CastleCops Anti-Malware Site Closes Down 68
Fortran IV writes "Volunteer-powered anti-malware site CastleCops appears to have closed shop. As of Tuesday, December 23, the CastleCops home page notes: 'You have arrived at the CastleCops website, which is currently offline. . . . Unfortunately, all things come to an end.' It was reported back in June that Paul Laudanski, founder of CastleCops and its parent Computer Cops LLC, was taking a full-time job with Microsoft and was 'looking for new management' for CastleCops. The site has also long had problems with funding and with hostile action from spammers. The actual shutdown seems to have taken the security community by surprise; as late as Tuesday evening Brian Krebs was still recommending CastleCops on his Security Fix blog."
Hostile Action from Spammers (Score:3, Informative)
So in other words: they won that battle.
Re:Hostile Action from Spammers (Score:5, Insightful)
Basic problem:
Castlecops were volunteers. Spammers do what they do for a living. Eventually, the volunteers have to get back to the real world, while the spammers keep going and going because you're hitting them in the pocketbook.
Either we need a lot more volunteers, or we need to start imposing the the death sentence on convicted spammers and get the root problem solved.
Not really (Score:3, Informative)
Re:Hostile Action from Spammers (Score:5, Insightful)
That'll stop spam about as well as prison terms and (sometimes) death sentences have stopped drug traffickers. What you are dealing with is not a technological problem, which is why spam filters and anti-malware efforts have not ended spam. You're not dealing with a legal problem either because even if new laws to punish spammers somehow worked perfectly, and they won't, that could only change the jurisdiction from which the spam is being sent. Not to mention that if spamming becomes riskier because more spammers are caught and punished, you will actually make it more profitable for the ones that don't get caught (possibly those from other jurisdictions) because you will have removed their competitors.
This is an economic problem. The interesting thing about economic problems is that so long as there is sufficient demand for something, the suppliers will amaze you with both their ingenuity and their willingness to take risks to deliver it. We saw this with alcohol prohibition, we see this now with the War on (Some) Drugs, and we're also seeing it now with spam. The real problem with spam is that the spammers' costs are extremely low and there are enough idiots who buy from them to make it profitable. Punishing spammers amounts to a form of prohibition. Prohibition has never worked (they can't even keep illegal drugs out of prisons) and it's not going to start working now. It really amazes me that so many human beings can understand human nature so poorly that it was ever even tried, let alone that it continues today despite any social costs and that there are still people who would suggest applying this failed idea to more novel problems. When we, collectively, try something and find out that it has never worked and is never going to work, we think the solution to that is to try harder instead of trying something else. It's like a cross between that saying about having only a hammer and perceiving everything as a nail and that saying about the definition of insanity.
If the goal is to catch a tiny percentage of them and feel vindicated while your inbox continues to fill up with spam, the "crime and punishment" approach will do. If your goal is to end spam, then your only real option is to reduce the number of people willing to buy from spammers (the demand) until spamming is no longer profitable. Like many others, I have some ideas but I don't have the solution. At this stage though, I think that what's missing is a sound understanding of the problem.
Your premise is wrong (Score:4, Informative)
Spamming V1aG4 isn't were the money is at. The big money is in identity theft, espionage and pump & dump schemes. These crimes are committed by using botnets that host phishing sites, send out phishing spam, and use scripts to log into bank accounts and broker accounts.
It is an economic problem, yes. It is *not* analogous to prohibition. This stuff *is* criminal and the crimes committed cost tens billions of dollars each year. The solution is *not* to just toss your hands up and say "we give up", the solution is to lock these fuckers up and toss the key. We, as a society, need to clamp down on these fuckers before they do something that really screws with us. And don't kid yourself either, these people are sitting on top of some of the most powerful distributed computers on the planet.
Chicken Bone Spammers, V1agr4 and R0l3x W4tches is old school 1998 thinking. That crap is the little leagues. The big money is in "professional," massive, highly organized, sometimes government funded crime. This is the big leagues and the assholes playing in it need to be stopped.
