Digital Hit? 8:28 am / 14 February 2009 by Thomas Van Wyk, at Crooked Spoke
Now, instead of patching (something that probably should have never been a security issue)…
Microsoft is offering a $250,000 reward for the information that leads to the arrest and conviction of the creator(s) of the infamous Conficker/Downadup worm.
First, the responsible parties are already in the wind, to be honest. He/she/they were in the wind by the time the handlers knew something was wrong. That’s just a realistic observation. You can talk about “fighting malware authors” as much as you want, but at some time we all have to, in the words of Lewis Black, “agree on what the fuck reality is.”
Second, it’s literally heaping another $250,000 on top of already sunk costs. It adds cost insult to cost injury. Sure, Microsoft can claim euphemistically that they’re broadening their responses to malware infections, but this rings so hollow:
“As part of Microsoft’s ongoing security efforts, we constantly look for ways to use a diverse set of tools and develop methodologies to protect our customers,” said the general manager of Microsoft’s Trustworthy Computing Group, George Stathakopoulos, in a statement. “By combining our expertise with that of the broader community we can expand the boundaries of defense to better protect people worldwide.”
I sort of understand the rationality, but I just fail to see how this in any way makes business sense. Even if this character or these characters are brought to “justice” (whatever Microsoft & Co. mean by that), so what? What are they going to do to him/her/them? Spank them?
It’s the rough equivalent of swatting a wasp when you have a hive under your front porch. Even if you literally crucify the wrongdoers on telephone polls it’s still a sunk cost.
Come on, Microsoft. Patch, move on, and put that $250,000 into making sure this shit doesn’t happen again. Stop with the vindictive digital hitlisting. This is not a “tool” that will help protect Microsoft’s customers – it will waste their money; even if it pans out and the responsible folks are “found,” that won’t magically quarantine all the infected machines. If Microsoft customers had any sense, this would raise at least a bit of ire.
It’s like a ten-year old got put in charge of some twisted Corleone family and threw a hissy fit when one of his grunts got hit. There’s no better way to slap your paying customers in the face than to put a digital hit out on one of a million malware authors.
Grandstanding. Digital gunboat diplomacy. Throwing around a quarter million dollar bounty will not make Windows a secure operating sytsem.
The people who crafted the worm are laughing.
PS – Dear Microsoft: Since you’re in the mood for slinging around the money I have paid you in the past, how about you take a few dollars of that $250,000 and send me a few copies of XP Pro?



