Microsoft's Virus Bounty Plan Sound Familiar? It Should

from the worked-so-well-the-first-time dept

When I started seeing stories all over the web about Microsoft’s offer of a $250,000 bounty for the authors of the Conficker virus, I thought that the plan sounded awfully familiar. Going through the Techdirt archives, I turned up some stories on bounties for phishers and spammers, then found a post from 2003 talking about how the company had set aside $5 million for bounties on people who wrote viruses and worms. While it’s not clear if Microsoft has actually paid out any of that cash, it is pretty clear that the bounty plan hasn’t done much to make Windows any more secure since it was announced. And neither will this latest bounty. Like the previous plan, it’s gotten Microsoft tons of press that makes the company look tough — but it doesn’t solve the underlying security problems of the Windows platform. Catching the people who wrote the Conficker worm won’t undo any of the problems they’ve exposed, and it certainly won’t make Windows users any more secure.

Filed Under: , ,
Companies: microsoft

Rate this comment as insightful
Rate this comment as funny
You have rated this comment as insightful
You have rated this comment as funny
Flag this comment as abusive/trolling/spam
You have flagged this comment
The first word has already been claimed
The last word has already been claimed
Insightful Lightbulb icon Funny Laughing icon Abusive/trolling/spam Flag icon Insightful badge Lightbulb icon Funny badge Laughing icon Comments icon

Comments on “Microsoft's Virus Bounty Plan Sound Familiar? It Should”

Subscribe: RSS Leave a comment
Ima Fish (profile) says:

The bounty is an empty promise because your information has to lead to the arrest and conviction of the author. So even if you rat the person out, Microsoft still has a lot of wiggle room to get out of paying.

No conviction, no pay. Conviction, but it’s a plea to a lessor charge, no pay. Conviction, but the police found a lead independent from your information, no pay.

Ratting out your friend/associate for the mere minuscule chance that MS might pay up a 1/4 of a million dollars, of which you’ll have to pay a boat load of taxes on…? Not worth it in the least.

JJJ says:

Re: Still

The boounty is in no way an “empty” promise, chances are the person who is doing this is very lucrative with there work, or there are many trackers trying to trace this virus, remember, 5 million is a huge fucking am mount, why would one want to risk jail time for someone else to get 5 mill. If you Report it to Microsoft its different from reporting it to the cops since Microsoft is offering the bounty. Of course Microsoft makes sure your not affiliated with this persons scheme in any way. Get me?

PaulT (profile) says:

Re: Re:

“no….it won’t fix the underlying problem that caused conflicker…the patch they release months before does”

No, it won’t.

There was no patch before Conficker was released into the wild. Microsoft released a patch soon after, but it was several weeks before many companies could deploy it as Microsoft patches do have a habit of screwing up large enterprises in various unexpected ways if not properly tested beforehand. Microsoft have also not released patches that work with some service pack versions of 2000 and XP.

So, regular patching would not have helped in this case. The virus attacked yet another buffer overflow vulnerability, a class of attack that Windows always seems particularly vulnerable to. Microsoft do still deserve some blame in this attack, and the bounty is a half-assed attempt to save face among the mainstream media.

Trevlac says:

To be fair, Conficker affects XP machines worse than Vista from what I’ve seen at the tech bench since this thing spread. Since XP is falling by the wayside, I’m sure Microsoft isn’t terribly concerned with protecting it much. The only reason I can see is the people who choose to fervently live in the past (this OS is approaching 8 years old).

Dan says:

Before XP “falls by the wayside” M$ will have to develope something far better then Vista, not just Vista SP2 (Windows 7). We are tired of buying broken shit that won’t work till SP4, so those that got stuck with Vista need to start demanding something other then $300 million ad campaigns, like an OS that works. For the time being XP at least works, an “upgrade” to the new Yugo isn’t the answer.

Add Your Comment

Your email address will not be published. Required fields are marked *

Have a Techdirt Account? Sign in now. Want one? Register here

Comment Options:

Make this the or (get credits or sign in to see balance) what's this?

What's this?

Techdirt community members with Techdirt Credits can spotlight a comment as either the "First Word" or "Last Word" on a particular comment thread. Credits can be purchased at the Techdirt Insider Shop »

Follow Techdirt

Techdirt Daily Newsletter

Techdirt Deals
Techdirt Insider Discord
The latest chatter on the Techdirt Insider Discord channel...