It’s a hypothetical scenario that we’ve heard time and again since 9-11. A suspected terrorist has been captured who has information that authorities need to thwart an imminent attack — such as the detonation of a nuclear bomb in an American city.

How far should we go to get their information? Should authorities be able to ignore Miranda rights? Detain without a warrant? Even torture the suspect?

It’s a difficult question, one with no easy answers. And in the world of spam-fighting, we are facing similar questions.

As Network World reports, a private company may have recently found the key to disabling one of the world’s largest spam networks, dubbed the Kraken network. Among other things, the Kraken network disseminates millions of spam emails advertising illegal online pharmacies.

TippingPoint, an IT security company, recently set a trap for the Kraken network — one that looks like it might have worked. But because of ethical and privacy considerations, they decided not to spring it.

According to Network World:

The Kraken … is a huge network of personal computers that have been infected with software that turns them into zombie systems under the control of a master program – a botnet. The Kraken botnet is used by criminals to generate spam.

TippingPoint researchers Pedram Amini and Cody Pierce “created a fake Kraken command-and-control server … honeypot that waited for connections from PCs infected with the bot.”
As a result, the scientists “monitored the incoming communications from Kraken bots for seven days.” They “listened and collected statistics for a week, and filtered out [for] the IP addresses and then the systems.”

Then “Pierce wrote code that would let him redirect infected PCs, or better yet, use the bot’s built-in update mechanism – something most malware includes – to remove Kraken.”

However, management at TippingPoint forbade the researchers from activating the cleaning code. They argued that although it might be nice to interfere with the botnet, the law in the U.S. forbids unauthorized access to anyone’s computers, including zombies.

That’s right — because it’s illegal to access a computer without authorization from the owner, TippingPoint decided not to fight fire with fire. It’s a classic example of bringing a knife to a gunfight — operating under a more restrictive set of rules than our enemy.

It’s difficult to win when the battle is not being fought on an even playing field. Which has been exactly the argument in favor of dismissing niceties like the Geneva Convention when dealing with terrorists.

Network World argues that TippingPoint’s decision was the right one, for two reasons:

1. Releasing programs that modify other people’s systems without permission, even with the best of intentions, is a prescription for disaster…

2. Accessing someone else’s computer without permission is illegal. Period.

What do you think?

This entry was posted on Sunday, April 5th, 2009 at 1:16 pm and is filed under online pharmacy scams, pharmacy spam. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.