Spyware is a type of
malwareMalware, short for malicious software, consists of programming that is designed to disrupt or deny operation, gather information that leads to loss of privacy or exploitation, or gain unauthorized access to system resources, or that otherwise exhibits abusive behavior...
that can be installed on
computerA computer is a programmable machine designed to sequentially and automatically carry out a sequence of arithmetic or logical operations. The particular sequence of operations can be changed readily, allowing the computer to solve more than one kind of problem...
s, and which collects small pieces of information about users without their knowledge. The presence of spyware is typically hidden from the user, and can be difficult to detect. Typically, spyware is secretly installed on the user's
personal computerA personal computer is any general-purpose computer whose size, capabilities, and original sales price make it useful for individuals, and which is intended to be operated directly by an end-user with no intervening computer operator...
. Sometimes, however, spywares such as keyloggers are installed by the owner of a shared, corporate, or
public computerA public computer is any of various computers available in public areas. Some places where public computers may be available are libraries, schools, or facilities run by government....
on purpose in order to secretly monitor other users.
While the term
spyware suggests software that secretly monitors the user's computing, the functions of spyware extend well beyond simple monitoring. Spyware programs can collect various types of
personal informationPersonally Identifiable Information , as used in information security, is information that can be used to uniquely identify, contact, or locate a single person or can be used with other sources to uniquely identify a single individual...
, such as Internet surfing habits and sites that have been visited, but can also interfere with user control of the computer in other ways, such as installing additional software and redirecting
Web browserA web browser is a software application for retrieving, presenting, and traversing information resources on the World Wide Web. An information resource is identified by a Uniform Resource Identifier and may be a web page, image, video, or other piece of content...
activity. Spyware is known to change computer settings, resulting in slow connection speeds, different home pages, and/or loss of
InternetThe Internet is a global system of interconnected computer networks that use the standard Internet protocol suite to serve billions of users worldwide...
connection or functionality of other programs. In an attempt to increase the understanding of spyware, a more formal classification of its included software types is provided by the term
privacy-invasive softwarePrivacy-invasive software is a category of computer software that ignores users’ privacy and that is distributed with a specific intent, often of a commercial nature. Three typical examples of privacy-invasive software are adware, spyware and content hijacking programs.- Background :In a...
.
In response to the emergence of spyware, a small industry has sprung up dealing in anti-spyware software. Running anti-spyware software has become a widely recognized element of
computer securityComputer security is a branch of computer technology known as information security as applied to computers and networks. The objective of computer security includes protection of information and property from theft, corruption, or natural disaster, while allowing the information and property to...
practices for computers, especially those running
Microsoft WindowsMicrosoft Windows is a series of operating systems produced by Microsoft.Microsoft introduced an operating environment named Windows on November 20, 1985 as an add-on to MS-DOS in response to the growing interest in graphical user interfaces . Microsoft Windows came to dominate the world's personal...
. A number of jurisdictions have passed anti-spyware laws, which usually target any software that is surreptitiously installed to control a user's computer.
History and development
The first recorded use of the term spyware occurred on 16 October 1995 in a
UsenetUsenet is a worldwide distributed Internet discussion system. It developed from the general purpose UUCP architecture of the same name.Duke University graduate students Tom Truscott and Jim Ellis conceived the idea in 1979 and it was established in 1980...
post that poked fun at
MicrosoftMicrosoft Corporation is an American public multinational corporation headquartered in Redmond, Washington, USA that develops, manufactures, licenses, and supports a wide range of products and services predominantly related to computing through its various product divisions...
's
business modelA business model describes the rationale of how an organization creates, delivers, and captures value...
.
Spyware at first denoted
software meant for
espionageEspionage or spying involves an individual obtaining information that is considered secret or confidential without the permission of the holder of the information. Espionage is inherently clandestine, lest the legitimate holder of the information change plans or take other countermeasures once it...
purposes. However, in early 2000 the founder of Zone Labs, Gregor Freund, used the term in a
press release for the
ZoneAlarm Personal Firewall. Since then, "spyware" has taken on its present sense.
According to a 2005 study by
AOLAOL Inc. is an American global Internet services and media company. AOL is headquartered at 770 Broadway in New York. Founded in 1983 as Control Video Corporation, it has franchised its services to companies in several nations around the world or set up international versions of its services...
and the National Cyber-Security Alliance, 61 percent of surveyed users' computers were infected with form of spyware. 92 percent of surveyed users with spyware reported that they did not know of its presence, and 91 percent reported that they had not given permission for the installation of the spyware.
As of 2006, spyware has become one of the preeminent security threats to computer systems running Microsoft Windows
operating systemAn operating system is a set of programs that manage computer hardware resources and provide common services for application software. The operating system is the most important type of system software in a computer system...
s. Computers on which
Internet ExplorerWindows Internet Explorer is a series of graphical web browsers developed by Microsoft and included as part of the Microsoft Windows line of operating systems, starting in 1995. It was first released as part of the add-on package Plus! for Windows 95 that year...
(IE) is the primary
browserA web browser is a software application for retrieving, presenting, and traversing information resources on the World Wide Web. An information resource is identified by a Uniform Resource Identifier and may be a web page, image, video, or other piece of content...
are particularly vulnerable to such attacks, not only because IE is the most widely-used, but because its tight integration with Windows allows spyware access to crucial parts of the operating system.
Before
Internet Explorer 6Internet Explorer 6 is the sixth major revision of Internet Explorer, a web browser developed by Microsoft for Windows operating systems...
SP2 was released as part of Windows XP Service Pack 2, the browser would automatically display an installation window for any
ActiveXActiveX is a framework for defining reusable software components in a programming language-independent way. Software applications can then be composed from one or more of these components in order to provide their functionality....
component that a website wanted to install. The combination of user naivety concerning
malwareMalware, short for malicious software, consists of programming that is designed to disrupt or deny operation, gather information that leads to loss of privacy or exploitation, or gain unauthorized access to system resources, or that otherwise exhibits abusive behavior...