Re:Your premise is wrong (Score:5, Interesting)
Spamming V1aG4 isn't were the money is at. The big money is in identity theft, espionage and pump & dump schemes. These crimes are committed by using botnets that host phishing sites, send out phishing spam, and use scripts to log into bank accounts and broker accounts.
It is an economic problem, yes. It is *not* analogous to prohibition. This stuff *is* criminal and the crimes committed cost tens billions of dollars each year. The solution is *not* to just toss your hands up and say "we give up", the solution is to lock these fuckers up and toss the key. We, as a society, need to clamp down on these fuckers before they do something that really screws with us. And don't kid yourself either, these people are sitting on top of some of the most powerful distributed computers on the planet.
Chicken Bone Spammers, V1agr4 and R0l3x W4tches is old school 1998 thinking. That crap is the little leagues. The big money is in "professional," massive, highly organized, sometimes government funded crime. This is the big leagues and the assholes playing in it need to be stopped.
But that's exactly why new laws aren't going to work. What you're talking about there is fraud. Fraud is fraud; it's not something new just because the means of communication was a networked computer. Fraud is already universally illegal (everywhere or nearly everywhere) and this hasn't stopped the type of spam that you mention. Why? Because these criminals are finding it to be very profitable.
The laws that imprison or execute people for things like rape and murder have some deterrent effect on would-be criminals because there is generally no enormous economic incentive to rape and murder people and the desire to do those things is widely recognized as aberrant and pathological. Contrast that with spam (any kind) where there is a strong economic incentive (it's only getting worse so it's obviously profitable) and the desire to make money is generally valued and encouraged by our society -- the problem with spam is the destructive method by which that desire is satisfied, not the desire itself. In my mind, that's the difference between enforcable laws and unenforcable laws.
I believe that my previous point was sound and still applies here. The only thing your clarification changes is the application of the term "demand". Whereas before, demand constituted people who purchase items from spammers, now it also describes people who want to connect a computer to a network that is known to be hostile without learning how use it securely (botnets), people who want to make transactions without careful authentication (phishing), and people who want to get rich quick or who think that some random spammer with a stock tip really has their best interests at heart (scams). Whether such people are genuine victims or merely suffering the consequences of poor decision-making makes no difference to the spammer. A large (enough) number of people who keep doing these things despite all of the warnings against them and all of the information available is indistinguishable from the usual sense of the word "demand" as far as spammers are concerned.
What I am telling you is that so long as this is the case, you can make the penalty for this type of fraud as severe as you like and it will make no difference, for all of the reasons I have outlined in my previous post. It is prohibition because there is a large enough demand to make $ACTIVITY profitable and you are trying to eradicate $ACTIVITY by punishing $SUPPLIER in an effort to destroy $AVAILABILITY. It will fail for all of the reasons why more traditional forms of prohibition have failed.
Remember that you don't need perfectly knowledgable users running perfectly secure systems so that online fraud is completely impossible; you just need knowledgable enough users running secure enough systems to make fraud difficult enough that it's no longer profitable. Accomplishing this is merely very difficult; catching, prosecuting, and punishing enough spammers to achieve anything resembling "stopping spam" is utterly impossible.
Re: (Score:2)
My real response to you is this post [slashdot.org] but I also wanted to ask you something.
What I am advocating is that we should attempt to understand the real nature of the problem before we even begin to think about implementing any solutions. This may include a willingness to question what we think we know about it since the "conventional wisdom" has thus far gotten us nowhere. It mig
I agree (Score:2)
And I suspect we are a bit on the same page. Personally, I think most computer crime is akin to real-world viruses. The stronger our anti-boitics, the stronger and more resistant the bugs get.
