Iain Thomson

The news that Microsoft is putting a bounty on the heads of virus writers using less than 0.0002 per cent of last year's revenues has won it some good headlines.

Of course, it may also come in useful when Microsoft defends the forthcoming class action lawsuit from those seeking damages for the mess left by virus exploits of security weaknesses in Redmond's code.

I don't doubt that the offer will bring in new information, and may even lead to some arrests, but they won't be the ones Microsoft wants.

Creating a basic virus from scratch is as easy as building a paper aeroplane: you only need a few lines of code and a modicum of programming knowledge.

Creating a virus that can spread in the modern computing environment and flummox antivirus experts is a lot harder; now we're talking about building a microlight.

But original viruses are rare. The majority are mutations where someone has taken the original code, modified it slightly to defeat antivirus signatures using one of several easily available toolkits, and then sent it on its way.

Essentially they jump on the bandwagon of someone else's idea and try and bask in the reflected glory. Such folk are known in the trade as script kiddies and it's these that the reward scheme will catch.

Speak to most professionals and they'll tell you that a lot of script kiddies make lousy criminals.

Most can't resist putting in clues about themselves, either their moniker, a rant against someone or some other clue as basic as including details of their home page.

Sometimes they brag to friends online and off about what they've done. When caught they usually capitulate immediately and spill their guts about accomplices and techniques.

Now, these mutated viruses cause a lot of grief and need to be stopped. Some people are going to get a nice reward for turning their authors in, after the lengthy legal cases have been solved.

But the offer will also bring piles of false leads from the greedy, the credulous and the vindictive. Law enforcement officials might waste more time than they save in the process.

The virus originators aren't going to be worried by the bounty system. This small band of highly technical misanthropes generally don't talk about what they do.

We still haven't caught most of the originators of the really big and well-designed viruses and probably never will.

Like this story? Spread the news by clicking below:

 del.icio.us     Digg this     reddit!