, and the assumption by
Internet ExplorerWindows Internet Explorer is a series of graphical web browsers developed by Microsoft and included as part of the Microsoft Windows line of operating systems, starting in 1995. It was first released as part of the add-on package Plus! for Windows 95 that year...
that all ActiveX components are benign, led, in part, to the massive spread of spyware. Many spyware components would also make use of
exploitAn exploit is a piece of software, a chunk of data, or sequence of commands that takes advantage of a bug, glitch or vulnerability in order to cause unintended or unanticipated behavior to occur on computer software, hardware, or something electronic...
s in
JavascriptJavaScript is a prototype-based scripting language that is dynamic, weakly typed and has first-class functions. It is a multi-paradigm language, supporting object-oriented, imperative, and functional programming styles....
, Internet Explorer and Windows to install without user knowledge or permission.
The
Windows RegistryThe Windows Registry is a hierarchical database that stores configuration settings and options on Microsoft Windows operating systems. It contains settings for low-level operating system components as well as the applications running on the platform: the kernel, device drivers, services, SAM, user...
contains multiple sections where modification of key values allows software to be executed automatically when the operating system boots. Spyware can exploit this design to circumvent attempts at removal. The spyware typically will link itself from each location in the
registryThe Windows Registry is a hierarchical database that stores configuration settings and options on Microsoft Windows operating systems. It contains settings for low-level operating system components as well as the applications running on the platform: the kernel, device drivers, services, SAM, user...
that allows execution. Once running, the spyware will periodically check if any of these links are removed. If so, they will be automatically restored. This ensures that the spyware will execute when the operating system is booted, even if some (or most) of the registry links are removed.
Spyware, adware and tracking
The term
adwareAdware, or advertising-supported software, is any software package which automatically plays, displays, or downloads advertisements to a computer. These advertisements can be in the form of a pop-up. They may also be in the user interface of the software or on a screen presented to the user during...
frequently refers to any software which displays advertisements, whether or not the user has consented. Programs such as the
EudoraEudora is an e-mail client used on the Apple Macintosh and Microsoft Windows operating systems. It also supports several palmtop computing platforms, including Newton and the Palm OS....
mail client display advertisements as an alternative to
sharewareThe term shareware is a proprietary software that is provided to users without payment on a trial basis and is often limited by any combination of functionality, availability, or convenience. Shareware is often offered as a download from an Internet website or as a compact disc included with a...
registration fees. These may be classified as "adware", in the sense of advertising-supported software, but not as spyware. Adware in this form does not operate surreptitiously or mislead the user, and provides the user with a specific service.
Most adware is
spyware in a different sense than "advertising-supported software": it displays advertisements related to what it finds from spying on users. Gator Software from
Claria CorporationClaria Corporation was a software company based in Redwood City, California with products many considered spyware. It was established in 1998 by Denis Coleman. Its name was often used interchangeably with its Gain advertising network, which it claimed serviced over 40 million users...
(formerly GATOR) and Exact Advertising's BargainBuddy are examples. Visited Web sites frequently install Gator on client machines in a surreptitious manner, and it directs revenue to the installing site and to Claria by displaying advertisements to the user. The user is shown many pop-up advertisements.
Other spyware behavior, such as reporting on websites the user visits, occurs in the background. The data is used for "targeted" advertisement impressions. The prevalence of spyware has cast suspicion on other programs that track Web browsing, even for statistical or research purposes. Some observers describe the
Alexa ToolbarThe Alexa Toolbar, is an application produced by Alexa Internet, and is a Firefox extension and Browser Helper Object for Internet Explorer on Microsoft Windows that is used by Alexa to measure website specific statistics.-Content:...
, an Internet Explorer plug-in published by
Amazon.comAmazon.com, Inc. is a multinational electronic commerce company headquartered in Seattle, Washington, United States. It is the world's largest online retailer. Amazon has separate websites for the following countries: United States, Canada, United Kingdom, Germany, France, Italy, Spain, Japan, and...
, as spyware, and some anti-spyware programs such as
Ad-AwareAd-Aware is an anti-spyware and anti-virus program developed by Lavasoft that detects and removes malware, spyware and adware on a user's computer...
report it as such. Many of these adware-distributing companies are backed by millions of dollars of adware-generating revenues. Adware and spyware are similar to viruses in that they can be considered malicious in nature. People are profiting from misleading adware, sometimes known as
scarewareScareware comprises several classes of scam software with malicious payloads, or of limited or no benefit, that are sold to consumers via certain unethical marketing practices. The selling approach uses social engineering to cause shock, anxiety, or the perception of a threat, generally directed at...
, such as Antivirus 2009.
Similarly, software bundled with free, advertising-supported programs acts as spyware (and, if removed, disables the 'parent' program), yet people are willing to download it. This presents a dilemma for proprietors of anti-spyware products whose removal tools may inadvertently disable wanted programs. For example, WhenUSave is ignored by popular anti-spyware program
Ad-AwareAd-Aware is an anti-spyware and anti-virus program developed by Lavasoft that detects and removes malware, spyware and adware on a user's computer...
(but removed as spyware by most scanners) because it is part of the popular (but recently decommissioned) eDonkey client. To address this dilemma, the
Anti-Spyware CoalitionThe Anti-Spyware Coalition is a group dedicated to building a consensus about definitions and best practices in the debate surrounding spyware and other potentially unwanted technologies....
was formed to establish and document best practices regarding acceptable software behavior.
http://www.antispywarecoalition.org/about/index.htm However, the Anti-Spyware Coalition website does not appear to have been updated since late 2008.