My only concern is, and I doubt you are part of this, sites like Slashdot seem to carry a strange attitude that because something takes place on a computer, it is immune from law. You sometimes see comments from people who whine about a spammer getting 10 years in jail--"they didn't hurt anybody". You'll get a stor
Re: (Score:3, Interesting)
I think much of that comes from the "artificial scarcity" nature of copyright and the repeated extensions to both the duration and severity of copyright law. Our legislators are not carefully evaluating whether or not technology has made this model obsolete and using the results o
Re: (Score:2)
Not to mention the fact that there IS a legal problem here. OP mentions the fact that most pro spammers reside outside US jurisdiction. Jurisdiction is by definition a legal/diplomatic problem.
In some ways it's similar to the "War on Terror": you have a bunch of criminals preying on peaceful neighbors and ducking across the border when things get too hot for them. Unfortunately, we can't send a bunch of Predator drones to launch missile strikes against cyber-criminals in Russia and China with the same impu
Re: (Score:1)
Re:Hostile Action from Spammers (Score:4, Informative)
Re:Hostile Action from Spammers (Score:4, Insightful)
I am [was] a volunteer security expert on CastleCops. I helped hundreds of people, but the task was very daunting. Back in the hayday for malware, there were literally hundreds of new posts everyday with problems that would take more than a canned response and a hijackthis log. There was only a handful of us and to be honest, I am surprised that it lasted as long as it did. I know I would get burned out and disappear for a few months then pop back in and try to help a couple people.
I should preface this by saying that your efforts are noble and should be commended. I am encouraged any time I see people like you who are willing to selflessly try to do something about a problem especially against what must seem like impossible odds. What I would like to see this world become has a lot more of that spirit than the real world does.
I'll be honest with you and hope that how I genuinely feel about this doesn't appear to you to contradict what I just said. I don't really believe in this kind of solution, not because it's labor-intensive but because it addresses a symptom or a result instead of addressing the underlying problems that keep causing it. In other words, it is damage control and not real prevention.
If you study computer security, one (very sound) idea you will come across is the notion that once a machine has been compromised, the only way to ever trust that machine again is to reformat the hard drive and reinstall the operating system from known good media. To our detriment, the way security is generally handled flies in the face of this observation. There is a plethora of virus removal tools and spyware removal tools provided by what has become quite the cottage industry. These tools operate by detecting and attempting to remove known malware from a system that has been compromised. After the malware is removed, the system continues to be used even after it has been both compromised and proven to be configured/operated in an insecure fashion. This is perfect for the antivirus companies because the job can never be finally completed. Under this model, there will always be work in the form of finding, analyzing, and creating signatures and heuristics for new malware. Work that someone will have to be paid to do. What was a volunteer effort that caused burnout for you equates to $$$ dollar signs for them.
What is needed is a proper security system built into the OS that can prevent the compromise from happening in the first place. Windows can be found on the vast, vast majority of computers and Windows has no such security system (whether anyone else has or does not have such a system is not my point; this isn't intended to be a Unix vs. Windows debate). Further, no one in the security industry is really interested in providing one because by doing so they would kill their own market. If Microsoft tried to implement something like that, something far more effective and less of a "band-aid" than UAC, they would receive tremendous pressure to desist from an entire industry. What further complicates the problem is that there is a very large and very ignorant userbase which does not understand these issues and does not care to learn about them. Because of that, they have come to accept this as normal and "just the way things are done", as though entering into an malware vs. antimalware arms race that cannot possibly be won is an inherent feature of computing.
I hate to say it but I think this will have to get worse before anyone will be truly interested in making it get better. Call me cynical for saying so if you will, but as a culture we're not very big on dealing with foreseeable problems while they are still relatively small and managable and prefer to ignore them until they become a crisis first. I have said for some time that perhaps the best thing that could happen would be a wake-up call in the form of a virus/trojan/worm that infects a machine, spreads itself rapidly to other machines, and then destructively formats
Re: (Score:2)
You call the arms race a huge mistake, I think you'll find that it's an unavoidable natural law.
