prediction vs. tempting fate

how many of you reading this remember conficker? i certainly remember it, but i have a long memory, especially when it comes to regrets. you may recall an apology i posted some years ago concerning the possibility that i might have made a small contribution to the feature-set of that malware by way of giving the bad guys ideas.

well, from where i sit, that may very well have happened again, only it wasn't me this time, it was an AV vendor. now you might expect that, as a result, said vendor may become much more scrupulous about censoring themselves. it's no easy task, let me tell you, but it's certainly something that some of you (and myself included) probably expect from the people who are supposed to be protecting us.

alternatively, you might expect just an apology, under the philosophy that it's better to ask forgiveness than permission. that would certainly be easier, although accepting responsibility for negative outcomes is not generally considered good for the public image of a company. as an individual, owning up to one's mistakes and accepting responsibility is considered a mark of maturity, but the rules for companies are unfortunately very different in this regard.

which brings us to the thing you might not have expected, but probably should have - bragging about it as though it were a "prediction":

that link, by the way, points to this story on informationweek.com which in turn points back to a post on the f-secure blog where it was suggested that if the people behind the flashback malware for the mac upgraded to unpatched java vulnerabilities (it had only been using exploits for old, already patched vulnerabilities before) they might affect a lot more people.

is that a prediction or an instruction? f-secure's blog, as you might be aware, is one of the most (perhaps the most) widely read blogs in the entire anti-malware field. it stands to reason that if the people behind flashback are reading any anti-malware blogs, that one is probably on their list. even if it isn't, that particular post was about their efforts and would most likely have been forwarded by someone who was aware of their work (just as, in a small software development company, every press release, news article, and TV spot that mentions your work gets sent to everyone in the company).

would they have upgraded to unpatched vulnerabilities without that suggestion being made? perhaps, perhaps not. we'll never know. do all malware profiteers who use exploits for patched vulnerabilities inevitably upgrade to ones for unpatched vulnerabilities? that's doubtful - exploits for unpatched vulnerabilities are much harder to come by than ones for vulnerabilities that have already been patched. the transition is anything but inevitable, so there exists the very real possibility that f-secure's "prediction" was more like a self-fulfilling prophesy.

but of course, it sounds better if you call it a prediction. it sounds like something that adds value to their voice (though they have plenty already without that) and so helps to build the brand.

it seems to me that openly predicting what the bad guys are going to do next, or speculating on what they could do better, only invites them to take your advice. you might then capitalize on that with liberal amounts of spin, but at the end of the day is giving them ideas really so much more benign than giving them code? don't you tempt fate either way?

the mac malware phenomenon

i posted something to twitter earlier (which was already too big to actually fit in a normal tweet) but i think there's more to be said.

those who downplay the mac threat landscape by comparing it to the pc are missing the point. the mac will never be the pc, it'll never follow the same path or be in exactly the same place, but the mac community was sold false hope and many of them are either unaware or in denial about the fact that they were lied to.

one of the most crippling thing about mac security awareness is the pc comparison. people can't look past the fact that things aren't as bad for the mac. does that really matter? crime in your neighborhood likely isn't as bad as crime in a ghetto (unless you happen to be unfortunate enough to be living in a ghetto), does that mean it's safe to leave the door to your house or car unlocked? no.

stop thinking about the comparison, stop thinking about the pc entirely. imagine there are no pc's. think about the things that have happened in the mac landscape over the past several years and what they mean to the various subsets of the mac user population.

there are users who believe macs are immune to viruses. that was proven technically false five years ago (i wrote about it here). the viruses that have been produced may have never reached epidemic proportions, but epidemics are a poor yardstick for measuring risk. car crashes aren't exactly an epidemic, but you should still fasten your seatbelt.

there are users who believe macs are inherently secure because of their *nix lineage. this, in spite of the fact that the initial academic investigation of the concept of computer viruses involved successful experiments in a professionally administered unix environment. also in spite of the fact that rootkits originally come from the *nix family of platforms. also in spite of the fact that a security researcher renowned for successfully attacking the platform on multiple occasions has explicitly contradicted the notion that macs are especially secure.

there are those who believe that for something to be a real threat it has to activate by itself without user intervention, that something that requires the user's help is only an issue for dumb users. this despite the obvious success of social engineering attacks like phishing that are already platform agnostic.