Spyware, viruses and worms
Unlike
virusesA computer virus is a computer program that can replicate itself and spread from one computer to another. The term "virus" is also commonly but erroneously used to refer to other types of malware, including but not limited to adware and spyware programs that do not have the reproductive ability...
and
wormsA computer worm is a self-replicating malware computer program, which uses a computer network to send copies of itself to other nodes and it may do so without any user intervention. This is due to security shortcomings on the target computer. Unlike a computer virus, it does not need to attach...
, spyware does not usually self-replicate. Like many recent viruses, however, spyware—by design—exploits infected computers for commercial gain. Typical tactics include delivery of unsolicited pop-up advertisements, theft of personal information (including financial information such as credit card numbers), monitoring of Web-browsing activity for
marketingMarketing is the process used to determine what products or services may be of interest to customers, and the strategy to use in sales, communications and business development. It generates the strategy that underlies sales techniques, business communication, and business developments...
purposes, and routing of HTTP requests to advertising sites.
However, spyware can be dropped as a payload by a worm.
Routes of infection
Spyware does not directly spread in the manner of a computer virus or worm: generally, an infected system does not attempt to transmit the infection to other computers. Instead, spyware gets on a system through deception of the user or through exploitation of software vulnerabilities.
Most spyware is installed without users' knowledge. Since they tend not to install software if they know that it will disrupt their working environment and compromise their privacy, spyware deceives users, either by
piggybackingIn security, piggybacking refers to when a person tags along with another person who is authorized to gain entry into a restricted area, or pass a certain checkpoint. The act may be legal or illegal, authorized or unauthorized, depending on the circumstances...
on a piece of desirable software such as
KazaaKazaa Media Desktop started as a peer-to-peer file sharing application using the FastTrack protocol licensed by Joltid Ltd. and operated as Kazaa by Sharman Networks...
, or by tricking them into installing it (the
Trojan horseA Trojan horse, or Trojan, is software that appears to perform a desirable function for the user prior to run or install, but steals information or harms the system. The term is derived from the Trojan Horse story in Greek mythology.-Malware:A destructive program that masquerades as a benign...
method). Some "rogue" spyware programs masquerade as security software.
The distributor of spyware usually presents the program as a useful utility—for instance as a "Web accelerator" or as a helpful
software agentIn computer science, a software agent is a piece of software that acts for a user or other program in a relationship of agency, which derives from the Latin agere : an agreement to act on one's behalf...
. Users download and install the software without immediately suspecting that it could cause harm. For example, Bonzi Buddy, a program bundled with spyware and targeted at children, claims that:
He will explore the Internet with you as your very own friend and sidekick! He can talk, walk, joke, browse, search, e-mail, and download like no other friend you've ever had! He even has the ability to compare prices on the products you love and help you save money! Best of all, he's FREE!
Spyware can also come bundled with other software. The user downloads a program and installs it, and the installer additionally installs the spyware. Although the desirable software itself may do no harm, the bundled spyware does. In some cases, spyware authors have paid shareware authors to bundle spyware with their software. In other cases, spyware authors have repackaged desirable freeware with installers that slipstream spyware.
Some spyware authors infect a system through security holes in the Web browser or in other software. When the user navigates to a Web page controlled by the spyware author, the page contains code which attacks the browser and forces the download and installation of spyware. The spyware author would also have some extensive knowledge of commercially-available anti-virus and firewall software. This has become known as a "
drive-by downloadDrive-by download means three things, each concerning the unintended download of computer software from the Internet:# Downloads which a person authorized but without understanding the consequences Drive-by download means three things, each concerning the unintended download of computer software...
", which leaves the user a hapless bystander to the attack. Common
browser exploitA browser exploit is a form of malicious code that takes advantage of a flaw or vulnerability in an operating system or piece of software with the intent to alter a user's browser settings without their knowledge...
s target security vulnerabilities in Internet Explorer and in the
Sun MicrosystemsSun Microsystems, Inc. was a company that sold :computers, computer components, :computer software, and :information technology services. Sun was founded on February 24, 1982...
JavaJava is a programming language originally developed by James Gosling at Sun Microsystems and released in 1995 as a core component of Sun Microsystems' Java platform. The language derives much of its syntax from C and C++ but has a simpler object model and fewer low-level facilities...
runtime.
The installation of spyware frequently involves Internet Explorer. Its popularity and history of security issues have made it the most frequent target. Its deep integration with the Windows environment and scriptability make it an obvious point of attack into
WindowsMicrosoft Windows is a series of operating systems produced by Microsoft.Microsoft introduced an operating environment named Windows on November 20, 1985 as an add-on to MS-DOS in response to the growing interest in graphical user interfaces . Microsoft Windows came to dominate the world's personal...
. Internet Explorer also serves as a point of attachment for spyware in the form of
Browser Helper ObjectA Browser Helper Object is a DLL module designed as a plugin for Microsoft's Internet Explorer web browser to provide added functionality. BHOs were introduced in October 1997 with the release of version 4 of Internet Explorer. Most BHOs are loaded once by each new instance of Internet Explorer...
s, which modify the browser's behavior to add toolbars or to redirect traffic.
In a few cases, a
wormA computer worm is a self-replicating malware computer program, which uses a computer network to send copies of itself to other nodes and it may do so without any user intervention. This is due to security shortcomings on the target computer. Unlike a computer virus, it does not need to attach...
or
virusA computer virus is a computer program that can replicate itself and spread from one computer to another. The term "virus" is also commonly but erroneously used to refer to other types of malware, including but not limited to adware and spyware programs that do not have the reproductive ability...
has delivered a spyware payload. Some attackers used the
Spybot wormThe Spybot worm is a large family of computer worms of varying characteristics. Although the actual number of versions is unknown, it is estimated to be well into the thousands...
to install spyware that put pornographic pop-ups on the infected system's screen. By directing traffic to ads set up to channel funds to the spyware authors, they profit personally.
