U.S publishers branching into malware?

[JDK1962]

US Publishing Industry Might Soon Be Infecting eBook Pirates with Malware

Leaving the ethics of media piracy completely to one side...

While it's an interesting idea, I think it's been generated by people who don't understand a whole lot about computers, malware, or psychology.

A publisher's virus would be no different from any other malware, which most applications have evolved to anticipate and intercept. Also, applications typically run in a "sandbox" and have certain permissions. I'd actually be rather surprised if most media software could grab the administrator-level permissions needed to start mucking around in the OS (e.g. to stop future boots and require a password). That's assuming the content encoding could even support that level of operation. Sounds like you'd need considerable buy in from application developers...and the chances of that happening without a scaffolding of supporting law would be nil. Even with the law, users would likely just switch to open source software developed outside the jurisdiction.

Lots of malware already does this sort of thing, of course, *if* it manages to get the user to execute something (or exploits an unpatched security hole in the application). Writers of fake anti-virus software like this approach: insert a program into the set of startup programs, and cause hell for the user until they submit to blackmail. Computer-savvy users (which often includes torrent users) know how to get around malware of this type. But as anyone who has extricated a virus can tell you...it makes you very, very angry.

Which leads to the final concern that publishers should have: they will have pissed off a community that--on the whole--is probably much more familiar with wreaking computer havoc than they are. Not sure I'd want to be writing malware with my name plastered all over it. Not unless I also felt like painting a huge target on my forehead.

All in all, it's a thought...but publishers should be wary of starting the equivalent of a land war in Asia. It's one of the classic blunders.

[teh603]

I could see a certain US political party going hog wild with these technologies. Not going to go any further, just saying.

Edit: I'm also not too surprised the Big Whatever are pushing for something like this. Their business model is collapsing, and they're going to grasp at any straw- no matter how ethically unsound- to prop it up. That's the way of the big business capitalist.

That having been said, I wouldn't be surprised either if they tried making out legitimate companies' ebooks- companies like Smashwords and the like- as being the same kind of schnikey.

Edit again: Also, most of the countries pushing for similar technologies in the likes of SOPA/PIPA have a bad reputation for crimes against education.

[OddCosine]

I can't imagine this actually getting off the ground. Sony tried malware in their audio CDs. How'd that work out?

[wizwor]

These companies are at war with their customers. That hardly ever goes well.

[HansTWN]

Originally Posted by wizwor

These companies are at war with their customers. That hardly ever goes well.

The way I would put it is that customers are becoming collateral damage in their war with pirates.

[Barcey]

Hmmm

Instead of going through the court system, which costs a copious amount of time, energy, and money, the document advises to go after the root of the problem, the end user.

So they're suggesting cyber terrorism because it's too expensive and difficult to go through the court system and prove fault. Maybe this could be used for other things, like when companies illegally conspire to raise prices.

Seriously, I doubt that they would be stupid enough to actually attempt to implement something like this. It seems like a media campaign to scare people from visiting pirate sites.

[cromag]

Originally Posted by OddCosine

I can't imagine this actually getting off the ground. Sony tried malware in their audio CDs. How'd that work out?

Ditto.

And my Linux netbook is unimpressed.

[rkomar]

Pirates are always looking for justification for their actions: Company A rips off their clients, using Hollywood accounting, Company B has sunk great amounts of money into pushing copyrights longer,... This kind of action really helps pirates see the companies as evil, and thus to be righteously plucked. I think that it's a bad move, in the psychological wars. Treating your artistic clients and customers well is probably the best way to get many pirates to pay up. Fat chance of that, though.

[wizwor]

Originally Posted by HansTWN

The way I would put it is that customers are becoming collateral damage in their war with pirates.

Piracy is only one front in the war. Price fixing, DRM, relentless pursuit of infinite copyright protections, licensing vs owning, the assault on fair use affect people who purchase at least as much as those who pirate.

[JoeD]

Any publisher who decides on doing this would lose my business for a very long time even after they realise the error of their ways, I hope I wouldn't be the only one. I didn't buy a single sony product since the root kit fiasco and it took up until pretty much last year for me to be willing to give sony a 2nd chance. Publishers have already done a lot to irk me compared to Sony.

Whilst they must have had lawyers look into it, I really question whether such malware is legal. I cannot believe I'd be allowed to distribute software that holds a computer hostage just because someone illegally downloaded my application. EULA's only get you so far, I'd hope data protection and other laws should still have priority.

However, when some publishers are willing to break the consumer laws with collusion to fix prices, is it any surprise they'll push the bounds elsewhere too?

I'd also hope they don't even consider allow this stuff to be in a legit bought book, because there's bound to be a programmer mess up and some honest customer will be screwed over. It's happened with anti-pirate measures in software.

Edit: Also to add, I see it having zero impact on piracy. A lot of pirated software has already had malware snuck into it by people distributing it and yet it hasn't deterred most pirates. Would similar done by publishers instead of identify thieves make any more difference?

Edit2: I've avoided the topic of technical issues with this plan too which are not insignificant, unlike with software developers.

[pdurrant]

Originally Posted by HansTWN

The way I would put it is that customers are becoming collateral damage in their war with pirates.

The set of customers is not disjoint with the set of pirates. It has been shown in more than one study that people who pirate media also spend (on average) the most on media.

