BleepingComputer.com: We should treat Malware authors like the kidnappers that they are

Hi
I have been curious about something and thought this would be a good place to post.
Malware authors and the countries that host them are the scourge of the internet age.
The motivation for fake anti spyware and similar malware programs are to make money for the authors or criminals behind them. The method being that the victim is instructed to send money to download the fake program that will supposedly cure the problem. These people, in effect , kidnap a computer.
What I learned from old TV shows is that the weakness behind the crime of kidnapping was the point where the ransom was exchanged.
Any funds sent for these fake programs must eventually end up with those responsible for them. I do not understand why the FBI or some other responsible law enforcement agency cannot trace these payments and shut them down. It doesn’t seem it would be that difficult to do if the motivation was there.
Now I know many of these payments probably go to a third world country or to the old soviet bloc. The USA undoubtedly has foreign aid flowing to these regions. Maybe if the government refunded the money to the victims and deducted the amount from foreign aid funds these countries would be motivated to do some house cleaning.
Just some thoughts
Nawtheasta

A little off topic, but I think the biggest problem in the world today is that we are trying to create a global society/economy where everyone is equal, but the laws governing people's actions, labor, taxes, and many other things, are no where near equal. So, countries computer crimes laws will probably never (at least in our life time) match enough for anything to be done.

But, your statement was a little too much. You said, "they are kidnapping your computer." Even if you see it that way, people are more important than computers.

Hi ryan w quick
Sorry if I have misused the word. The horror of a kidnapped child or loved one cannot compare remotely with the misuse of a computer. Hijacking may be the more appropriate word. My point was that both crimes have an economic aspect that requires a transfer of funds. This should be the weak point that law enforcement could exploit to catch the responsible parties

Best Regards
Nawtheasta

[quote]This should be the weak point that law enforcement could exploit to catch the responsible parties[/quote]

Law enforcement belonging to whom? There are no global Internet police. Besides, I could set up a server in one country, bounce access to it through a couple other countries, register it anonymously, and never have to leave home. If what I am doing in my home is not illegal, no country has any right to come in and tell me any different. Sudan is one of those countries with lax laws. Are you saying that it would be right to cut off finances to a country embroiled in civil war, where innocent people are suffering? China is another problem country. Since we rely on their money more than they rely on ours, we have no leverage.

[quote]These people, in effect , kidnap a computer[/quote] what about your identity too?

[quote name='groovicus' post='1149473' date='Feb 24 2009, 05:57 AM'][quote]This should be the weak point that law enforcement could exploit to catch the responsible parties[/quote]

Law enforcement belonging to whom? There are no global Internet police. Besides, I could set up a server in one country, bounce access to it through a couple other countries, register it anonymously, and never have to leave home. If what I am doing in my home is not illegal, no country has any right to come in and tell me any different. Sudan is one of those countries with lax laws. Are you saying that it would be right to cut off finances to a country embroiled in civil war, where innocent people are suffering? China is another problem country. Since we rely on their money more than they rely on ours, we have no leverage.
[/quote]




Actualy a very valid Point.

What seems wrong in some Countries is quite right in others.

Only the Brave would ever Challange someone from another Country.

A couple of points
I am not a sophisticate computer user. But I know enough now to be cautious. But what about the thousands of people out there that treat computers and the internet like a new form of TV. Are they always to be doomed to become victims of botnets, ID thieves and the like?
Maybe it is naive of me but I would like to think that those responsible for malicious malware should be found and stopped.
Also in regards to punishing a country that was facilitating malware It would not be moral or ethical to suspend or reduce humanitarian aid to an impoverished country due to the criminal acts of a few. For other countries that may allow this activity and it can be shown to be a continuing pattern they should be held accountable. I do not believe that in any country it is legal to enter you neighbor’s home to extort money. Stealing is stealing.
Whether or not the US or other nations have the motivation to do anything about this is another matter entirely
Best Regards
Nawtheasta

[quote]Maybe it is naive of me but I would like to think that those responsible for malicious malware should be found and stopped.[/quote]

I would too. I am a bit of a realist though, and am always shocked when someone gets arrested for malware or spamming.

[quote]Are they always to be doomed to become victims of botnets, ID thieves and the like?[/quote]
No. If a person keeps their system updated, is cautious about emails, and careful about what info they give out, then they can have a relatively trouble free computing experience. Too many people think of the internet like a trip to Disneyland, when it is more like Bike Week at Sturgis.

With any type of crime there are different levels. I think there might also be some organized crime involved, subsidized by governments who would like to weaken the western economic system.

Just my imagination at work. No facts.

There have been reports the past few days that the various governments in the former Soviet Union, particularly the Ukraine, Georgia, the Baltic States and Russia, have all been victimized by the local malware designers. Sometimes an entire agency's computers have been badly infested. Some of these agencies render essential services and are quite innocent in their purpose.

Maybe the malware designers are requiring the payment of protection money, and the payments have not been made. Pure speculation, but perhaps in some cases, services were requested and rendered, but not paid for, resulting in revenge attacks: pay up, or this could get much worse!

Mafia structures. Undoubtedly.

[quote]Mafia structures. Undoubtedly.[/quote]

Why? For the most part, malfeasance on the Internet is carried out by script kiddies that can do nothing more than cut and paste scripts found on the Internet. The people that are creating bot nets, and infiltrating state computers are rare. Although there are some people that act alone, it has been my experience that their actions tend to not be malicious. The resources necessary to infiltrate state machines are vast, ie, takes a bunch of money, a bunch of tools, and a bunch of really smart people. That scenario doesn't scream mafia to me. It screams military, and black-ops by governments. Of course, that is purely some educated guessing on my part. My guess is based on who would have the most to gain by infiltrating State systems. There was a news story a while back about Chinese activity directed towards DOD and CIA systems. I don't suppose they would consider Russia off limits?

I always see organized crime in Russia and other places do a lot of this stuff cause they can afford to hire good programmers to write the malicious code I think.

Agree with you,Zllio and Mishy. The Russian Mafia I am sure would be implicated.They are into White Collar Crime, big time.
All about extortion.Some of the worst Malware writers, originate out of the Soviet Block.The Zlob an example.
http://www.bleepingcomputer.com/forums/topic197269.html
http://news.bbc.co.uk/1/hi/special_report/...mafia/70485.stm

I jhave been trying to come up with a decent metaphor for these malware designers, and keep coming up with the idea of burrowing, because of worms and data mining.

I believe it was Peter Hamilton who wrote the novel Evanescence, and its sequels. In Evanescence, there is a secret society of nuns, who hail back to the time of the ancient Roman empire. I cannot recall if there was an alien link there. Anyway, there are a few similarities to the Dune saga by the father-and-son Herberts, but the nuns in Hamilton's work are quite different. many of them are simply drones, who care for the physical plant underground and for the various females, who have differing degrees of intelligence, as they are raised. I should say "raised", not "reared", because the females in the dorms are often lacking in individuality. There is also a breeding program similar to that of the Bene Gesserit in Dune, where compatible males living throughout the world, but especially in Great Britain, continue to produce compatible males and , more importantly, females who are potential leaders. These females, who are educated within a secret society that is part of the Catholic Church (!), or more accurately, hidden within it, receive much training in leadership skills, diplomacy, commerce, language, science, and IT. This group has made itself indispensable to a large part of the IT community. Hamilton likens them to mole rats, who have a hive-like community structure and are, of course, burrowers, living a quite subterranean life.

I think these malware designers, in some respects, are like the mole rat community of Hamilton's books. By choice.