CastleCops

» see castlecops.com as it lived, on the wayback machine

~ the eulogy ~

There was a window, roughly 2003 to 2008, when a Windows machine that had been on the internet for a year was not really yours anymore. Toolbars stacked four deep in Internet Explorer, and a homepage you could not change back. The repair procedure everyone learned was the same: run HijackThis and post the log somewhere that strangers would read it.

CastleCops was the biggest of those somewheres. It started in 2002 as Computer Cops, run by Paul Laudanski and his wife Robin, took the CastleCops name in 2005, and did everything for free. There were searchable databases of malware entries and file hashes, so you could look up a process name before panicking about it. Mostly there was a forum where trained volunteers worked through log after log, line by line, telling people which entries were the operating system and which was the thing stealing their banking password.

The other half was offense. The site ran volunteer squads that investigated phishing campaigns and worked to get the fraud sites taken down, feeding what they found to hosts and to law enforcement. That is unglamorous, slow work done by people with day jobs, and for several years it was a real part of how phishing infrastructure got dismantled.

~ the dossier ~

~ the volunteer economy ~

Everything CastleCops did was donated. The analysts were unpaid and so was the administration, and the hosting ran on donations that never comfortably covered it. This is the structural condition of almost every useful security resource of that decade, and it looks fine right up until the moment the one or two people holding it together need an income.

In June 2008 Paul Laudanski took a full-time position at Microsoft as an internet safety investigator, working on phishing and spam campaigns for the Live consumer services group. He had been the site's primary leader for three years. No replacement was named. Reading the coverage afterward, every observer uses some version of the same word for what followed: predictable.

~ the attacks ~

The site was also under fire, literally and repeatedly. CastleCops was hit with sustained denial of service attacks by the criminals whose operations it was disrupting, and there were organized attempts to discredit it. Running a volunteer forum that costs professional fraudsters money turns out to attract professional retaliation, which is a cost the donation model never priced in.

It absorbed all of that for years, and then closed six months after one person changed jobs.

~ the funny part ~

The notice went up on 24 December 2008. "It has been our pleasure to investigate online crime and volunteer with our virtual family to assist with your computer needs and make the Internet a safer place. Unfortunately, all things come to an end." PayPal donations were refunded. Donations sent by check were passed on to the Internet Software Consortium by the middle of March. The domain was deliberately kept registered rather than released, specifically so the criminals could not buy it and serve malware from an address that thousands of people still trusted. Even the shutdown was a security decision.

By January 2010 castlecops.com was a 786-byte page reading "Castlecops has ceased operation. For additonal information, please view this Slashdot article." The typo is theirs, and six years of a community's work had been reduced to a link to its own obituary thread.

I was in internet cafes in Ankara in those years, and then on a TTNet line at home, and the machines around me were in exactly the state CastleCops existed to fix. Counter-Strike on one screen and MSN on the other, software arriving from wherever it arrived from. Nobody I knew paid for an antivirus subscription. When something went wrong you searched the error, you found a forum thread in English, and the answer was already there because somebody with no reason to help had written it out three years earlier for a stranger.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »