Slashdot Log In
Phishing Is a Minimum-Wage Job
Posted by
kdawson
on Tue Jan 06, 2009 08:06 PM
from the triumph-of-the-commons dept.
from the triumph-of-the-commons dept.
rohitm918 writes "A study by Microsoft Research concludes that phishers make very little (PDF): '...low-skill jobs pay like low-skill jobs, whether the activity is legal or not.' They also find that the Gartner numbers that everyone quotes ($3.2B/year etc) are rubbish, off by a factor of 50. 'Even though it harvests "free money," phishing generates total revenue equal to the total costs incurred by the actors. Each participant earns, on average, only as much as he would have made in the opportunities he gave up elsewhere. As the total phishing effort increases the total phishing revenue declines: the harder individual phishers try the worse their collective situation gets. As a consequence, increasing effort is a sign of failure rather than of success.'"
Related Stories
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
So that's what they do... (Score:5, Funny)
I always wondered what the remaining 5% of computer science majors did, who didn't end up working minimum wage jobs at McBurger Queen...
Re: (Score:2)
Sorry if I was an insensitive clod and offended any
Re: (Score:2)
...pulling a D in Programming 101...
For some reason, my tired eyes read that as "someone programming in D", and I thought to myself, "When did D become a huge hax0r language all of the sudden?" Because everyone knows the real black hats use M [slashdot.org]!
Minimum wage in the US (Score:2, Interesting)
Re:Minimum wage in the US (Score:5, Informative)
The pool of phishing money is (more or less) static, so when more people start phishing (which happens as it becomes easier), the available money per phisher goes down until its not worth it. If this is less then the minimum wage, then people wouldn't do it, if its more, then more people do it. Hence it stabilizes around that mark. This is also one of the reasons why there are more phishers in poorer nations.
Parent
Re:Minimum wage in the US (Score:4, Funny)
This is also one of the reasons why there are more phishers in poorer nations.
Don't worry, Obama is gonna fix that. He'll pass tax incentives to help encourage businessmen [wikipedia.org] to keep those phishing and bot-net writing jobs here in America ;)
Parent
Re: (Score:3, Interesting)
No more phish! (Score:5, Funny)
That's actually waht they argue (Score:4, Interesting)
If you read their paper.
Also it is even worse, when you get down to it: People (contrary to evidence some times) have the capacity to learn. As phishing becomes a bigger problem, there's more news on it, more efforts to educate people about it and so on. So the pool of candidates shrinks. Likewise some companies start implementing technologies that make it hard/impossible to do (Paypal has a secure ID token you can get now for example).
So it isn't just a case of depleting the pool of dollars belonging to the people who can get phished, it is also a case of less people being available to be phished. While you'll certainly never educate everyone, I'd say awareness of phishing is much higher these days and many more people take care to protect their information.
Parent
Re:That's actually waht they argue (Score:4, Informative)
I'm own the anti-phishing rules at a well-known email security company, and while I agree with the principle that over-phishing is causing problems, as it does with fishing (although as with phishing, the best phishers are catching a lot more phish than the worst pishers), I don't think very many people are doing much more to protect their information. What does seem to happen, though, is that - just as with fish that see lures dragged in front of them all day long - people are coming to think everything is a fraud (I see legit bank emails reported as phishing all the time). Some of them, anyway. I also see a lot of correspondence threads in which people have already handed over money to 419ers or are preparing to do so.
And of course, phishers are also diversifying somewhat. Earlier this year, account credential phishing became popular. The goal: not immediate financial reward via account plunder, but to get access to a legit login on a host with a good email reputation for the purpose of either using it to send fraudulent email, or using it to send regular spam for hire.
Financial losses continue to be high, and I'm not convinced that the 3.2 billion figure is off by a factor of 50, even if it might be on the high side. But earnings by the theoretical average phisher? Yeah, they've got to be off. There are so many phishers these days, so many people are deluged by phishing attempts, and at least for those who have a good spam filter, a figure north of 99% of those phishing attempts don't make it to the inbox anyway.
The ones that get me are the people who release blatant phishing from quarantine. I'd love to know how many of them later respond and get phished. I suspect that number is rather high.
And then there are the money mule scams. People fall for those all the time. The phish aren't getting that much smarter, as far as I can tell.
Parent
Re:That's actually waht they argue (Score:5, Informative)
Parent
Re: (Score:3, Interesting)
That fails to work with most sensibly designed token-systems, because there's either a timestamp involved, or the tokens are required in a certain sequence.
For example, to log into my bank, I need to enter my account-number and pin, then it'll ask me for say token #37, which I can get from the token-thing. If a phisher got my pin and account-number and somehow convinced me to enter a few tokens, he'd still have low odds of suceeding, because he doesn't KNOW which tokens to ask me for, since he doesn't know
Re:No more phish! (Score:5, Funny)
Parent
Not really all that big a surprise (Score:5, Interesting)
I mean for one thing, a lot of crime really doesn't pay well. Sometimes even less than a minimum wage job. I remember a few years ago there was a problem of newspaper machines getting broken in to and the change stolen. They finally caught the guy and estimated he'd been making well less than minimum wage. It wasn't a trivial job to get in them and it isn't as though a ton of papers are sold from those. While there certainly are criminals who make bank (like drug lords) often you'll find that really criminals would do just as well to get honest work.
