Why no laws against malware?

Factual Questions
1

Greetings:

I have been reading, laughing, pondering and going “wow, why didn’t I think of that” from the message boards for a few months now, but a recent thread on malware got me wondering why we aren’t doing more about it.

Doesn’t the malicious software have to be uploaded from some point?

Aren’t these uploads logged?

Can’t the authorities find out who did the upload and penalize them?

What am I missing or not thinking about that is making this a more difficult issue than I visualize it to be?

A trying to teem millionth, seeking enlightenment.
Zyanthia

2

A big issue is that this stuff is multinational. Someone working for the Russian mafia highjacks some computers in various countries in the European Union, and these in turn load malware onto your computer in Canada from a site which looks like it’s based in Australia, but which is really running on a server in the US. So, which police and which courts do you turn to?

3

You are missing a few things.

Malware tends to be able to copy itself. So, you suddenly find a few million copies of it running around on the internet. Which one came first?

While uploads to a legitimate file server are usually logged, simple file transfers aren’t necessarily logged. Not every transaction on a computer is logged.

The malware may not come from an upload. A good example of this is called a buffer overflow. In this case, your server has a buffer that is used for something, and this buffer is say 1000 characters in length. You send it a 1500 character message. 500 characters go somewhere and sometimes this somewhere can result in the data being executed as code. There is no log at all for this since it wasn’t a normal file transfer.

One common type of malware is to turn a user’s computer into a “zombie”. The malicious code allows someone from a remote location to send commands to the infected computer, and the infected computer then does the malicious operation. You can trace the source of the malware back to the infected computer, but there may not be any traces left from the computer that originally was controlling it. Zombies are great for spreading infections, and are also great for things like denial of service attacks. A denial of service attack is when you have a few thousand infected computers, and they all start sending messages to the victim of the attack. The victim computer gets overwhelmed by all of the incoming messages and for all practical purposes can no longer access the internet. Zombies are quite common, as many folks don’t even know their computer has become a zombie unless the malware code gets so busy sending out copies of itself and network attacks and such that it causes the computer to noticeably get slower.

Zombies also make great spammers.

Causing damages like loss of data and such to computers often already falls under existing laws, and those who create malware can usually be prosecuted, if you can figure out who was behind it originally.

4

Read my last post in that thread as well as the links. You’ll find that most of these hackers are foreign and it is not easy to get foreign governments to arrest these people, especially if they are bringing money into the local economy.

5

More to the point, many people don’t care that their computer is zombified until it starts slowing down. It sounds pretty draconian to punish people for poor computer security, but if we did start doing so, it might give people an incentive to care. Really, it’s no different qualitatively from health codes requiring people to maintain biological hygiene in certain contexts, so as to avoid spreading biological infection.

6

Does Sony BMG count as foreign?

7

Related, I guess. What’s the point of malware? Especially the stuff that seems to have no other purpose than screwing up the computers of regular folks surfing the net? Is it still just the stereotypical teenage “hacker” who is bored and showing what he/she can do?

Or are there other motives that I can’t even think of? I just don’t get all the effort that goes into creating something to make it impossible for Grandma Edna to send little Joey an e-mail, or even start the laptop she got for Christmas.

On the other hand, I’m grateful to the people who spend equal amounts of time devising countermeasures to the latest threats, for no personal gain – or who walk people through fixes step by step on message boards like this one and many others. I’ve gotten that kind of help before from strangers online.

8

I sometimes help my friends with their buggy computers. First thing I ask them before I come over to take a look at it is, “do you have an antivirus program?” They usually say sure, it came with one already installed. When I get there I find that what they have is a 30 day free trial of McAfee or Norton that they have never bothered to update or purchase beyond the trial period.

When I explain that an antivirus program is only as good as the last threat list that has been downloaded they say something like, “that is dumb, it should just work.” They keep a computer for a couple of years until it gets ‘slow’ and they buy another one.

People hop into their car and turn the key and expect everything to just work without having to know much about how it works. The attitude with computers is the same. Plug it in when you buy it, never turn it off, ignore update requests, and just go clickety, clickety, click, until it doesn’t work anymore. They don’t defragment, they don’t delete files, they don’t dump history, they leave everything set to the default settings so that programs they never use are always running, and they never take time to run a virus scan.

“Damn thing, oh well, I guess it’s time for a new one. Plus the new ones have a prettier picture and a new operating system.”

This attitude is very, very common. Especially if they are only home users. This keeps the virus and bot people happy and offers no incentive to computer and software manufacturers to change anything.

Now, forward this to everyone in your address list within the next 10 minutes. Do not delete any of the e-mail address’ within the body of the message that came along for the ride the last 6 times this was forwarded, FW, FW, and if you do this, something nice will happen to you.

Hey, it’s worth a try! :smack:

9

Most of it, someone’s getting use out of your computer for either attacking companies, or for sending out spam. Just because the only part you notice is that it’s screwing up your computer, doesn’t mean that’s all it’s doing. When your computer won’t start up at all, that can be attributed to multiple infections not getting along well with each other, combined with the poor quality control you’d expect from malware: If a legitimate software company writes something that’ll accidentally trash your computer one time in a hundred, that’s a big problem, and they won’t ship the software until it’s fixed. If a malware writer writes something that’ll accidentally trash your computer one time in a hundred, do you expect them to give a damn?

10

No, I guess not. I really hate those guys. Not as much as gangbangers who miss their targets and catch innocents in the crossfire. But they’re still scum.