Effects and behaviors
A spyware program is rarely alone on a computer: an affected machine usually has multiple infections. Users frequently notice unwanted behavior and degradation of system performance. A spyware infestation can create significant unwanted
CPUThe central processing unit is the portion of a computer system that carries out the instructions of a computer program, to perform the basic arithmetical, logical, and input/output operations of the system. The CPU plays a role somewhat analogous to the brain in the computer. The term has been in...
activity, disk usage, and network traffic. Stability issues, such as applications freezing, failure to boot, and system-wide crashes, are also common. Spyware, which interferes with networking software, commonly causes difficulty connecting to the Internet.
In some infections, the spyware is not even evident. Users assume in those situations that the performance issues relate to faulty hardware, Windows installation problems, or another
infectionMalware, short for malicious software, consists of programming that is designed to disrupt or deny operation, gather information that leads to loss of privacy or exploitation, or gain unauthorized access to system resources, or that otherwise exhibits abusive behavior...
. Some owners of badly infected systems resort to contacting
technical supportTechnical support or tech support refers to a range of services by which enterprises provide assistance to users of technology products such as mobile phones, televisions, computers, software products or other electronic or mechanical goods...
experts, or even buying a new computer because the existing system "has become too slow". Badly infected systems may require a clean reinstallation of all their software in order to return to full functionality.
Only rarely does a single piece of software render a computer unusable. Rather, a computer is likely to have multiple infections. The cumulative effect, and the interactions between spyware components, causes the symptoms commonly reported by users: a computer, which slows to a crawl, overwhelmed by the many parasitic processes running on it. Moreover, some types of spyware disable software firewalls and anti-virus software, and/or reduce browser security settings, thus opening the system to further
opportunistic infectionAn opportunistic infection is an infection caused by pathogens, particularly opportunistic pathogens—those that take advantage of certain situations—such as bacterial, viral, fungal or protozoan infections that usually do not cause disease in a healthy host, one with a healthy immune system...
s, much like an immune deficiency disease. Some spyware disables or even removes competing spyware programs, on the grounds that more spyware-related annoyances make it even more likely that users will take action to remove the programs. One spyware maker, Avenue Media, even
suedA lawsuit or "suit in law" is a civil action brought in a court of law in which a plaintiff, a party who claims to have incurred loss as a result of a defendant's actions, demands a legal or equitable remedy. The defendant is required to respond to the plaintiff's complaint...
a competitor, Direct Revenue, over this; the two later
settledIn law, a settlement is a resolution between disputing parties about a legal case, reached either before or after court action begins. The term "settlement" also has other meanings in the context of law.-Basis:...
with an agreement not to disable each others' products.
Some other types of spyware use
rootkitA rootkit is software that enables continued privileged access to a computer while actively hiding its presence from administrators by subverting standard operating system functionality or other applications...
like techniques to prevent detection, and thus removal. Targetsoft, for instance, modifies the "
WinsockIn computing, the Windows Sockets API , which was later shortened to Winsock, is a technical specification that defines how Windows network software should access network services, especially TCP/IP. It defines a standard interface between a Windows TCP/IP client application and the underlying...
" Windows Sockets files. The deletion of the spyware-infected file "inetadpt.dll" will interrupt normal networking usage.
A typical Windows user has administrative privileges, mostly for convenience. Because of this, any program the user runs (intentionally or not) has unrestricted access to the system. As with other
operating systemAn operating system is a set of programs that manage computer hardware resources and provide common services for application software. The operating system is the most important type of system software in a computer system...
s, Windows users too are able to follow the principle of least privilege and use non-administrator least user access accounts, or to reduce the
privilegesIn computing, privilege is defined as the delegation of authority over a computer system. A privilege is a permission to perform an action. Examples of various privileges include the ability to create a file in a directory, or to read or delete a file, access a device, or have read or write...
of specific vulnerable Internet-facing
processesIn computing, a process is an instance of a computer program that is being executed. It contains the program code and its current activity. Depending on the operating system , a process may be made up of multiple threads of execution that execute instructions concurrently.A computer program is a...
such as Internet Explorer (through the use of tools such as
DropMyRights). However, as this is not a default configuration, few users do this.
In
Windows VistaWindows Vista is an operating system released in several variations developed by Microsoft for use on personal computers, including home and business desktops, laptops, tablet PCs, and media center PCs...
, by default, a computer administrator runs everything under limited user privileges. When a program requires administrative privileges, Vista will prompt the user with an allow/deny pop-up (see
User Account ControlUser Account Control is a technology and security infrastructure introduced with Microsoft's Windows Vista and Windows Server 2008 operating systems, with a more relaxed version also present in Windows 7 and Windows Server 2008 R2...
). This improves on the design used by previous versions of Windows.
Advertisements
Many spyware programs display advertisements. Some programs simply display pop-up ads on a regular basis; for instance, one every several minutes, or one when the user opens a new browser window. Others display ads in response to the user visiting specific sites. Spyware operators present this feature as desirable to advertisers, who may buy ad placement in pop-ups displayed when the user visits a particular site. It is also one of the purposes for which spyware programs gather information on user behavior.
Many users complain about irritating or offensive advertisements as well. As with many
banner adsA web banner or banner ad is a form of advertising on the World Wide Web delivered by an ad server. This form of online advertising entails embedding an advertisement into a web page. It is intended to attract traffic to a website by linking to the website of the advertiser...
, spyware advertisements often use animation or flickering banners, which can be visually distracting and annoying to users. Pop-up ads for
pornographyPornography or porn is the explicit portrayal of sexual subject matter for the purposes of sexual arousal and erotic satisfaction.Pornography may use any of a variety of media, ranging from books, magazines, postcards, photos, sculpture, drawing, painting, animation, sound recording, film, video,...
often display indiscriminately. Links to these sites may be added to the browser window, history or search function. When children are the users, this could possibly violate anti-pornography laws in some jurisdictions.
