Bruce Schneier
Schneier on Security
A blog covering security and security technology.
« Friday Squid Blogging: Prehistoric Sentient Squid—Or Not | Main | Discovering What Facebook Knows About You »
October 17, 2011
Criminal Uses of Crowdsourcing
Interesting article.
Posted on October 17, 2011 at 6:12 AM • 21 Comments
To receive these entries once a month by e-mail, sign up for the Crypto-Gram Newsletter.
Natanael L • October 17, 2011 8:18 AM
Not much new to me, but it's a good read.
For TLDNR'ers, some of the things to avoid is "quick money schemes" and sharing personal and financial details. As always. And don't just blindly agree to do tasks that seems strange.
(The CAPTCHA thing is quite interesting. How could you defend against that in a way that can be beaten with automation?)
paul • October 17, 2011 9:00 AM
Is this article moving toward a new synthesis, or is it slapping a bunch of unrelated things under a fancy new buzzword? Black markets for stolen goods and criminal networks have been around for centuries if not millennia, and the whole "flash rob" thing sounds suspiciously like the "wilding" hype of the late 80s and early 90s.
The one newish bit would seem to the Mechanical Turk crowdsourcing of CAPTCHA information, which relies crucially on the ability to stitch data from many sources together in real time to make a web page. (Along those lines, convincing people to download software that attaches their computer to a botnet is arguably another form of crowdsourcing -- it's almost certainly the biggest application of distributed computing currently in operation.)
askme233 • October 17, 2011 9:33 AM
I'd love to see one of the Botnet runners try to make money "legally" by finding a way to sell the processing power of their net for real business or scientific purposes. I will bet they could make a lot more money analyzing data than they can pumping spam.
They would have to hide behind a front of some sort, but that doesn't seem hard.
Captain Obvious • October 17, 2011 12:17 PM
I've seen a number of TV shows use the craigslist approach for surveilance DOS: "$20 to wear a t-shirt and mill around X"
Have this been observed in real life?
Kaz • October 17, 2011 12:59 PM
@askme233
I really don't think so, with the latency of the Internet as well dedicated hardware vs the average outdated, I'm skeptical that would be plausible to successfully build a botnet for less effort(/cost) per computation achieved than investing in the hardware to rent out. That is ignoring the ethics completely. Could you really fool someone that is in the business of purchasing computations that they were not being sold time on a botnet?
I do I agree that it would be better for the world to use bots for good than evil, no institution would want to be the one known for stealing your CPU cycles.
Captain Obvious • October 17, 2011 1:38 PM
@kaz, askme
Could McAfee AV be the $600 toilet seat?
When my CPU pegs for 3 days (of each week) it can't really be just scanning my puny HD...what better front to hide an 'authorized' botnet?
A legitimate user of computer time expects to see uptime guarantees not applicable to botnets.
I actually had a business plan for farming out idle CPUs to corporations until I realized Intel had no desire to hand a PSpice model of its upcomming chip to some random person's computer to do simulations.
nickzoic • October 17, 2011 4:33 PM
Anyone remember Bruce Sterling's story Maneki Neko? Crowdsourced espionage, more-or-less.
pfogg • October 17, 2011 6:32 PM
The crowdsourcing of crime predates the coinage of the jargon term 'crowdsourcing', and the internet as well, doesn't it? Using Islamic fatwas to induce remote, third-party assassination attempts, for example.
godel • October 17, 2011 6:46 PM
Be sure to check out that Gigapixel link mentioned in TFA.
Wow, how did they do that?
Although it's very much a good news, bad news situation. Good for fighting crime, really bad implications for privacy.
I remember the 'crowd of identically dressed individuals recruited from internet' trick being used in a movie or TV show ("Castle"?) to cover for a ransom pick up.
For the 'flash rob' method, there is a clear possibility for Police to use this to set up ambushes. I wonder if there is a way to do this without it counting as entrapment.
Thomas • October 17, 2011 8:25 PM
re: FB-tagging 10,000 people in a single pic.
Today it's rioters, tomorrow it may be demonstrators in a legitimate peaceful protest, next week it's everyone, all the time.
The scariest part? It may not even be a government doing it.
Quis custodiet ipsos custodes?
Natanael L • October 19, 2011 4:32 AM
There was this TV show were the bad guy hid among a group of employees. They were all locked into a large room to make sure the bad guy didn't get away.
They didn't know who he was or how to figure out who he was.
Then one of them referenced *another* TV show were they asked the people to gather with their closest friends in small groups - the bad guy were an outsider and would instantly stand out.
And so he did!
I think that counts as crowdsourcing. (I'd call it crowdsourced whitelists :)
R2D3 • October 19, 2011 1:54 PM
@ MW, Natanael L
This 'hiding in a crowd of identical looking people' was used in a 1970s/80 episode of M*A*S*H when, I think it was, Radar got an unauthorized nose-job and everyone in camp had their nose bandaged.
Sam Peds • October 19, 2011 11:25 PM
As atrimpi observed On the Perception of the Valuation of Fungible Transactions,
published on MIT's delphi forums'elphic Thoughts Forum,
the intersections of any perceptual discontinuities can overcome security
as much as any criminal act.
Crowdsourcing for a crime may seek to gather as many discontiuous perceivers as are needed
in order to stitch together a whole arc of intent, of parti-tasks needed in order to accomplish the whole crime.
(Just like booking air fare and hotel rooms, together. "Wow factor.")
(http://forums.delphiforums.com/DelphicThoughts/messages/?msg=3.1)
Natanael L • October 20, 2011 3:48 AM
I think that what Sam Peds writes won't make any sense to most of you, but here's how I'm interpreting what he said:
If you see something you think is impossible, you're likely to dismiss it without substantial evidence that it's true.
Also, if each observer only see one tiny part of a crime, they are unlikely to understand that a crime happened.
So the idea is that crimes are made somewhat complex (to prevent easy analysis, like steganography) and are split up in thousands of tiny tasks that each and every one blends in among the normal ones such that nobody who sees it will know what's going on even if they see it all, and if crime ever would be suspected it would be quickly dismissed because nobody understands it and thus they can not prove it.
Sam Peds • October 20, 2011 9:12 PM
@ Nataniel L
Thank you for making it so clear.
I only want to add that the article said:
If they don't believe in it,
they won't see it.
Subscribe to comments on this entry
Post a comment
Schneier.com is a personal website. Opinions expressed are not necessarily those of BT.
|
| Subscribe |
Subscribe via Kindle |
| Blog Menu |
SearchPowered by DuckDuckGoBlog Home Page
Archives by Date2013 J F M A M
Tags  |
| Latest Book |
more books by Bruce Schneier |
Comments