Research Project Pays People To Download, Run Executables 76
msm1267 (2804139) writes Incentivized by a minimal amount of cash, computer users who took part in a study were willing to agree to download an executable file to their machines without questioning the potential consequences. The more cash the researchers offered, capping out at $1, the more people complied with the experiment. The results toss a big bucket of cold water on long-standing security awareness training advice that urges people not to trust third-party downloads from unknown sources in order to guard the sanctity of their computer. A Hershey bar or a Kennedy half-dollar, apparently, sends people spiraling off course pretty rapidly and opens up a potential new malware distribution channel for hackers willing to compensate users. The study was released recently in a paper called: "It's All About The Benjamins: An empirical study on incentivizing users to ignore security advice." While fewer than half of the people who viewed the task actually ran the benign executable when offered a penny to do so, the numbers jumped to 58 percent when offered 50 cents, and 64 percent when offered $1.
Did they say HOW to run it? (Score:2)
Re:Did they say HOW to run it? (Score:5, Interesting)
Apparently you weren't the only one who thought so; but the numbers were small. 16 VMware VMs, 1 Parallels (which, since the study required windows to participate, may have been a security measure or may have been a mac user willing to hose his 'everything I need windows for' machine...)
No word, obviously, on anybody who is a bit more subtle about their VM usage; but I'd be shocked if that number is high.
Re: (Score:3)
Re: (Score:2)
Who said anything about a buck?
1. Create script to register Amazon Turk account and spin up EC2 instance for an hour
2. while (true) { run_script(); }
3. Profit!
Re: (Score:2)
Re: (Score:2)
And you would all do that for just a buck?
Heck, some disgruntled employees would pay them a buck for the payload to run on their work PC that might cause their employer a huge loss... :)
Re: (Score:2)
I didn't take part in this little thing. But, I'll mention that I have downloaded malware, intentionally, just to look at it. "Hey, Dad, I found a site that does a driveby installation of crap. Don't go there!" So, I load the site, let it do it's thing, find and decompile the executable, nod my head, and say, "That's pretty slick - I wish they'd find the bastard and castrate him."
It should be noted that almost nothing runs on my locked down Unix-like boxes. Sure, Javascript enabled allows them to hijac
Re: (Score:2)
Sure, Javascript enabled allows them to hijack the browser, and take it over, but that doesn't take over the system!
Bad assumption, as you'll find out one day when a privilege escalation attack you weren't aware of succeeds and they pwn you. Hell, a few years back there was a bug with libpng that would allow that just by the browser rendering the image!
Re: (Score:2)
Okay - sometimes malware does unexpected things. I lose the VM that I'm running. Is that privilege escalation going to give it control of VirtualBox, and then the host system?
I suppose it's possible, but curiosity causes me to take chances now and then.
Besides - the boxes that I play on aren't critical. I wouldn't do this kind of stupid shit on a production machine, after all.
Re: (Score:2)
The software did chat over the network (they were interested to see if people would
Nope, but it was through Amazonâ(TM)s Mechani (Score:2)
Because it was through Amazonâ(TM)s Mechanical Turk, I'd take any "findings" with a grain of salt.
Re: Nope, but it was through Amazonâ(TM)s Mec (Score:2)
A quick 50 cent or $1 task on mturk could be the highlight of someone's afternoon, when one is stuck thinking in terms of relative value, after tens or hundreds of nickel and dime (or less) tasks.
Re: (Score:2)
Dosbox isn't meant for security.
Tue, but that doesn't mean you cannot use it securely.
It can mount a path and modify anything your user can modify.
True, but it doesn't mount much of anything by default. If you mount your entire hard drive at startup in dosbox you're an idiot and deserve what you get.
Re: (Score:3)
Squirrel! (Score:1)
It is so easy to get distracted these days ...
Security can be so boring.
wasnt this on ./ before ? (Score:1)
i remember i read this somewhere before i tought i read it here on ./
How about Bitcoin? (Score:2, Interesting)
Business plan (Score:2)
2. Download all the crap they ask me to
3. Profit
Seriously, what kind of idiot would download an unknown executable on his main PC to earn a fucking dollar?
Re: (Score:3, Insightful)
1. Set up VM
2. Download all the crap they ask me to
3. Profit
Seriously, what kind of idiot would download an unknown executable on his main PC to earn a fucking dollar?
They usually do it for free.
It's a world-wide study. Not an american one. (Score:2)
Seriously, what kind of idiot would download an unknown executable on his main PC to earn a fucking dollar?