A number of spyware programs break the boundaries of illegality; variations of “Zlob.Trojan” and “Trojan-Downloader.Win32.INService” have been known to show undesirable child pornography, key gens, cracks and illegal software pop-up ads, which violate child pornography and copyright laws.
A further issue in the case of some spyware programs concerns the replacement of banner ads on viewed web sites. Spyware that acts as a web proxy or a
Browser Helper ObjectA Browser Helper Object is a DLL module designed as a plugin for Microsoft's Internet Explorer web browser to provide added functionality. BHOs were introduced in October 1997 with the release of version 4 of Internet Explorer. Most BHOs are loaded once by each new instance of Internet Explorer...
can replace references to a site's own advertisements (which fund the site) with advertisements that instead fund the spyware operator. This cuts into the margins of advertising-funded Web sites.
"Stealware" and affiliate fraud
A few spyware vendors, notably 180 Solutions, have written what the
New York Times has dubbed "
stealwareStealware refers to a type of software that effectively transfers money owed to a website owner to a third party.Specifically, stealware uses an HTTP cookie to redirect the commission ordinarily earned by the site for referring users to another site....
", and what spyware researcher Ben Edelman terms
affiliate fraud, a form of
click fraudClick fraud is a type of Internet crime that occurs in pay per click online advertising when a person, automated script or computer program imitates a legitimate user of a web browser clicking on an ad, for the purpose of generating a charge per click without having actual interest in the target...
. Stealware diverts the payment of
affiliate marketingAffiliate marketing is a marketing practice in which a business rewards one or more affiliates for each visitor or customer brought about by the affiliate's own marketing efforts...
revenues from the legitimate affiliate to the spyware vendor.
Spyware which attacks affiliate networks places the spyware operator's affiliate tag on the user's activity — replacing any other tag, if there is one. The spyware operator is the only party that gains from this. The user has their choices thwarted, a legitimate affiliate loses revenue, networks' reputations are injured, and vendors are harmed by having to pay out affiliate revenues to an "affiliate" who is not party to a contract.
Affiliate fraud is a violation of the
terms of serviceTerms of service are rules which one must agree to abide by in order to use a service. Unless in violation of consumer protection laws, such terms are usually legally binding...
of most affiliate marketing networks. As a result, spyware operators such as 180 Solutions have been terminated from affiliate networks including LinkShare and ShareSale.
Identity theft and fraud
In one case, spyware has been closely associated with
identity theftIdentity theft is a form of stealing another person's identity in which someone pretends to be someone else by assuming that person's identity, typically in order to access resources or obtain credit and other benefits in that person's name...
. In August 2005, researchers from security software firm Sunbelt Software suspected the creators of the common
CoolWebSearchCoolWebSearch is a well-known spyware program that installs itself on Microsoft Windows based computers. It first appeared in May 2003.- Effects :...
spyware had used it to transmit "chat sessions, user names,
passwordA password is a secret word or string of characters that is used for authentication, to prove identity or gain access to a resource . The password should be kept secret from those not allowed access....
s, bank information, etc."; however it turned out that "it actually (was) its own sophisticated criminal little trojan that's independent of CWS." This case is currently under investigation by the
FBIThe Federal Bureau of Investigation is an agency of the United States Department of Justice that serves as both a federal criminal investigative body and an internal intelligence agency . The FBI has investigative jurisdiction over violations of more than 200 categories of federal crime...
.
The
Federal Trade CommissionThe Federal Trade Commission is an independent agency of the United States government, established in 1914 by the Federal Trade Commission Act...
estimates that 27.3 million Americans have been victims of identity theft, and that financial losses from identity theft totaled nearly $48 billion for businesses and financial institutions and at least $5 billion in out-of-pocket expenses for individuals.
Spyware-makers may commit
wire fraudMail and wire fraud is a federal crime in the United States. Together, 18 U.S.C. §§ 1341, 1343, and 1346 reach any fraudulent scheme or artifice to intentionally deprive another of property or honest services with a nexus to mail or wire communication....
with
dialerA dialer or dialler is an electronic device that is connected to a telephone line to monitor the dialed numbers and alter them to seamlessly provide services that otherwise require lengthy access codes to be dialed...
program spyware. These can reset a
modemA modem is a device that modulates an analog carrier signal to encode digital information, and also demodulates such a carrier signal to decode the transmitted information. The goal is to produce a signal that can be transmitted easily and decoded to reproduce the original digital data...
to dial up a premium-rate telephone number instead of the usual
ISPAn Internet service provider is a company that provides access to the Internet. Access ISPs directly connect customers to the Internet using copper wires, wireless or fiber-optic connections. Hosting ISPs lease server space for smaller businesses and host other people servers...
. Connecting to these suspicious numbers involves long-distance or overseas charges which invariably result in high call costs. Dialers are ineffective on computers that do not have a modem, or are not connected to a telephone line, and are now very rare due to the decline in use of dial-up internet access.
Digital rights management
Some copy-protection technologies have borrowed from spyware. In 2005,
Sony BMG Music EntertainmentSony BMG Music Entertainment was a recorded music company, which was a 50–50 joint venture between the Sony Corporation of America and Bertelsmann AG...
was found to be using
rootkitA rootkit is software that enables continued privileged access to a computer while actively hiding its presence from administrators by subverting standard operating system functionality or other applications...
s in its XCP
digital rights managementDigital rights management is a class of access control technologies that are used by hardware manufacturers, publishers, copyright holders and individuals with the intent to limit the use of digital content and devices after sale. DRM is any technology that inhibits uses of digital content that...
technology Like spyware, not only was it difficult to detect and uninstall, it was so poorly written that most efforts to remove it could have rendered computers unable to function.
Texas Attorney GeneralThe Texas Attorney General is the chief legal officer of the State of Texas.The department has offices at the William P. Clements State Office Building at 300 West 15th Street in Austin.-History:...
