to a different IP and change domain name records.

        • by kvezach (1199717)
          The botnet is fast flux, but the master servers are relatively stationary; at least that's the impression I got from the paper. But it doesn't matter if they use fast flux. Just do a DNS lookup regularly and spoof DDoS commands targeting the new IP. If the botnet supports DDoS referenced by name, you don't even have to do anything. One would expect the DDoS part to have this functionality; otherwise, the affected servers of a "regular" DDoS could just move out of the way as with Code Red and the White House
    • Re: (Score:3, Interesting)

      by russotto (537200)

      I realize this will either be wildly popular with you or you'll hate it, but what I'd like to see someone do is infiltrate the botnet somehow (either by vulnerability or crack their key or whatever) and send a command to the herd to zero the boot sector and shut down their host. (the zombies, not the herder's machines)

      All that will do is get law enforcement after the vigilantes. Law enforcement is much more concerned with effective competition than they are with ordinary lawbreakers, so they won't stop bot

    • by Colin Smith (2679) on Saturday November 08, 2008 @01:22PM (#25688595)

      Consider it a form of quarantine.
       

    • Why not just replace explorer.exe with a simple app that tells them they have to get their PC fixed due to their own ignorance of basic security? I'm pretty sure all the major botnets run on Windows systems exclusively.

  • Only because the botnet operators steal resources in such a large manner they can turn a "profit". Whatever that may be. How do you calculate a script kiddies costs anyways?

    The much more interesting information was the US$ 2700 for about 350 Million Spam messages received and (an estimated) four times as much sent.

    Rounded up that is a dollar earned for every 10 Million messages received and 40 Million messages sent (and caught as spam early on). Not counting that: "Still, the researchers acknowledge their f

  • by Anonymous Coward

    A single response in 12 million emails ? So someone orders $50 of 'GetHard' or whatever.

    Then introduce micropayments on all emails. $50/12,000,000 or about 0.5 millicents an email. No normal operation would suffer, and spammers can't make a profit. Job done.

    • So your plan would result in Joe Sixpack getting a bill for email that he claims he didn't send.

      And he would be correct. He would not have sent it. His machine would have. While it was a zombie.

      • by maxume (22995)

        This is only sort of a problem; it would at least get their attention.

        • No, they'd just get pissed at their ISP for billing them for something they didn't do, and rightfully so.
          And when the ISP didn't budge, they'd go to a new one, if they're anywhere other than monopoly-fascist USA, with no broadband competition.
          No matter how many times this happened, it would always be the ISPs fault, according to the customer.

  • proposing refundable microcharge for sending email [vad1.com] (which is NOT fully refunded ONLY when the recipient subsequently marks incoming email as spam). Obviously my idea might be flawed, but those who have critiqued it never formulated why. At the present conversion rates, a refundable cent per email will do wonders. Possibly it will kill spam, or at least change its quality and quantity very considerably.
    • Re: (Score:3, Informative)

      by TheLink (130905)
      How do you pay?

      So far it's hard to pay random people on the internet. For instance if I want to pay you USD1, it'll cost me more than USD1 in time and money to do so.
    • Re: (Score:1, Informative)

      by Anonymous Coward

      Joe Dumbass signs up for Bass Fisher Extreme News letter.

      Bass Fisher Extreme sending him his weekly email.

      Joe Dumbass forgets he signed up for this and hits the 'Report SPAM' link instead of the 'unsubscribe' link.

      Bass Fisher Extreme loses money.

      • by Yvan256 (722131)

        Bass Fisher Extreme should monitor the bounced/spam-tagged emails on their list to stop sending them to these people.

        Total cost: 1 cent per Joe Dumbass user. And if micropayments exist to do that, then they also exist to require micropayments from subscribers. At 1 email per week, it cost someone 52 cents per year to receive the newsletter, which is half the 99 cents threshold for impulse purchases.

