Windows: pirated, owned, bugged

Interesting to hear news that botnet malware is being found in pirated copies of the new Windows 7.

Here's the translation. Windows 7, not released yet, has been getting better press than the previous Windows Vista. Beta copies have been released by Microsoft, including the latest one available free from their website for the past few days. It's called "Windows 7 release candidate", and it's probably going to change very little for the proper release later this year.

But beta copies are pre-release, given to people for testing purposes: there could still be a few bugs in it. And W7rc is available from Microsoft's website, free. So why would anyone go for a pirate copy? In this case, they're being downloaded from a peer-to-peer, bit torrenting site. This means a much faster download: the bitstreams come from a number of sources, and so it's likely to be fast, not being dependent on a single server - or Microsoft's web site, for that matter.
Moreover, there'd be a number of people who are so used to downloading from such fast sources that they'd source their needs - licit or illicit - from there.

But some enterprising soul has hacked the W7rc code, just days after it was released. And they inserted into it code that compromises the computer it's loaded on, rendering it part of a botnet - a network of compromised computers that could be hijacked at will for any number of nefarious purposes, such as emailing spam or partaking in attacks on other computers (eg DDOS, distributed denial of service). And that hacker figured others in the shadow internet world would be sufficiently tempted.

And they were. Not only downloaded, but loaded, operational, and calling home to the specified target for orders. Dambala, an anti-botnet organisation "managed to grab control over" the server the hack was directed to, and noted that a peak of 550 infected computers per hour were calling in.

Lessons?

It should be one big bounty for Microsoft, in its quest to get everyone to pay them money: "But a genuine copy, or you'll get infected/compromised". This concept should also provide an even better bounty for evil hackers. Why stop at botnets? Why not a hack that allows for eavesdropping, so you can grab a user's personal information, hopefully bank accounts, etc.

Piracy will never be the same again.