Slashdot

If it were up to me, I'd harden the targets. Even if that meant making Microsoft financially liable under defective product laws for any losses incurred due to these botnets. The choice for Microsoft would be, stop selling Windows as a general consumer product touting claims of security and ease-of-use or face product liability for its insecurity. If they want to sell Windows as a product designed for skilled/competent users who understand the security issues it would be a different story, but then they'd lose the massive market they currently enjoy. Let them decide whether the product liability or the reduced market is more beneficial to their bottom line. This might have the side-effect of making Windows less of a monopoly, and thus less of a monoculture that allows one exploit to immediately impact millions of machines.

Either way the idea that Joe Sixpack can use an immensely complex system that he doesn't remotely understand and never expect a bad result is an illusion that needs to go. It leads to a parasitic situation where Microsoft profits from Windows and everyone else pays its costs above and beyond its price tag at the point of sale. This is unjust. Doing something about this would be good for everyone except maybe Microsoft, and for that I'd have to quote Spock about the needs of the many outweighing the needs of the few or the one. In the long term, serious pressure on Microsoft to improve Windows might even be beneficial to them as well.

So yes, hardening the targets is the approach I would take. When you have millions of systems with massive vulnerabilities I am not remotely surprised that someone somewhere is going to come along and exploit them. It's rather predictable. You can spend two years and a great deal of effort and expense to catch three of them, but during that two years how many more than three have committed similar crimes? It's a losing game so long as the supply of these criminals exceeds your ability to catch them. That's if your goal is to eliminate botnets. If you have a strong preference for some form of visceral satisfaction, then the current criminal justice approach would be more to your tastes.

It wasn't really my intention to make this a post about Microsoft, but how can you separate them from any sincere discussion about botnets? These million-plus-member botnets might have a great deal of diversity in terms of their function, their method of propagation, their purpose, and who is at the helm. They all have one thing in common: Windows. Targeted attacks by a skilled and determined human adversary are one thing. It's automated self-propagating write-once-exploit-everywhere script-kiddie bullshit for which there is no excuse. It is the latter and not the former that allows for millions of machines to become members of a botnet.

If you're a Microsoft fanboy, Windows is targeted because it's so popular. Because it's so popular and so thoroughly targeted, it needs to be one of the most security-hardened. Call it the price of success. If you're not a Microsoft fanboy, then Windows is targeted because it is inherently less secure. That makes it the squeaky wheel in need of some serious security oil. Either way, it's a pointless debate because what needs to be done about the situation is the same. Because they have such a wealth of resources and talent, I have full confidence that Microsoft could make a Windows secure enough to frustrate automated self-propagating attacks if they truly wanted to do it.