WizGidget

You may have seen some of the ads on television recently about the new “Auction” site called QuiBids.com.  Son Jesse checked it out, and it sounded like a good topic for WizGidget.

Basically, QuiBids puts new items “up for auction”, and registered users “bid” on the item.  It costs 60 cents for each bid.  Every time someone bids on an item, it increases the price by one or two cents, depending on the auction.  The auction goes for a specific time, although if bidding is continuing on an item the “Timer” gets extended.  If the timer goes below 20 seconds, and someone bids, the timer gets reset to 20 seconds.  After so many bids, it only gets reset to 15 seconds, and then 10 seconds, and eventually it no longer resets — kind of a “going…. going…. gone!” thing.

The auctions start at zero, and yes usually the item “auction price” goes for much less than what a retail item would fetch. Let’s take one auction as an example.

The item was a Mark of Fitness WS-820 blood pressure monitor — IF you can believe the photo on the auction — they don’t tell you the model, and have a caveat “Contents of package may vary from those pictured”.  Target had them online for $60, but I found them as low as $30, and more typically about $35.  Quibids listed their “value price” as $35.15.  When I started watching this auction, the auction price was 20-something cents.  The auction ended at $1.96.  The winning bidder bid 22 times, which cost them $13.20 (60 cents times 22 bids) plus the $1.96 auction price, for a total cost to them of $15.16 — about half off.  Oh, and they had to pay $7 shipping.

So, how does Quibids make money on this, when the sale price ends up being half of retail, you might ask?  Let’s do the math.  It costs $.60 for each bid, and each bid ratchets the price by one cent.  The $1.96 final price translates to 196 bids.  196 x $.60 = $117.00.  So, Quibids sold a $35 blood pressure monitor for $117.  Creative retailing, eh?

Getting something half off may seem not too bad, until you think about the fact that there were 196 bids on the item, out of which only 22 were from the winning bidder.  If the typical bidder bid 22 times more or less, that translates to about 8 bidders, which each invested $13 or so to bid on this item.  One won.  Seven lost.  It reminds me of my friend Jerry’s comment about the Lottery being a tax on people who are bad at math.

There is an escape clause though.  They have a “Buy it now” feature, which basically allows you to use the amount you’ve spent bidding on an item to buy an identical item at the “Value Price” — within 2 hours of the auction end.  What this means is that when you bid, you’ve decided to buy that item, at their price, without really knowing exactly what the item is.  Show me a retailer, and I’ll show you someone who likes the idea of getting a customer to commit to buying at retail by charging them 60 cents a bid to try for a better price.  Getting customers to commit is probably one of the hardest tasks for a retailer.

Years ago the spammers would send their spam out from a single or even several computers.  They might forge the “from” address to make it not as obvious where it was coming from, but it was relatively easy to “blacklist” ip addresses that were producing spam.  Often they would send the original spam through an “open relay” — that is, an email server that accepts email for relaying without regard for where it’s coming from or where it’s going.

These days email servers are pretty much locked down — they will only accept email for addresses they know how to deliver.  And with the CanSpam law, it would be pretty unwise to send out spam where the email could easily be traced back to the sender.  It would be just asking for fines and jailtime.

Nowadays, spam is mostly sent from botnets.  A botnet is a collection of virus-infected computers that can be controlled by an individual or group.  Because the ‘bots are usually running behind some form of firewall, they can’t be directly controlled from the internet.  Instead they are designed to run autonomously, meaning they’re smart enough to “phone home” — that is, to connect to any of a group of controllers for instructions and data as well as uploading data that the bot may have collected. Botnets are crafted to be really hard to detect, as well as being really hard to identify the perpetrators.

Botnets are used for more than just sending out spam.  They also collect from the host computers things like email addresses, personal data like credit card information, and even intellectual property from businesses.  They can also be used to try to infect computers on the same network using security holes in Windows.  Among other things they can be used to mount a “denial of service” attack, by using thousands or even millions of ‘bots to flood websites or internet services with so much traffic that it clogs their networks or overloads their servers.  There was a widely publicized incidence of this recently with the Facebook/Twitter attack that took place in August of 2009 (“facebook twitter attack“) that was apparently contracted to botnet operators by the Russian government.

The good news about botnets is that although they have tended to live free on the net for several years, researchers and ISP’s (Internet Service Providers) have begun to fight back and have successfully shut down at least two botnets.  Be assured this is not a problem that will be solved overnight: like cockroaches the cybercriminals will find ways to adapt and evade, but at least for now the researchers are making some headway on clobbering the botnets.

Here’s a couple articles on successful botnet elimination from “DarkReading” and “FireEye“.

The thing you need to do to avoid having your computer join a ‘botnet is to make sure you have a good anti-virus, anti-spyware program running on your computer.  I don’t recommend the free ones — who’s paying the person that has to constantly be on the watch for new viruses?