Greg AbbottGregory Wayne "Greg" Abbott is the Texas Attorney General, and is the second Republican since Reconstruction to serve in that role. Abbott was sworn in on December 2, 2002, following John Cornyn's election to the U.S. Senate...
filed suit, and three separate class-action suits were filed. Sony BMG later provided a workaround on its website to help users remove it.
Beginning on 25 April 2006, Microsoft's
Windows Genuine AdvantageWindows Genuine Advantage is an anti-piracy system created by Microsoft that enforces online validation of the licensing of several recent Microsoft Windows operating systems when accessing several services, such as Windows Update, and downloading Windows components from the Microsoft Download...
Notifications application was installed on most Windows PCs as a "critical security update". While the main purpose of this deliberately uninstallable application is to ensure the copy of Windows on the machine was lawfully purchased and installed, it also installs software that has been accused of "
phoning homePhoning home, in computing, refers to an act of client to server communication where a client device or client application software reports its location on a network, the currently logged on user, or any other information to a server computer...
" on a daily basis, like spyware. It can be removed with the RemoveWGA tool.
Personal relationships
Spyware has been used to surreptitiously monitor electronic activities of partners in intimate relationships, generally to uncover evidence of infidelity. At least one software package, Loverspy, was specifically marketed for this purpose. Depending on local laws regarding communal/marital property, observing a partner's online activity without their consent may be illegal; the author of Loverspy and several users of the product were indicted in California in 2005 on charges of wiretapping and various computer crimes.
Browser cookies
Anti-spyware programs often report Web advertisers'
HTTP cookieA cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used for an origin website to send state information to a user's browser and for the browser to return the state information to the origin site...
s, the small text files that track browsing activity, as spyware. While they are not always inherently malicious, many users object to third parties using space on their personal computers for their business purposes, and many anti-spyware programs offer to remove them.
Examples
These common spyware programs illustrate the diversity of behaviors found in these attacks. Note that as with computer viruses, researchers give names to spyware programs which may not be used by their creators. Programs may be grouped into "families" based not on shared program code, but on common behaviors, or by "following the money" of apparent financial or business connections. For instance, a number of the spyware programs distributed by Claria are collectively known as "Gator". Likewise, programs that are frequently installed together may be described as parts of the same spyware package, even if they function separately.
- CoolWebSearch
CoolWebSearch is a well-known spyware program that installs itself on Microsoft Windows based computers. It first appeared in May 2003.- Effects :...
, a group of programs, takes advantage of Internet Explorer vulnerabilities. The package directs traffic to advertisements on Web sites including coolwebsearch.com. It displays pop-up ads, rewrites search engineA web search engine is designed to search for information on the World Wide Web and FTP servers. The search results are generally presented in a list of results often referred to as SERPS, or "search engine results pages". The information may consist of web pages, images, information and other...
results, and alters the infected computer's hosts fileThe hosts file is a computer file used in an operating system to map hostnames to IP addresses. The hosts file is a plain-text file and is conventionally named hosts.-Purpose:...
to direct DNSThe Domain Name System is a hierarchical distributed naming system for computers, services, or any resource connected to the Internet or a private network. It associates various information with domain names assigned to each of the participating entities...
lookups to these sites.
- Internet Optimizer
Internet Optimizer, also known as DyFuCA is a spyware program which redirects Internet Explorer error pages to advertising pages. When users follow a broken link or enter an erroneous URL, they see a page of advertisements...
, also known as DyFuCa, redirects Internet Explorer error pages to advertising. When users follow a broken link or enter an erroneous URL, they see a page of advertisements. However, because password-protected Web sites (HTTP Basic authentication) use the same mechanism as HTTP errors, Internet Optimizer makes it impossible for the user to access password-protected sites.
- HuntBar
HuntBar, aka WinTools or Adware.Websearch, was installed by an ActiveX drive-by download at affiliate Web sites, or by advertisements displayed by other spyware programs — an example of how spyware can install more spyware...
, aka WinTools or Adware.Websearch, was installed by an ActiveX drive-by download at affiliate Web sites, or by advertisements displayed by other spyware programs—an example of how spyware can install more spyware. These programs add toolbars to IE, track aggregate browsing behavior, redirect affiliate references, and display advertisements.
- Movieland
Movieland, also known as Movieland.com, Moviepass.tv and Popcorn.net, is a subscription-based movie download service that has been the subject of thousands of complaints to the Federal Trade Commission, the Washington State Attorney General's Office, the Better Business Bureau, and other agencies...
, also known as Moviepass.tv and Popcorn.net, is a movie download service that has been the subject of thousands of complaints to the Federal Trade CommissionThe Federal Trade Commission is an independent agency of the United States government, established in 1914 by the Federal Trade Commission Act...
(FTC), the Washington State Attorney General's OfficeThe state attorney general in each of the 50 U.S. states and territories is the chief legal advisor to the state government and the state's chief law enforcement officer. In some states, the attorney general serves as the head of a state department of justice, with responsibilities similar to those...
, the Better Business BureauThe Better Business Bureau , founded in 1912, is a corporation consisting of several private business franchises of local BBB organizations based in the United States and Canada, which work through their parent corporation, the Council of Better Business Bureaus .The Better Business Bureau, through...
, and other agencies. Consumers complained they were held hostage by a cycle of oversized pop-up windows demanding payment of at least $29.95, claiming that they had signed up for a three-day free trial but had not cancelled before the trial period was over, and were thus obligated to pay. The FTC filed a complaintIn legal terminology, a complaint is a formal legal document that sets out the facts and legal reasons that the filing party or parties In legal terminology, a complaint is a formal legal document that sets out the facts and legal reasons (see: cause of action) that the filing party or parties In...