there are users who believe macs aren't really a target of criminals yet. they believe that the criminals have bigger fish to go after so the mac isn't worth the effort. they believe criminals have to make an either/or decision about which platform to attack. these beliefs are in stark contrast to a nearly 4 year old reality of professional cybercriminals attacking the mac platform - specifically the zlob gang taking their already successful windows trojan and porting the important functionality over to the mac (which i mentioned here and here). the more recent example of java based malware is an indication that the cybercriminals are trying to take the either/or question out of the equation entirely.

and then there are those wonderful users who are actually security aware but somehow believe the rest of the mac user community is largely like them so the efforts to raise awareness of security issues are pointless and alarmist. this is even though it's plain to see that security aware people are a minority in any population. and as far as the mac user population goes, apple's marketing was quite clearly designed to appeal to people based on style, image, and simplicity, and told users that security was something they didn't have to worry about. to imagine such a population is somehow better at dealing with security issues than the average person seems more than unjustifiably optimistic.

macs can be attacked, they have been attacked, their attackers are enjoying increasingly numerous successes, and not enough mac users know it. it's a growing threat and there has yet to be a compelling argument put forward that it won't continue to grow. knowledge is the first prerequisite for people to be able to protect themselves. stop pretending everyone knows what you know or are smart enough to make the threat a non-issue, there's just too much variety amongst humans for that to be true.

why mac fanatics still believe they're virus free

(another post form the draft pile)

i stumbled across this article about why macs are still virus free and it occurred to me that there were a number of false premises that deserved highlighting to illustrate why mac users still think their beloved platform is so safe.

• the first thing i noticed was an ill-conceived notions of what a virus is (eg. "When I say virus I'm referring to a program which self-propagates and self-installs either by exploiting a back door in the operating system or another legitimate application"). by this definition most PC viruses (and i'm not using virus as a catch-all umbrella term here) are not actually viruses.
• next thing i noticed was the comparison of apples to fruit (eg. "So why don't Macs get viruses while Windows PC's seem to be facing a constant tsunami of malware, spyware, worms, trojans and botnets?"). compare mac viruses to pc viruses please, not mac viruses to pc viruses, worms, spyware, trojans, botnets, etc. either that or compare the gamut of mac malware to the gamut of pc malware.
• next on the list of wrong-headed thinking i picked up from that post was thinking malware authors are still just attention seekers (eg. " There are a lot of theories regarding install base and attention-seeking virus writers") when it has been demonstrated over and over again for the past several years that they're financially motivated now - the current trend is to follow the money.
• another bit of nonsense i noticed (which in fairness is bandied around by a lot of otherwise intelligent people) is thinking that going after the biggest group limits them to going after just one group (eg. "wanting to target the biggest market") when it has been demonstrated that professional malware gangs are targeting both platforms at the same time (see zlob gang).
• yet another wrong thought in the article was thinking that unix makes the difference (eg. "The real answer is UNIX") when in fact the first academic treatment of the virus problem (back when the term 'computer virus' was originally coined) had viruses successfully replicating across a user population in a professionally administered unix environment without cooperation from the admin.
• the most damning, however, is thinking in yesterdays terms. the very fact that they're still focusing on viruses rather than malware in general shows just how outdated the thinking really is. most of the malware currently attacking pc's these days is NOT viral (either by normal pc definitions, incorrect mac definitions, or formal definitions). furthermore viral malware isn't really the biggest malware problem these days. huge numbers of non-viral malware are the biggest problem facing pc's and the malware gangs have been targeting both pc's and macs for years now.

mac users have largely ignored the malware problem, which is probably why what little they know of the problem is generally either wrong or out of date. the malware problem isn't ignoring them, however. they have an opportunity to get ahead of the problem, but if they keep living in the past that opportunity will be squandered.

lifehacker's mac anti-virus poll

if there's one thing that never fails to disappoint me it's the failure of the wisdom of crowds principle to work when it comes to malware-related topics, and this ask-the-reader style post on lifehacker lives down to that standard quite well...

you've got some people like astrosmash saying "There are no OS X viruses" - which ignores both the fact that there are in fact os x viruses (osx/leap.a is an overwriting file infecting virus, among other things) and the fact that anti-virus software targets non-viral malware too (of which there has been more than a few for the os x platform)...

you've also got people like texizboy saying:

I don't run A/V on some of my windows machines. All boils down to common sense in my opinion. Webmail services have helped out on this front also, to give credit where it's due, I believe there are less viruses getting around due to them.

despite the fact that email is just one of many different attack vectors that malware have been known to use for some time now, and despite the fact that not all malware is obvious enough for common sense to help (nevermind what they say about common sense)...

then there's people like kilianamphitrite saying:

The real strength of the Mac is that in general, when a Mac is running an untrusted bit of code, it is not doing so with system management privileges. Most of the time (and especially for home systems) Windows users run untrusted code as privileged users.

which incorrectly assumes that you need privileges to do bad things... a lot of windows malware depends on privileged access not because it's necessary for the ultimate goal of the malware, but rather just because such privileged access was almost always there so malware authors didn't have to think of alternatives...

on top of that you've got people like insomniac who says:

The idea of "Mac/Linux/Unix do not have enough market share so people don't develop a virus for them" is only partially true. Unix and Linux based systems are just a lot more difficult to infect because of their architecture and security design than a Windows machine (Vista does a much better job than previous versions of Windows).

which ignores the fact that the first academic treatment of the computer virus phenomenon back in the early-to-mid 80's had viruses successfully spreading in a professionally administered unix environment without aid from privileged users like root...

or how about sverrip who says:

I mainly surf around pages I trust, and don't download and open setup files like "Free-XXX.exe" on my Windows machine.

apparently ignorant of the fact that there is no such thing as safe/trustworthy sites, not to mention ignorant of the existence of the drive-by download vector... even the cbs website can serve malware to unsuspecting victims... and it's not like macs are immune to drive-by downloads - remember the safari carpet bombing flaw?

sad, isn't it? that people believe these fantasies about why they don't need anti-virus software on their mac (or in some cases even pc) computers... i have my doubts as to whether apple's quiet urging of people to use av is going to do anything at this stage of the game... the baseline level of ignorance about malware issues was bad enough but add to that apple's previous arrogance (which no doubt resonated with a lot of their fans) about security and the damage done is all but complete - the only thing left to do is wait for the fallout...

gaming the mac malware game theory

adam j. o'donnell has put up an interesting bit of analysis of malware attack strategies... it's interesting (to me at least) for 2 reasons: the focus on strategy and because i can't honestly say i've seen game theory applied to the malware domain before... that said, i think there are some problems with it...

right off the bat there's the explanation of game theory describing how rational players would interact with one another... no doubt this is not a problem that is unique to the current discussion but not all the players involved in this particular game are rational; on the attackers' side many probably are but some definitely aren't (and you probably need look no further than your junk mail folder for evidence of that), while on the users side many don't even know they're playing this game in the first place... rationality is a surprisingly subjective thing - it's an attribute characterized by the making of reasoned, logical decisions based on available facts, but how can person A know what facts person B has available to them? a decision where a particular fact is significant will most likely seem illogical to the other party if only one of them knows the fact... this is problematic because one of the conclusions adam draws (that mac malware won't reach a tipping point until the mac reaches 1/6th market share) seems to require the entire malware writing population to adhere to the rationality that game theory assumes... i don't doubt that game theory can be used to model behaviour in populations, but i think it's descriptive value exceeds it's predictive value...

the subjectivity of rationality isn't the only problem with this sort of model, however, as adam demonstrates by focusing on a single motivation and therefore ignoring the subjectivity of value... while it is certainly true that financially motivated malware creation is a significant trend these days, there's little reason to think that people magically stopped using it as a means to acquire the rewards they sought before the commercial malware trend started... there is a wide variety of motives and by extension a wide variety of value propositions for prospective malware creators...

beyond the overly narrow constraints on value, there appears to be an additional problem with the way the game itself is framed... by that i mean that it's implied that the attacker has 2 strategies: attack platform A or attack platform B... it's still very early in the evolution of malware for the mac osx platform but we already know there's a 3rd strategy, we've seen it in the wild with the zlob gang's approach i described before: attack platform A AND platform B...

this mischaracterization of the game points to a classic mac vs. pc mindset - a platform rivalry that has more meaning to users than it does to attackers... a rational attacker would recognize that the platforms are not fundamentally different, that attacks that can be applied to one can generally also be applied to the other (ie. the 2 suggested strategies are not mutually exclusive), and that the cost of mounting an equivalent attack on a second platform is the cost of porting the malware rather than developing the entire attack from scratch... in this way the minority platform becomes little more than a special case that the attackers may decide to accommodate when revising their attack for the next wave of their malware campaign... and revising their attack is exactly what the more professional, financially motivated, rational attackers do when a malware campaign proves successful... after all, adding features (like mac attack capability) adds to their payoff rather than selecting a different (less optimal) payoff...