At the first layer, it appears that the reason we've fallen into this trap is that the whole electronics industry is build on an "arms race" model called Moore's Law. In computers, you have to buy new hardware to run the newest software, then developers come up with new software (Vista) that exceeds the current HW capabilities. You can find similar examples in media recording formats, TVs and so on. So perhaps th
Re: (Score:1, Offtopic)
Re:Hostile Action from Spammers (Score:4, Informative)
Excuse me, but what is the US Constitution's Second Amendment for, exactly?
"No free man shall ever be de-barred the use of arms. The strongest reason for the people to retain their right to keep and bear arms is as a last resort to protect themselves against tyranny in government." --Thomas Jefferson
"That the people have a right to keep and bear arms; that a well regulated militia composed of the body of the people trained to arms, is the proper. natural and safe defense of a free State. That standing armies in time of peace are dangerous to liberty, and therefore ought to be avoided, as far as the circumstances and protection of the community will admit; and that. in all cases, the military should be under strict subordination to and governed by the civil power." --George Mason
"The said constitution shall never be construed to authorize Congress to prevent the people of the United States who are peaceable citizens from keeping their own arms." --Samuel Adams
"Americans have the right and advantage of being armed -- unlike the citizens of other countries, whose governments are afraid to trust the people with arms." --James Madison
"Are we at last brought to such a humiliating and debasing degradation that we cannot be trusted with arms for our own defense? Where is the difference between having our arms under our own possession and under our own direction, and having them under the management of Congress? If our defense be the real object of having those arms, in whose hands can they be trusted with more propriety, or equal safety to us, as in our own hands?" --Patrick Henry
"[A]rms like laws discourage and keep the invader and the plunderer in awe, and preserve order in the world as well as property. The balance of power is the scale of peace. The same balance would be preserved were all the world destitute of arms, for all would be alike; but, since some will not, others dare not lay them aside. And while a single nation refuses to lay them down, it is proper that all should keep them up." --Thomas Paine
Re: (Score:2)
How the hell did a thread about CastleCops going down devolve into Yet Another Gun Thread(tm)? No matter, I suppose...
Things were as they were in Jefferson's time. Today, if your aim is to be able to fight the military of the US, your best bet, according the latest results in far-o
Re: (Score:2)
What does it have to do with gun ownership? They are not proposing that (during peacetime) the standing army should be replaced with nothing. They are saying that the standing army should be replaced by everyday ci
Re: (Score:2)
Either we need a lot more volunteers, or we need to start imposing the the death sentence on convicted spammers and get the root problem solved.
Right. Kudos to Microsoft for picking up a good member of the community. I sincerely hope he'll be able to help. Whatever platform you use, spam and trojans diminish everyone's experience.
Still, even if Paul Laudanski's expertise is top-notch, he was but one piece of the larger community. This isn't quite like a government where someone leaves to work elsewhere. In those cases, a system takes over, pushes a person into the vacated position, and business continues. In this case, the community is now closed,
Re: (Score:2)
All things? (Score:3, Funny)
Unfortunately, all things come to an end.
Even Microsoft?
Re: (Score:2)
No Microsoft -> no massive malware problem!
(inb4 "but any popular system will be insecuuure!!!")
tag this neverheardofit (Score:2)
Editors: how about posting news about cool services and sites before they die so that we can check them out, use them, and contribute (ie, keep them from dying)? I have seen things like this in the firehose, but they never make the front page.
Just a thought.
Re: (Score:2)
If you never had a reason to run across CastleCops then you likely would not have been the sort to help out.
After all, CC has been high visibility on the web for years, you just haven't been searching for the types of information that they collected.
This was not exactly an obscure website. Those who are interested can check threads over at Wilders where some enterprising souls are collecting CC content out of the Google cache as quickly as they can.
Re: (Score:2)
I've got your superhero -right here [youtube.com].
Re: (Score:3, Informative)
I'd hardly call $150 Million [cnet.com] a controlling share. Microsoft bought about 8 Million shares, and there are about 800 million shares currently outstanding. So approximately 1% of current - or 4% accounting for the 2000 and 2005 2:1 splits (each).