Originally Posted by pdurrant

The set of customers is not disjoint with the set of pirates. It has been shown in more than one study that people who pirate media also spend (on average) the most on media.

All the more reason to ensure that your customers are getting the best experience possible. If your customers have the skills and ethical mindset to pirate, you probably don't want to give them a reason to stop buying your product.

[Katsunami]

One of the suggestions the document makes is, “If an unauthorized person accesses the information, a range of actions might then occur. For example, the file could be rendered inaccessible and the unauthorized user’s computer could be locked down, with instructions on how to contact law enforcement to get the password needed to unlock the account. Such measures do not violate existing laws on the use of the Internet, yet they serve to blunt attacks and stabilize a cyber incident to provide both time and evidence for law enforcement to become involved.” In essence, a pirate commits theft and has to report the theft to the police in order for them to regain access to their computer and likely to pay a fine.

And HOW would one want to achieve this?

A program has to be running on my computer to make this happen, and I can guarantee 100% that it will be ineffective. Even if something like this is hidden in, let's say, ADE or the Kindle software, then I'll know the moment the computer locks down.

What do I need to unlock it? My image, probably made a few days earlier, and my backup. Both are not on that computer. So, I boot the computer using a CD or DVD, wipe the drives, recover the image and data (this will take me about 30 minutes), and then I'll know in short order which software caused the incident.

If I wanted to, I can install a Virtual Machine running any version of Linux. Then I download ebooks to my heart's content, and transfer the epub/mobi/azw files from the virtual machine to the host computer. This computer will only run Calibre, which will never be infected with anything because it's open source.

All of this stuff is just crap. It's all way too easy to circumvent.

The only way to curb piracy is to take a look at GOG.com and copy their business model, as I've often said.

- Large selection
- Low price
- Easy to pay
- Easy to download
- No frackin' DRM
- No hassle
- Many goodies (like the games soundtrack in 320 kbps. I own some games just for the sound track... maybe I'll play them some day too :X)

You select something to buy, you pay, you're done. Download the game, install, play. GOG.com even patches everything up to the latest patch, and fixes problems that prevent older games to run on new computers. It's part of the "No Hassle" clause. Buying a game at GOG.com is so fast, easy, cheap, and hassle-free (not to mention safe) that it beats any reason to pirate. All of that convenience is worth $5-10 to me.

Publishers should be the first ones to take a page out of GOG.com's book.

Diesel E-Books has a sale running now, and a 30% promo code. I've checked some Forgotten Realms fantasy books I wanted to read. As this is just low-brow quick-read fantasy (but still fun, of course), I don't want to spend a lot of money on it. I've calculated that, between the sale and the 30% promo code, I can have a bunch of Forgotten Realms books for $2.35 a piece. That's LESS than the cost of a beer in my local pub. I don't even think about pirating the books, because most of the FR books I want are old (80's, early 90's), so the pirated versions are probably bad OCR-ed crappy versions.

It's cheap ($2.35 is only €1.85: If I buy the paperback in the Netherlands, it'd cost me €7.95), quick and easy, and the stuff is (probably) of good quality. If they'd refrain from using DRM, I'd be perfect.

The only people that will still pirate under those conditions are the losers that think that all entertainment (and all software) must be free. Those are the people that steal anything they can get their hands on, and you'll never stop them, apart from throwing them into jail.

Originally Posted by JDK1962

Which leads to the final concern that publishers should have: they will have pissed off a community that--on the whole--is probably much more familiar with wreaking computer havoc than they are. Not sure I'd want to be writing malware with my name plastered all over it. Not unless I also felt like painting a huge target on my forehead.

You can be sure of that.

I've been running a virus scanner like... forever. Norton Antivirus up to 2001, Kaspersy after that, and Microsoft Essentials since its first release. Never, ever has a virus scanner detected anything. If I run a malware scanner, the worst things that come up are tracking cookies.

The ways to avoid crap software are easy:

- Install only software you trust.
- Get this software a a trusted place.
- Have the latest version of your internet browser and plugins, and don't visit untrusted websites.
- Don't execute untrusted stuff mailed to you in attachments.

This common sense prevents all malware except maybe the very "best" high end virusses that can install and propagate without user interaction.

[din155]

Originally Posted by Katsunami

The ways to avoid crap software are easy.....
......
- Install only software you trust.
- Get this software a a trusted place.
- Have the latest version of your internet browser and plugins, and don't visit untrusted websites.
- Don't execute untrusted stuff mailed to you in attachments.

This common sense prevents all malware except maybe the very "best" high end virusses that can install and propagate without user interaction.

This. If the publishers still manage to infect some computers, they are in the wrong business and should try to run a software company.

[DiapDealer]

It seems like a media campaign to scare people from visiting pirate sites.

I agree. Sounds like a FUD campaign.

Besides, how would you make an ebook launch malicious code on a device that most people wouldn't be opening the ebook with to read on in the first place? Let alone on a reading device that doesn't execute scripts? Are there really that many ebook reading apps/devices out there that would be susceptible to the usual malware techniques (never mind the memory-resident programs designed to thwart such threats)?

Unless they're talking about putting malicious programs out there with the names of popular books with the mindset of: "Have no worries about this fishy-looking executable that we want you to believe is the ebook you've been searching for! Go ahead and click it!" To which I say; "yeah... great plan."