mac malware reality check

last month david harley wrote a really good piece about macs and malware... of course david is a writer (who i hope will forgive me if that's too much of an oversimplification) and has been following malware on the mac for as long as i can remember (you knew there was malware on the mac before osx, right?) so it's balance and reason comes as no great surprise... it was a fine piece of work...

perhaps too fine...

i regularly keep an eye out for new and interesting security related blogs and the name of adam o'donnell's blog NP-Incomplete appealed to the comp.sci. in me but some of his recent posts about malware for the mac (biological niches and malware prevalence, newsflash, its an issue of market share, not security), not to mention a heap of posts by others like rich mogull that i wrote about before, have made me wonder if perhaps a blunt instrument is called for instead... bluntness is something i ought to be able to handle, after all that's what being {c|k}urt is all about...

i think we need a reality check about where we are with respect to malware for the mac osx platform...

first, there are viruses for the mac osx platform... the first of which, osx/leap-a, has apparently even been seen in the wild by at least one anti-malware vendor (note the prevalence is not at it's lowest level as it is for the osx/inqtana-a)...

"but that's the old model", you say... "that's not what you need to worry about these days", you say... "it's all about the commercial malware now", you say... fine, then let's talk about the DNS changing trojan that was discovered last year... a port of zlob from windows to the mac... as craig schmugar pointed out on the avert blog, zlob was one of the most widely reported pieces of malware for windows and it was most definitely commercial malware...

"it's just one piece of malware" i can almost hear you saying - try one family of malware... it wasn't just a single instance that was made for the mac, there were many variants made as mikko hypponen clearly demonstrates... and if you have any doubts about how serious the zlob gang were about spreading malware onto macs you need only take a look at the posts alex eckelberry made for a while, while tracking the new instances found - it's a list that goes on, and on, and on, and on, and on, and on, and on, and on, and on, and on, and on, and on, and on, and on, and on, and on, and on... personally, i'm glad alex stopped filling his blog with these posts, but they certainly are useful for making a point... the point in this case is that some criminals have already started looking at the mac and they've decided it's worth the effort and expense to target them in addition to targeting the windows platform...

"but it's still just one case", you say... WRONG!... did you not hear about the rogue anti-malware apps macsweeper and imunizer? they were (as far as anyone knows) produced by a different group than the folks making zlob so that's at least 2 criminal enterprises that have moved to include the mac platform in their pool of targets...

the mac may not have crossed the chasm in the malware underground yet, but there are already multiple early adopters... as such it's no longer a matter of if the criminals will start targeting the mac, nor is it even a matter of when will they do it... the only question that remains now is how long will it take before it gets bad enough that people to wake up and notice... mac osx' age of innocence is over...

has anti-virus' time come to an end?

no, i'm not talking about the end of the anti-virus industry or the technology, i'm talking about the term itself... that's what came to mind when i read rich mogull's post about the lack of need for anti-virus on the mac...

i think it may be time we retire the term anti-virus... it's no longer a completely accurate description of what the technology (or people) does... there hasn't been a stand-alone known-malware scanner that just detected viruses for a long time now... it's also become negatively loaded...

rich's post demonstrates this negativity (without being unreasonably anti-av, nor a rabid mac fanboy)... 'do mac users need anti-virus' indeed...

let's phrase it a different way, though - if there exists malware for the mac (and there does, it's in the wild and being actively spread by financially motivated cyber criminals) should mac users use tools to help them protect themselves from that malware?

it's hard to imagine these are actually the same question under the covers, it's so much easier to say no to the first one and so much harder for the second... harder still if you consider that mac users are no more immune to social engineering than anyone else and exploiting the user (rather than the system) has long been the primary method of getting malicious code executed (exploiting the system is generally just an optimization)...

granted all these additional considerations load the question in the opposing direction, but even without them i think you'll find that you'll get a faster no response to "do mace users need anti-virus" than you would to "do mac users need anti-malware"... the term anti-virus has come to be something people have a knee-jerk reaction to and only accept it in situations where it seems like a necessary evil (otherwise it's just an unnecessary evil) while no similar reaction has evolved yet for anti-malware...

anti-malware hasn't been loaded down with the baggage of all the anti-virus industry's mistakes and if those who adopt the terminology shift are smart and reinvent themselves rather than just relabeling themselves then perhaps the term anti-malware will remain baggage-fee...

symantec, viruses, and the mac

i've written about viruses and the mac before but of course people don't read what i write or don't listen to what i say or maybe just don't think i'm right and so continue to make silly gaffes... sometimes those people are even in a position where you'd expect them to know what they're talking about...

take for example the recent pronouncement from symantec that there are no file infecting viruses for the mac osx platform... todd woodward is a symantec employee so of course people are going to assume what he says about viruses and the mac must be true... he makes a pretty convincing argument too, except for one tiny problem - in trying to convince us that osx/leap.a wasn't a file infecting virus he points to a symantec virus analyst's write-up that actually says osx/leap.a does infect files...

ooops...

but lets not be too hard on poor todd, after all he's not a virus analyst himself, rather he's a product support analyst for symantec... still, that embarrassing gaffe could have been avoided if he'd simply read the page he was linking to...

so just to clear up the confusion (and to repeat something i've said a bunch of times already) osx/leap.a is an overwriting file infector (that would have been a companion infector if not for a bug in the code) and an instant messaging worm at the same time... that's right, is a worm/virus hybrid and therefore there IS a virus for the mac osx platform... i get the feeling that perhaps todd is not aware that something can be both a virus and worm at the same time but it can and there are plenty of examples in the windows world so that part of his post about the differences between worms and viruses is poorly conceived..

the flip side of sophos' mac advice

as many have reported already, sophos is suggesting that home computer users purchase mac computers in the future in order to avoid the huge amount of windows malware out there...

while that's all well and fine, there's a bit of context that is conspicuously absent from the various news accounts - sophos doesn't really deal with the home user market... they're focused on the enterprise market and don't really have a product geared for the home user market... they aren't giving this advice to corporations or anyone they actually do business with...

now, don't get me wrong, i'm not a sophos basher, i think there's plenty of good things to be said about them, but their advice seems a little like patting the home users on the head and saying "there, there"... 'buy a mac' is just about the most hands-off answer you could give to the home computer users looking for a helping hand with their malware problems... at the very least switching to linux or freebsd would be cheaper and more expedient than waiting until one has enough money to go out and buy a whole new computer...

also, if everyone switched to macs, that would include the malware writers... after all, the new generation of malware writers are profit oriented, and if everyone is using a mac then the mac platform is where the malware-related profits will be found...

at best, jumping ship would just be a temporary solution to a persistent problem... it would probably help in the interim, but only for a while and then what happens when it stops working?

i can't help but see their advice, not as the professional endorsement of the mac platform that some consider it, but rather as a glib response to a problem they don't really want any part of...

"PCs, not Macs" - snake oil straight from apple?

if you haven't heard about it yet, apple has produced a bunch of commercials comparing the mac to the pc and one of them gives the distinct impression that macs don't get viruses...

of course mac computers are not immune to viruses, they had viruses in the past and a little over a month ago they got their first osx virus (osx/leap.a) so the mac's virus immunity is definitely the stuff of fiction, which makes the commercial in question all the more damning...

you see it's pretty much a foregone conclusion that when the average person hears the dialog:

PC - last year there were 114,000 known viruses for pcs
MAC - pcs, not macs

they're going to get the impression that macs don't get viruses, which is false...

but do you think a false advertising charge is going to hold up in court? maybe not... if you look closely at what is actually being said, there are no unambiguously false statements... the mac guy could have simply been saying the virus figures for the pc apply only to the pc and not the mac, which is true - or he could habe been saying that the viruses for the pc are for the pc and not the mac, which is also currently true...

the mac guy was awefully ambiguous, and the commercial walked a very fine line between giving a false impression and making an actual false statement - just enough to get the benefits without any legal problems... and that's what makes me think it was intentional and why i have no qualms about calling it snake oil (rather than just an accident)... you see you don't have to explicitly lie in order to be a snake oil peddlar, you just have to make people believe something that isn't true in order to make your product look better and that is exactly what apple is doing...

one of the biggest security problems in the mac world, especially in light of all the vulnerabilities that have been uncovered recently and proof of concept malware that's been developed, is denial... mac users don't see security as being a problem they need to worry about and apple is actively fostering this delusion with the commercial in question and with statements like that of bud tribble that macs are designed to be run "without the need for firewalls or additional security software"... in that sense, apple is being part of the problem rather than part of the solution...

mac computers and viruses

there's been a lot of coverage lately of the issue of mac security, unix, and viruses, and i think it's time to dispell a few myths...