* figures based on cnet article linked above ($150M/$19) and current stock price and market cap [google.com]. This doesn't take into account new issues or share buybacks, which likely do not materially affect my case.
the community (Score:5, Insightful)
The website looked a lot like all the superwindowsvirussmasher scam websites....You may have trojan.dropper.w32, free scanner here! with all the ads, color, and layout.
It's possible that it just never presented a legit-looking or professional experience. I'm no the only one who thought this...the community let it die too.
Ditto (Score:3, Interesting)
The look of that site always made me nervous and I could never really tell if it was legit. Correct me if I'm wrong, but isn't CastleCops the ones who distribute HijackThis? I think so, because I'd always get nervous about downloading it from that website.
It must be hard to use AdSense on a security site like that because most of the ads would be "you may have blah blah blah". One of the flaws in AdSense, I suppose.
Re: (Score:1)
Re: (Score:3, Informative)
Process Explorer (Score:2)
Re: (Score:2)
HijackThis was a critical tool for anti-spyware work. Every tech who knows anything has it in his anti-spyware toolbox. It was dangerous for end users to use it because it showed everything that was hooked into IE. The usual advice was run it and post the results on the site for others to analyze. Generally I found it not difficult to tell what was the crap to be removed.
The important thing about the site was the forums. If you ran across some spyware that was resistant to the usual utilities like Ad-Aware,
Re: (Score:1)
Re: (Score:1, Interesting)
Posting this as AC because I'm the one who made up the design for that site... back when it was Computer Cops and not Castle Cops... and this was also about 7 years ago when that "look" was fresh for the internet.
Imagine my surprise when browsing around I stumbled there and saw the same design, just kind of more raped and pillaged for the CMS. Not saying it was great to begin with, but that's one of the few sites that was probably Web 0.5b, and decided to stick it out.
It's one of the sites I don't tell peop
Re: (Score:2)
Well, it was still a useful site, so dont feel too bad :-)
Re: (Score:2)
Personally I would much rather have useful than pretty.
Re: (Score:2)
It was a legit website, and a good one at that.
Free as in no money (Score:1, Insightful)
taking a full-time job with Microsoft = my unemployment and savings ran out and then my ARM reset
'looking for new management' = did you just lose your job and have 6 or seven months of unemployment to tide you over (unadjusted ARM holders need not apply)
problems with funding = you can only bark up a tree so many times before even the most benevolent/stupid people stop handing you cash.
A big LOSS for no acceptable reason (Score:2, Interesting)
This seems to have been such a badly handled shutdown. I've been tracking it since Dec 24th. and I was wondering if anyone at slash-dot would even comment. Now finally there is a thread.
By just shutting down CC, Paul Laudanski has destroyed the work of many many volunteers. All the reference pages on malware, illegitimate & legitimate dll's etc are just GONE. Additionally pages on specific projects like proximotrom (sp?), etc have just been vaporized. From what I have been able to find NO ONE was
Re: (Score:1)
I've previously worked for one of the large tech support companies, fixing machines etc.
Castle Cops was one of the resources when you found a particularly nasty infection, that you'd know would be a good resource - so when it turned up in Google searches, you'd hit it. Mind you, we did our stuff remote - so we had to be extra careful about how we fixed things. (Pilot project and all that, panned out apparently, then outsourced - wheeee!) I'm not terribly surprised they didn't try to fund any of these, si
Mod parent up (Score:1)
Not sure why this was modded down - very important point. Why was an entire site by volunteers simply shuttered with no time to move the donated content elsewhere? It was a goldmine of anti-malware tips and techniques generously given by hundreds, if not thousands, of users over the years. Geeks (even more than most people perhaps) generally abhor having to figure something out that has already been solved. It is simply a waste of brain power (which God knows is in rather short supply). Now with this reposi
Switch-Hitter..... (Score:2, Interesting)
"It was reported back in June that Paul Laudanski, founder of CastleCops and its parent Computer Cops LLC, was taking a full-time job with Microsoft"
-And this turncoat joins *MICROSOFT"?!
I though he was *ANTI-* malware!