Microsoft's Virus Bounty Plan Sound Familiar? It Should
from the worked-so-well-the-first-time dept
When I started seeing stories all over the web about Microsoft’s offer of a $250,000 bounty for the authors of the Conficker virus, I thought that the plan sounded awfully familiar. Going through the Techdirt archives, I turned up some stories on bounties for phishers and spammers, then found a post from 2003 talking about how the company had set aside $5 million for bounties on people who wrote viruses and worms. While it’s not clear if Microsoft has actually paid out any of that cash, it is pretty clear that the bounty plan hasn’t done much to make Windows any more secure since it was announced. And neither will this latest bounty. Like the previous plan, it’s gotten Microsoft tons of press that makes the company look tough — but it doesn’t solve the underlying security problems of the Windows platform. Catching the people who wrote the Conficker worm won’t undo any of the problems they’ve exposed, and it certainly won’t make Windows users any more secure.
Filed Under: bounty, cornficker, virus
Companies: microsoft
Comments on “Microsoft's Virus Bounty Plan Sound Familiar? It Should”
Actually, if they find him and hire him to help with security testing…
Re: Re:
Everyone is still waiting for you to finish that sentence.
Re: concerned civ.
WHY WOULD THEY HIRE HIM?
Re: No...
Why would they hire him if there paying 5 mill on the guys head? seriously , if anything they would just find a way to isolate the virus. Hopefully no one will catch this god forsaken virus.
The bounty is an empty promise because your information has to lead to the arrest and conviction of the author. So even if you rat the person out, Microsoft still has a lot of wiggle room to get out of paying.
No conviction, no pay. Conviction, but it’s a plea to a lessor charge, no pay. Conviction, but the police found a lead independent from your information, no pay.
Ratting out your friend/associate for the mere minuscule chance that MS might pay up a 1/4 of a million dollars, of which you’ll have to pay a boat load of taxes on…? Not worth it in the least.
Re: Still
The boounty is in no way an “empty” promise, chances are the person who is doing this is very lucrative with there work, or there are many trackers trying to trace this virus, remember, 5 million is a huge fucking am mount, why would one want to risk jail time for someone else to get 5 mill. If you Report it to Microsoft its different from reporting it to the cops since Microsoft is offering the bounty. Of course Microsoft makes sure your not affiliated with this persons scheme in any way. Get me?
no….it won’t fix the underlying problem that caused conflicker…the patch they release months before does
Re: Re:
“no….it won’t fix the underlying problem that caused conflicker…the patch they release months before does”
No, it won’t.
There was no patch before Conficker was released into the wild. Microsoft released a patch soon after, but it was several weeks before many companies could deploy it as Microsoft patches do have a habit of screwing up large enterprises in various unexpected ways if not properly tested beforehand. Microsoft have also not released patches that work with some service pack versions of 2000 and XP.
So, regular patching would not have helped in this case. The virus attacked yet another buffer overflow vulnerability, a class of attack that Windows always seems particularly vulnerable to. Microsoft do still deserve some blame in this attack, and the bounty is a half-assed attempt to save face among the mainstream media.
I heard on the radio that MS paid out a bounty for the Sasser worm, so at least I think it’s a little more credible than the BSA’s bounties.
Bounty
Call Dog Chapman. He tracked a guy the cops gave up on and found him hiding in a ravine. He can surely catch a geek.
Re: Bounty
haha dog can find junkies on an island not someone who uses their brain.
Didn't Bruce Schneier coin the term...
…..”Security Theater”?
But this is actually doing less than nothing, in terms of real security, isn’t it? So we should all call this nonsense “Security Theater Advertising”.
Marketing
It’s probably a ploy to keep a large account with beef over maintaining patches from migrating to Linux, FreeBSD, or (oh gee) OS X.
Dog is srous about security
Ya, Srously
LINUX
To be fair, Conficker affects XP machines worse than Vista from what I’ve seen at the tech bench since this thing spread. Since XP is falling by the wayside, I’m sure Microsoft isn’t terribly concerned with protecting it much. The only reason I can see is the people who choose to fervently live in the past (this OS is approaching 8 years old).
Before XP “falls by the wayside” M$ will have to develope something far better then Vista, not just Vista SP2 (Windows 7). We are tired of buying broken shit that won’t work till SP4, so those that got stuck with Vista need to start demanding something other then $300 million ad campaigns, like an OS that works. For the time being XP at least works, an “upgrade” to the new Yugo isn’t the answer.