Another thing is that you are talking about something where your success rate is very low, and even when you do have a success in terms of getting info, you don't necessarily get anything with it. Just because you steal someone's account and try to use it, doesn't mean it works. For example I had my credit card stolen. Wasn't a phishing scam, just someone that had got a hold of the number, but either way they had it. As soon as they tried to order something, I noticed. I had the card disabled, the merchant stopped shipment on the goods, and so on. The thief didn't get squat. So even though they were successful in getting my card, they weren't successful in getting anything with it.
So all in all ti doesn't surprise me that phishing is a low paying job. You aren't going to get many bites, some of the ones you DO get will be fake (I love filling out phishing forms with fake data), and even when you do get legit info, you might not get to use it.
Re: (Score:2)
Re:Not really all that big a surprise (Score:4, Insightful)
Very true, I know a guy who sells pot. He is always bragging about how much money he makes
If he's selling drugs (even something as harmless as pot) while running around town bragging about it, he's likely to discover that his cost of doing business [wikipedia.org] will be going up soon.....
I'm not a big fan of a war on drugs but I don't have much sympathy for someone that mind numbingly stupid either. I always used to suspect that a friend of mine had a grow-operation going on -- but I never asked and she never told. If you are going to get involved in anything like that the first rule you learn is to keep your fucking mouth shut.
Parent
Re: (Score:2)
The second rule is: You get out before you're big enough to be worth taking down.
I wouldn't have the balls to get into dealing. The risk to reward ratio just isn't there for pot and I don't believe in any of the harder stuff.
Re:Not really all that big a surprise (Score:4, Insightful)
I wouldn't have the balls to get into dealing. The risk to reward ratio just isn't there for pot and I don't believe in any of the harder stuff.
On the other hand, the risk seems pretty low. Most pot dealers don't stand on a streetcorner, and many don't even advertise. Business is all word of mouth, and most customers repeat once a month or more -- nice and predictable income. Maybe every once in a while a dealer will try to up-sell a customer some mushrooms, but that's about it. Overall, selling pot seems like a much less risky business proposition than opening a coffee shop.
Parent
This has been pontificated about before... (Score:5, Informative)
I mean for one thing, a lot of crime really doesn't pay well. Sometimes even less than a minimum wage job.
Steven D. Levitt addresses this in his book, Freakonomics. Chapter 3 is titled Why Do Drug Dealers Still Live with Their Moms? [freakonomicsbook.com]
Parent
Re: (Score:3, Informative)
Tragedy of the suckers (Score:2)
Crime doesn't pay (Score:3, Funny)
...and neither does farming!
(slogan I saw on a baseball cap as a kid, maybe 25 years ago. One of my grandpa's buddies was wearing it.)
Yeah, Right... (Score:2, Insightful)
Phishers don't make squat. Right. Because obviously it's not as profitable as working at the local oil change shop, or at Wally World.
I'd like to see 419 examples of how Nigerian scammers don't make money.
Re: (Score:2, Funny)
I have the 419 examples you requested, but I need $3000 to get them through customs.
Re: (Score:2)
Economically rational, isn't. (Score:5, Insightful)
You have the choice:
1. earn minimum wage at McDonalds
2. earn less than minimum wage selling drugs
Which do you choose? Selling drugs of course. Why? Cause you've got respect for yourself and refuse to work a demeaning job.
Before you object, whether or not you agree that working at McDonalds is demeaning is irrelevant. Many, many, many women have been given the choice:
1. work as a stripper
2. work as a waitress
and decided that working as a waitress is less demeaning than working as a stripper. You may disagree with that, also but that's also irrelevant. The facts are that you can make a lot more money working as a stripper than as a waitress, and yet so many people choose not to.
The economically rational human is a myth.
Re: (Score:3, Interesting)
Just assign a value to, or create a market for, the lost self-respect and you're back in business from an economics standpoint.
Re: (Score:3, Insightful)
Hehe.. why do you think women get paid more to be strippers than to be waitresses? There already is a market for lost self-respect. People choose not to participate in it.
Or they just value it higher (Score:3, Insightful)
Every person places a different value on the same thing. If the difference in pay in X dollars per week, and girl A values her self-respect at X + 100 dollars, it would be irrational for her to strip instead of waiting tables (assuming other values are the same). If girl B values it at X - 200 dollars a week, it wouldn't make sense for
Re:Or they just value it higher (Score:5, Interesting)
Stripping as a career is not economically rational.
As a person with several strippers for friends, let me enlighten you on market forces in this industry.
Stripper income can be strongly affected by people's perception of the health of the local economy. This effect has a negative correlation with population, meaning that clubs in small towns are even more sensitive to economic change. Belt-tightening can happen in strip clubs the same as anywhere else.