There are plenty of people for whom a dollar is a lot of money. Don't forget, thus was a world wide study - not one limited to your particular country. The paper states that along with running a program, there was a questionnaire (I wonder what languages it was available in, and also what languages the Mechanical Turk posting was wtitten in - surely that is a tremendous skew to the results?) and that 40% of the survey respondents were from India - where english is quite popular (more english speakers than a
Re: (Score:3)
So, since purchasing power of the $1 wasn't taken into account, the results are flawed, since the reward will vary so much depending on the wealth of the individuals taking part.
From TFS, "While fewer than half of the people who viewed the task actually ran the benign executable when offered a penny to do so, the numbers jumped to 58 percent when offered 50 cents, and 64 percent when offered $1."
So, for $0.01, fewer than 50% of respondents (let's just guess around 45%... I'm not going to bother reading the article, but if it was only 10%, then they wouldn't have said "fiewer than half").
And for $0.50, 58%.
And for $1, 64%.
Generally, getting lots of people infected is not an attempt
Re: (Score:2)
Seriously, what kind of idiot would download an unknown executable on his main PC to earn a fucking dollar?
That, exactly, was the question. The research paper is the answer.
Re: (Score:2)
Seriously, what kind of idiot would download an unknown executable on his main PC to earn a fucking dollar?
That depends on how many boobies the idiot can see in for the dollar.
Re: (Score:2, Funny)
;)
I'll upgrade my flash player (Score:3)
for $5!
Re: (Score:2)
Re: I'll upgrade my flash player (Score:2)
Don't you accept Unicode Pounds over there?
Anything with gambling would do equally well (Score:2)
All About the Georges (Score:3, Informative)
> 'a paper called: "It's All About The Benjamins: An empirical study...'
> 'cash the researchers offered, capping out at $1, ...'
Because they never offered more than one "George", their paper's title is clearly overstated.
Re: (Score:2)
IT IS ENTIRELY REFERENTIAL
(insert picture of old dude here)
TO THE PORTRAITS OF WASHINGTON
(in this case, that is)
Duh (Score:5, Insightful)
People were happy to install ActiveX controls to "Punch the Monkey" in 1998. Nothing has changed since then.
It's also why the Android security model is a complete joke and always has been.
Any security model that requires users to make perfect security decisions is an automatic failure because there is no "undo", so one mistake after 10 years of perfect vigilence owns your entire machine.
That's one dollar more than it takes (Score:2)
Dancing pigs [wikipedia.org] accomplish the same. Actually, more likely even, because people, despite being used to getting free stuff from the internet, are still kinda wary if you actually pay them to do anything.
It's all about the ... (Score:2)
https://www.youtube.com/watch?... [youtube.com]
Hmmm (Score:2)
Less than half for .01, 58% for .50, and 68% for 1.0? Seems like the single penny was the best value, possibly followed by the 50 cents. However, even if we assume "less than half" is as low as 40%, $1 is 10000% more payment for less than a 50% increase!
Re: (Score:3)
Biased sample (Score:3)
This was done via the Mechanical Turk, so it's already filtered for people willing to do computery things for money. It would be a different story if this was a random website with the author anonymous.
Re: (Score:3)
i think you're missing the point.. it's not about the payout, or the self selected sample.
The takeaway should be that people will be less than cautious when it comes to getting some perceived benefit. That psychology is universal, the only variable being what is sufficient motivation. (free pr0n, free movies/tv shows/music etc, or in this case poor indians and $1.)
Re: (Score:2)
It is incredibly difficult to get a proper representative sample online, so some self-selection effects will usually be there. This is a better selection than using a topic-specific website.
Surprised ? Don't be ... (Score:2)
finally! (Score:2)
Thank you. I've wanted to run an experiment like this for years, but couldn't figure out to get a good sample audience.
The result is completely non-surprising. Security Awareness training is 90% pointless waste of money, and I regularily make enemies at conferences when I say it, because there's a ton of money in this snake oil, mostly because you can repeat it ad infinitum, once you've sold a client you can do one every year or twice a year or even get a whole "ongoing awareness process" going.
There are a
They forgot the most important question: (Score:2)
What would you download for a Klondike Bar?
There's no such word as "incentivize". (Score:2)
We already have "incite".
Re: (Score:2)
Neither "incent" nor "incentivize" are words. Using them makes you look illiterate.
Dated research? (Score:1)
When I read the paper, I didn't see anything to suggest a date after 2010. And as the paper says, this only covers workstation computers - Windows/XP through Windows/7. No tablets or smart-phones, or other app-store like environments.
I suspect that if anything, current behavior - influenced by app-store like environments - is even worse. You could probably get someone to run your mystery app just by promising them access to another mystery app.
Data is likely misinterpreted (Score:1)