Pain in the aaS: Economist

Apr 24th 2008
From The Economist print edition

Online crooks adopt the software industry's new service-based model
IT WAS bound to happen. One after another, pieces of software have been moving online in a trend towards “software as a service” (SaaS). You can now manage your e-mail, write documents and edit spreadsheets using online services that run inside a web browser. This month Intuit, the maker of TurboTax, an accounting program, said more Americans filled out their tax returns this year using the online version of its product than the traditional one in a box. But now the trend has reached the darker corners of the software universe. Computer-security firms say criminals have adopted the new model too, and are offering “crimeware as a service” (CaaS).
Once the remit of malicious hackers vying for bragging rights, cybercrime is now about making money. “Criminal attacks are moving upmarket—they're now real businesses,” says Bruce Schneier, a security guru. A few years ago online outlaws started selling e-mail addresses, credit-card numbers and other personal information. Then they began trading information about weaknesses in computer systems and selling software kits to exploit them, complete with technical support and updates. More recently they have taken to setting up and then renting out “botnets”—huge groups of hijacked computers, infected with malicious software, that can be activated remotely to flood a website with bogus requests or send millions of “spam” e-mails.


The new offerings, which go by names such as NeoSploit and 76service, take commercialisation to the next level by allowing criminals to use and pay for such nefarious services via a web browser. Just as companies that adopt SaaS no longer need armies of support technicians, says Yuval Ben-Itzhak of Finjan, a computer-security firm, criminals using CaaS no longer need to be hackers. One web-based service he found even allows customers to specify a target group, such as British lawyers or American doctors. Once enough of their machines have been infected, documents and other data are siphoned out of them.
Renting a website that distributes malware to personal computers costs a few cents per target machine; access to a computer infected with software that grabs personal information (such as credit-card details) can cost $1,000 or more a month. How much money is made through such services is anybody's guess, says Raimund Genes of Trend Micro, another computer-security firm, but he has no doubt that the market will grow. Yet as in the case of benevolent SaaS, there may be a limit to the business model for CaaS. Many companies are wary of SaaS for security reasons: they do not want an outside firm looking after their customer lists, for example. Similarly, some criminals may be reluctant to use CaaS providers, which need to market their services—and hence may attract the attention of the authorities.
One thing seems clear. CaaS is proof that everything and anything computer-related will end up being offered “as a service”. There are now at least a dozen kinds of “aaS”, including data mining (DMaaS), virtualisation (VaaS) and even hardware (HaaS). Perhaps, as with the “.com” suffix, overuse of the term will put people off. A revolt is already brewing. Nicholas Carr, author of “The Big Switch”, a book about how computing power is turning into a utility, vowed recently on his widely read blog that he would no longer use the term “aaS” at all. “Join me in this crusade,” he wrote: “Death to aaS!”

Original Link: Pain in the aaS