Last but not least, strippers age. As they get older, the physical requirements of the job become too difficult, particularly pole/cage dancing. As you age, you become less desirable and working in premier clubs becomes impossible. The end result for many strippers is they move from seedy to seedier clubs, turn to hooking or simply get a day job. The years spent stripping doesn't help them get a good job either, since the ability to spin around a pole at 1 RPM doesn't help them operate a computer or balance a register.
Working as a stripper for a long term career is a fiscally irrational decision, given that the income is neither stable nor will last for the duration of the time you need money. However, stripping your way through college is a rational decision and I support college-going women's decision to be strippers.
Parent
Re: (Score:3, Insightful)
It's not a question of most women not wanting to work as strippers, it's a simple fact that most women could never make a living as a stripper. The majority of people (both men and women) do not look all that good naked.
Re: (Score:2, Insightful)
Then those people are not presented with that opportunity. Thanks for finding something else irrelevant. You can always rely on Slashdot.
Re: (Score:3, Insightful)
he majority of people (both men and women) do not look all that good naked.
The majority of strippers don't look all that good naked either ;) The novelty of the experience combined with low lightning and alcohol is usually enough to make up for this however.....
Re: (Score:2)
Re: (Score:3, Informative)
Re: (Score:3, Insightful)
1. Have sex with men for money and get another job to supplement that income. (This can include stripper or waitress)
2. Not have sex with men for money and get a job to supply their income.
The vast majority of women choose to have sex with men for cash, goods and/or services. Almost all of them know what they are doing, but there are FAR greater profit for the whole group if this is denied.
Like drug dealing (Score:3, Insightful)
They'd do better with a real job.
Re: (Score:2, Insightful)
Of course they would. But then again, they'd probably have to lay off the pot or crack in order to do so.
Negative PR (Score:2)
Nah... they just wanna demoralize the phishers so they'll give up and beg Microsoft to hire them for the $10 an hour they now know they're worth.
Having taken Econ 101... (Score:4, Funny)
Clearly, since phishing shows the classic signs of being a tragedy of the commons(if I were serious, I would put a patronizing link to the wikipedia article I had read just moments before in this spot) we must divide up the world's computer using idiots and make individual blocks of them the property of particular phishers, thus aligning incentives and ensuring optimal exploitation of the Lusers. I call all AOL usernames that start with "a"!
Phishing is like Amway and other MLM's (Score:3, Interesting)
Irrational expepctation (Score:4, Insightful)
For instance, some football players make a lot of money, so families, schools, colleges spend huge amounts of money to get people a position where they can make this money. In fact, even if one only considers colleges that are regularly recruited, the expectation value of income for these players are minimum wage. Of course, they can make money if they have others degress or skills, but the expectation if the rely on the game is very small.
As mentioned, many people prefer a small income with criminal activity rather than an honest, if perhaps uncomfortable job. People also prefer jobs they think they can have fun with to jobs where they actually have to put a honest days work.
We see this with the Madoff case, where it is better to be rich and work at a dishonorable profession than honorable and not so well off. Why would Madoff, or his criminal kids, be more respected than a person who is on time and does a good job at McDonalds?
Opportunities Elsewhere (Score:3, Insightful)
This is speculation, but my (big fat) gut tells me that while this might be true in general, there's probably at least one person at the top of a major phishing scheme making decent money.
Sure, the peons (as in any industry) who do the actual labor get paid crud, my guess is that Upper Management does just fine. Sure, unskilled labor gets the market rate for such.
Give them a bailout (Score:3, Funny)
Re:FP? (Score:5, Funny)
And in case your browser does not stop you, do NOT [slashdot.org] actually log in to the access-login page above, unless you drool and make funny noises. And the IP used for the hosts file joke was random and does not VHost-phish slashdot.org. Disclaimers suck, don't they?
Parent
Re:FP? (Score:4, Funny)
Increasing effort is a sign of failure, according to the summary.
Parent
Re: (Score:2)
Re:Need a new plan (Score:5, Interesting)
Actually, A friend of mine was a marketing intern and turned to "slangin" as he called it. He made quite a bit of cash off the "nickle and dimers" by doing a little market analysis and identifying the non-public congregation points thereby raising his return on time and lowering his risk of being caught since most everyone there knew and could vouch for everyone else, then selling to them exclusively. He became known for delivering the desired goods in a far more timely fashion than could be acquired elsewhere and made those congregation points far more popular in the process. It was interesting to watch this occur. I observed for more than a year and rather enjoyed the constant female attention his customers lavished, you can probably see how that would work, the more you hang out with the supplier, the more deals you get.... In real life, he made a little over minimum wage, and oddly was my boss, then my employee.
Sigh, college life, how we miss you...
Parent
Re: (Score:3, Informative)
Re: (Score:3, Funny)
Perhaps were raided by the BSA for using unlicensed copies of Acrobat Distiller.
Hey, a man can dream...