, since settled, against Movieland and eleven other defendants charging them with having "engaged in a nationwide scheme to use deceptionDeception, beguilement, deceit, bluff, mystification, bad faith, and subterfuge are acts to propagate beliefs that are not true, or not the whole truth . Deception can involve dissimulation, propaganda, and sleight of hand. It can employ distraction, camouflage or concealment...
and coercionCoercion is the practice of forcing another party to behave in an involuntary manner by use of threats or intimidation or some other form of pressure or force. In law, coercion is codified as the duress crime. Such actions are used as leverage, to force the victim to act in the desired way...
to extract payments from consumers."
- WeatherStudio has a plugin that displays a window-panel near the bottom of a browser window. The official website notes that it is easy to remove (uninstall) WeatherStudio from a computer, using its own uninstall-program, such as under C:\Program Files\WeatherStudio. Once WeatherStudio is removed, a browser returns to the prior display appearance, without the need to modify the browser settings.
- Zango
Zango, formerly ePIPO, 180solutions and Hotbar, was a software company that provided users access to its partners' videos, games, tools and utilities in exchange for viewing targeted advertising placed on their computers. Zango software is listed as adware by Symantec...
(formerly 180 Solutions) transmits detailed information to advertisers about the Web sites which users visit. It also alters HTTP requests for affiliateAffiliate marketing is a marketing practice in which a business rewards one or more affiliates for each visitor or customer brought about by the affiliate's own marketing efforts...
advertisements linked from a Web site, so that the advertisements make unearned profit for the 180 Solutions company. It opens pop-up ads that cover over the Web sites of competing companies (as seen in their [Zango End User License Agreement]).
- Zlob trojan
The Zlob Trojan, identified by some antiviruses as Trojan.Zlob, is a trojan horse which masquerades as a needed video codec in the form of ActiveX...
, or just Zlob, downloads itself to a computer via an ActiveXActiveX is a framework for defining reusable software components in a programming language-independent way. Software applications can then be composed from one or more of these components in order to provide their functionality....
codecA codec is a device or computer program capable of encoding or decoding a digital data stream or signal. The word codec is a portmanteau of "compressor-decompressor" or, more commonly, "coder-decoder"...
and reports information back to Control Server. Some information can be the search-history, the Websites visited, and even keystrokes. More recently, Zlob has been known to hijack routers set to defaults.
Criminal law
Unauthorized access to a computer is illegal under
computer crimeComputer crime, or cybercrime, refers to any crime that involves a computer and a network. The computer may have been used in the commission of a crime, or it may be the target. Netcrime refers to criminal exploitation of the Internet. Such crimes may threaten a nation’s security and financial health...
laws, such as the U.S.
Computer Fraud and Abuse ActThe Computer Fraud and Abuse Act is a law passed by the United States Congress in 1986, intended to reduce cracking of computer systems and to address federal computer-related offenses...
, the U.K.'s Computer Misuse Act, and similar laws in other countries. Since owners of computers infected with spyware generally claim that they never authorized the installation, a
prima faciePrima facie is a Latin expression meaning on its first encounter, first blush, or at first sight. The literal translation would be "at first face", from the feminine form of primus and facies , both in the ablative case. It is used in modern legal English to signify that on first examination, a...
reading would suggest that the promulgation of spyware would count as a criminal act. Law enforcement has often pursued the authors of other malware, particularly viruses. However, few spyware developers have been prosecuted, and many operate openly as strictly legitimate businesses, though some have faced lawsuits.
Spyware producers argue that, contrary to the users' claims, users do in fact give
consentConsent refers to the provision of approval or agreement, particularly and especially after thoughtful consideration.- Types of consent :*Implied consent is a controversial form of consent which is not expressly granted by a person, but rather inferred from a person's actions and the facts and...
to installations. Spyware that comes bundled with shareware applications may be described in the legalese text of an end-user license agreement (EULA). Many users habitually ignore these purported contracts, but spyware companies such as Claria say these demonstrate that users have consented.
Despite the ubiquity of EULAs and of "
clickwrapA clickwrap agreement is a common type of agreement often used in connection with software licenses. Such forms of agreement are mostly found on the Internet, as part of the installation process of many software packages, or in other circumstances where agreement is sought using electronic media...
" agreements, under which a single click can be taken as consent to the entire text, relatively little caselaw has resulted from their use. It has been established in most
common lawCommon law is law developed by judges through decisions of courts and similar tribunals rather than through legislative statutes or executive branch action...
jurisdictions that a clickwrap agreement can be a binding contract
in certain circumstances. This does not, however, mean that every such agreement is a
contractA contract is an agreement entered into by two parties or more with the intention of creating a legal obligation, which may have elements in writing. Contracts can be made orally. The remedy for breach of contract can be "damages" or compensation of money. In equity, the remedy can be specific...
, or that every term in one is enforceable.
Some jurisdictions, including the U.S. states of
IowaIowa is a state located in the Midwestern United States, an area often referred to as the "American Heartland". It derives its name from the Ioway people, one of the many American Indian tribes that occupied the state at the time of European exploration. Iowa was a part of the French colony of New...
and Washington, have passed laws criminalizing some forms of spyware. Such laws make it illegal for anyone other than the owner or operator of a computer to install software that alters Web-browser settings, monitors keystrokes, or disables computer-security software.
In the United States, lawmakers introduced a bill in 2005 entitled the
Internet Spyware Prevention ActThe Internet Spyware Prevention Act, also known as I-SPY, is an act by the United States Congress to impose penalties and punishments on creators of computer spyware. The act was first introduced in the House of Representatives in 2004 and passed in 2005...
, which would imprison creators of spyware.
US FTC actions
The US
Federal Trade CommissionThe Federal Trade Commission is an independent agency of the United States government, established in 1914 by the Federal Trade Commission Act...
has sued Internet marketing organizations under the "
unfairness doctrineThe unfairness doctrine is a doctrine in United States trade regulation law under which the Federal Trade Commission can declare a business practice “unfair” because it is oppressive or harmful to consumers even though the practice is not an antitrust violation, an incipient antitrust violation, a...