      • by mixmatch (957776)
        Bass Fisher Extreme sees the list of charged emails and removes them from their system.
    • Re: (Score:1, Insightful)

      by Anonymous Coward

      Your post advocates a

      ( ) technical ( ) legislative (x) market-based ( ) vigilante

      approach to fighting spam. Your idea will not work. Here is why it won't work. (One or more of the following may apply to your particular idea, and it may have other flaws which used to vary from state to state before a bad federal law was passed.)

      ( ) Spammers can easily use it to harvest email addresses
      (x) Mailing lists and other legitimate email uses would be affected
      (x) No one will be able to find the guy or collect the mone

  • by slashdotmsiriv (922939) on Saturday November 08, 2008 @11:49AM (#25688035)

    the researchers seem to take the legality of their actions under serious consideration. From TFA:

    "Measurement Ethics:
    We have been careful to design experiments that we believe are both consistent with current U.S. legal doctrine and are fundamentally ethical as well. While it is beyond the scope of this paper to fully describe the complex legal landscape in which active security measurements operate, we believe the ethical basis for our work is far easier to explain: we strictly reduce harm. First, our instrumented proxy bots do not create any new harm. That is, absent our involvement, the same set of users would receive the same set of spam e-mails sent by the same worker bots. Storm is a large self-organizing system and when a proxy fails its worker bots automatically switch to other idle proxies (indeed, when our proxies fail we see workers quickly switch away). Second, our proxies are passive actors and do not themselves engage in any behavior that is intrinsically objectionable; they do not send spam e-mail, they do not compromise hosts, nor do they even contact worker bots asynchronously. Indeed, their only function is to provide a conduit between worker bots making requests and master servers providing responses. Finally, where we do modify C&C messages in transit, these actions themselves strictly reduce harm. Users who click on spam altered by these changes will be directed to one of our innocuous doppelganger Web sites. Unlike the sites normally advertised
    by Storm, our sites do not infect users with malware and do not collect user credit card information. Thus, no user should receive more
    spam due to our involvement, but some users will receive spam that is less dangerous that it would otherwise be."

    However, their premise of "reducing harm" is questionable. How can we be sure that a person who decided to purchase these drugs (against all warnings) really believes that not buying them is the best thing for him? What if this person really wants to purchase a drug that he thinks will enlarge him? Who gives the researchers the right to decide what other people should spend their money on? Under several legal interpretations, forcing a person not to buy something perceived as harmful is not legal: denying to sell cigarettes to a person of legal age may be illegal, under discrimination laws.

    The bottom line is that the researchers have a good point regarding the ethics of their study, however this issue is not 100% resolved.

    • Re: (Score:2, Informative)

      by jonbwhite (1402901)

      However, their premise of "reducing harm" is questionable. How can we be sure that a person who decided to purchase these drugs (against all warnings) really believes that not buying them is the best thing for him? What if this person really wants to purchase a drug that he thinks will enlarge him? Who gives the researchers the right to decide what other people should spend their money on? Under several legal interpretations, forcing a person not to buy something perceived as harmful is not legal: denying to sell cigarettes to a person of legal age may be illegal, under discrimination laws.

      The site that the spam normally points to actually sends placebos or mislabled painkillers instead of the actual drugs, so I don't think this is really an ethical issue. However, even if the site did send the real drugs, it is *not* difficult to find an alternative website willing to sell the same items. Not to mention the fact that the sending of the spam was illegal in the first place.

    • What if this person really wants to purchase a drug that he thinks will enlarge him? Who gives the researchers the right to decide what other people should spend their money on? Under several legal interpretations, forcing a person not to buy something perceived as harmful is not legal: denying to sell cigarettes to a person of legal age may be illegal, under discrimination laws.

      In this case, the sale would be illegal since we're talking about "drugs" that aren't FDA approved being sold without a prescrip

  • I can now die happy having seen the phrase, "Excellent Hardness is Easy!" in an academic paper.
    • "Excellent Hardness is Easy" sounds like an ideal title for a TCC submission if I've ever seen one. They're at home with stuff like:
      "Semi-honest to Malicious Oblivious Transfer - The Black-Box Way"
      "On the Complexity of Parallel Hardness Amplification for One-Way Functions"
      "The Ultimate Male Package", well that one's actually from my spam folder.
      http://www.cs.nyu.edu/~tcc08/ [nyu.edu]

  • "Botnets. Spammers Botnets.
    What kind of boxes are on botnets?

    Compaq, HP, Dell & Sony, true!
    Gateway, Packard Bell, maybe even Asus, too!

    Are boxes, found on botnets, all running Windows, FOO!"

    Why is it that TFAs almost never mention the OS of all the computers that make up these botnets?

    Perhaps it's just one of those things that EVERYBODY knows, and as such, doesn't really need to be mentioned.

    • by bobbonomo (997543)

      You are probably right about the *indows machine in the botnet. The brand is irrelevant.

      What is never mentioned is how many servers are infected (websites) with malware (or participate in it) because of errors in the apps running on them. I would say most of these are running *nix. I don't see IIS that much.

      I think we are converting a botnet (spam) problem into a religious OS thingy.

      Hygrade frankfurts are fresher because more people eat them or do more people eat them because they are fresher?

      There are more

    • Re: (Score:1, Flamebait)

      by justinlee37 (993373)

      If Linux had the greatest market share, it would have the most viruses. Windows is just a big target. Think about it -- if you wrote a virus, would you rather design it to attack 90% of the OSes in the wild, or 2%?

      The smugness of the "windows has viruses because it sucks" position is a really poorly thought-out one.

      • Just keep saying it though. Maybe eventually people will believe you.

        • I got modded flamebait and contradicted twice, but nobody has offered any evidence whatsoever.

          I'm not a computer scientist or programmer. I study economics. I'm making my inference based on logical conjecture.

          I'd love it if a real programmer chimed in and explained why Windows is "so easy to 0wn" as it is compared to Linux. And I want to hear solid architectural reasons; "Windows lusers are more likely to run an infected .exe on their machine because they think it's a picture" is not a sufficient reason, si

          • Your mistake. It's right here.

            Don't worry. It's a common error. Get the facts and you'll understand.

            • Oh, the facts! Of course, why didn't I consider those before. Now it makes complete sense. *rolls eyes* You're not very helpful.
              • Sorry about that. One of the problems with slashdot is that it can be tricky touching upon common memes, and you've stumbled on one. The problem with your assertion is that it's been made for fifteen years, thoroughly examined, and disproved in every case.

                GNU/Linux is not Windows. It won't ever be. Because Linux is available in over 1,000 distributions and hundreds of versions, and always will be, the generic reference to "Linux" includes far more scope than "Vista" or "W7" ever could. Linux is availab

                • No one exploit is going to be broad enough even to get most of them, and you can't say that about any version of Windows.

                  Isn't that basically a summation of my original point? There's just no incentive to the hacker to write a specialized virus, unless they have a very specific target or motivation, so Winblows gets all of the hijack-your-bank-account keylogging trojans?

      • People write viruses & trojans & worms to infect Windows because Windows is so easy to 0wn.

  • Unsolicited spam email Subject lines _MUST_ contain the phrase, "this is an unsolicited email". I think that would pretty much cover it. (The word Spam isn't used so there isn't any gray area with that processed meat product). I know that there have been attempts at this before and it has been shot down but I don't understand why. Obviously the purpose of this would be to have these in email filters to block the crap all of the time so why doesn't it pass? Someone in the gubment think it unfair to all
    • by Waccoon (1186667)

      I recall an article about the "Spam King" where he clearly rejected the idea of putting such markers on his e-mails. Legal or not, he said he wouldn't.

      There's no such thing as enforcement when faced with billions of messages every single day. You're on your own to protect yourself, bub.

  • I see two potential solutions...

    One is a worm that's released in the wild whose sole purpose is to find and clean infected/vulnerable computers, and then throw huge warning signs at them. If the same machine is re-infected X times within a year, the worm just shuts the computer off. A Robin-Hood worm of sorts. Illegal just like Batman, but hell, if it does the internet some good, why not. If they don't do it, the vulnerable hosts don't just disappear. Instead, they just sit there waiting for real hacke

Old programmers never die, they just branch to a new address.

Working...