1. macs are immune to viruses...
   
   they most certainly are not... OSX/Leap is an overwriting virus and instant messenger worm that operates on the mac osx platform...


2. macs were immune to viruses...
   
   they were never immune to viruses - no general purpose computer system can be immune to viruses...


3. macs were virus-free before OSX/Leap...
   
   OSX/Leap wasn't the first mac virus, it was just the first virus for mac osx... previous versions of the mac operating system had other viruses... not to mention some ms office macro viruses were able to operate on macs just like on windows machines, because ms office is a platform in and of itself...


4. the fact that it took so long for mac osx to get compromised means that mac osx is more secure than windows...
   
   it actually means no such thing... because of the smaller user-base a compromise of the mac osx platform has less payoff for the attacker community, therefore they aren't as interested in it, therefore there are fewer people working on it, therefore there are less man-hours going into the effort, therefore it takes longer and/or has a lower probability of success... mac osx may or may not be more secure than windows, but the key to it's apparent resistance to attack is that it's a lower risk platform (there's a big difference between security and risk, but i'll leave that for another time)...


5. mac osx is more secure and/or immune against viruses because it's based on unix...
   
   the first academic study of viruses was carried out by fred cohen on a professionally administrated unix system and the virus(es) still worked (see this paper for details)... unix is just as capable of supporting viral infection as any other OS...


6. mac osx is more secure than windows...
   
   maybe (and so this isn't technically a myth) but that doesn't mean there aren't security vulnerabilities or that mac users don't have to worry about security... with the release of viruses for the platform and the discovery of arbitrary code execution exploits it's clear that macs have many of the same security problems that windows has and as macs become more popular more and more effort will go into finding them... also consider that, due in part to these myths, mac users are less accustomed to thinking about security and so can be fool by less sophisticated ploys... users are a big part of the security of the system (often users are the weakest link in that security) so mac users really should not be taking security lightly as they're at greater risk than they probably realize...

let's be part of the problem

DVForge - Virus Prize 2005
what the hell are these people thinking, offering to pay people to write viruses for the mac and spread them in the wild? like virus writers don't already have enough motivation to write and spread viruses - especially when it comes to being the first one for a new platform or the first one in the wild for a new platform... those sorts of things already make them (in)famous...

these folks have clearly had a break our ethical reality - you do not need a proof of concept virus to prove viruses can spread on the mac - mac OS X is basically a form of unix and the very first viruses that fred cohen wrote when doing his seminal work on viruses back in the '80s worked on unix systems... and they did work, they spread on production systems...

come on, folks - all general pupose computing platforms are susceptible to viruses... all of them... it's been proven - and i don't mean the way you prove things in court with evidence, because there will always be new platforms for which there is no evidence yet... i mean it's been proven on paper with logic - the only facilities a virus needs are those that are already present in the definition of general purpose computer...

these people are not solving any real problem by offering a reward to virus writers for writing yet more viruses (and you know damn well there are going to be a lot more viruses written than rewards handed out)... all they are doing is making virus spreading (because you do need to spread your virus so that it makes it's way onto the target systems naturally in order to get the reward) seem more legitimate by wrapping it up like it's some sort of good deed that puts a set of misconceptions by uninformed people to bed... the fact is that they are soliciting behaviour that is illegal under canadian laws (criminal mischief pertaining to data) as well as laws in a variety of other countries that have unauthorized-access-related legislation...

john mcafee reputedly paid for virus collections and thus became a pariah in the anti-virus industry for supplying virus writers with financial motivation to write viruses... these people here are supplying financial motivation to write & spread viruses and that absolutely contributes to the problem, rather than the solution... these people are not interested in the greater good, they're only interested in making a name for themselves and they don't care how much damage they cause in the process...

update 5:30pm: well, that was quick... seems a lot of people contacted the guy in charge and convinced him to stop the contest... hurray!... now let's move on...