" to make them stop infecting consumers’ PCs with spyware. In one case, that against Seismic Entertainment Productions, the FTC accused the defendants of developing a program that seized control of PCs nationwide, infected them with spyware and other malicious software, bombarded them with a barrage of pop-up advertising for Seismic’s clients, exposed the PCs to security risks, and caused them to malfunction, slow down, and, at times, crash. Seismic then offered to sell the victims an “antispyware” program to fix the computers, and stop the popups and other problems that Seismic had caused. On November 21, 2006, a settlement was entered in federal court under which a $1.75 million judgment was imposed in one case and $1.86 million in another, but the defendants were insolvent
In a second case, brought against CyberSpy Software LLC, the FTC charged that CyberSpy marketed and sold "RemoteSpy" keylogger spyware to clients who would then secretly monitor unsuspecting consumers’ computers. According to the FTC, Cyberspy touted RemoteSpy as a “100% undetectable” way to “Spy on Anyone. From Anywhere.” The FTC has obtained a temporary order prohibiting the defendants from selling the software and disconnecting from the Internet any of their servers that collect, store, or provide access to information that this software has gathered. The case is still in its preliminary stages. A complaint filed by the
Electronic Privacy Information CenterElectronic Privacy Information Center is a public interest research group in Washington, D.C. It was established in 1994 to focus public attention on emerging civil liberties issues and to protect privacy, the First Amendment, and constitutional values in the information age...
(EPIC) brought the RemoteSpy software to the FTC’s attention.
Netherlands OPTA
An administrative fine, the first of its kind in Europe, has been issued by the Independent Authority of Posts and Telecommunications (OPTA) from the Netherlands. It applied fines in total value of Euro 1,000,000 for infecting 22 million computers. The spyware concerned is called DollarRevenue. The law articles that have been violated are art. 4.1 of the Decision on universal service providers and on the interests of end users; the fines have been issued based on art. 15.4 taken together with art. 15.10 of the Dutch telecommunications law. A part of these fines has to be paid personally by the directors of these companies, i.e. not from the accounts of their companies, but from their personal fortunes. Since an appeal has been lodged, the fines will have to be paid only after a Dutch law court makes a decision in this case. The culprits maintain that the evidence for violating the two law articles has been obtained illegally. The names of the directors and the names of the companies have not been revealed, since it is not clear that OPTA is allowed to make such information public.
Civil law
Former
New York State Attorney GeneralThe New York State Attorney General is the chief legal officer of the State of New York. The office has been in existence in some form since 1626, under the Dutch colonial government of New York.The current Attorney General is Eric Schneiderman...
and former
Governor of New YorkThe Governor of the State of New York is the chief executive of the State of New York. The governor is the head of the executive branch of New York's state government and the commander-in-chief of the state's military and naval forces. The officeholder is afforded the courtesy title of His/Her...
Eliot SpitzerEliot Laurence Spitzer is an American lawyer, former Democratic Party politician, and political commentator. He was the co-host of In the Arena, a talk-show and punditry forum broadcast on CNN until CNN cancelled his show in July of 2011...
has pursued spyware companies for fraudulent installation of software. In a suit brought in 2005 by Spitzer, the California firm Intermix Media, Inc. ended up settling, by agreeing to pay US$7.5 million and to stop distributing spyware.
The hijacking of Web advertisements has also led to litigation. In June 2002, a number of large Web publishers sued Claria for replacing advertisements, but settled out of court.
Courts have not yet had to decide whether advertisers can be held
liableLegal liability is the legal bound obligation to pay debts.* In law a person is said to be legally liable when they are financially and legally responsible for something. Legal liability concerns both civil law and criminal law. See Strict liability. Under English law, with the passing of the Theft...
for spyware that displays their ads. In many cases, the companies whose advertisements appear in spyware pop-ups do not directly do business with the spyware firm. Rather, they have contracted with an
advertising agencyAn advertising agency or ad agency is a service business dedicated to creating, planning and handling advertising for its clients. An ad agency is independent from the client and provides an outside point of view to the effort of selling the client's products or services...
, which in turn contracts with an online subcontractor who gets paid by the number of "impressions" or appearances of the advertisement. Some major firms such as Dell Computer and
Mercedes-BenzMercedes-Benz is a German manufacturer of automobiles, buses, coaches, and trucks. Mercedes-Benz is a division of its parent company, Daimler AG...
have sacked advertising agencies that have run their ads in spyware.
Libel suits by spyware developers
Litigation has gone both ways. Since "spyware" has become a common
pejorativePejoratives , including name slurs, are words or grammatical forms that connote negativity and express contempt or distaste. A term can be regarded as pejorative in some social groups but not in others, e.g., hacker is a term used for computer criminals as well as quick and clever computer experts...
, some makers have filed
libelDefamation—also called calumny, vilification, traducement, slander , and libel —is the communication of a statement that makes a claim, expressly stated or implied to be factual, that may give an individual, business, product, group, government, or nation a negative image...
and defamation actions when their products have been so described. In 2003, Gator (now known as Claria) filed suit against the website PC Pitstop for describing its program as "spyware". PC Pitstop settled, agreeing not to use the word "spyware", but continues to describe harm caused by the Gator/Claria software. As a result, other anti-spyware and anti-virus companies have also used other terms such as "
potentially unwanted programs" or greyware to denote these products.
WebcamGate
In the 2010 WebcamGate case, plaintiffs charged two suburban Philadelphia high schools secretly spied on students by surreptitiously and remotely activating webcams embedded in school-issued laptops the students were using at home, and therefore infringed on their privacy rights. The school loaded each student's computer with
LANrev'sAbsolute Manage is a systems lifecycle management software for system administrators which automates IT administration tasks. The product is composed of a server and client software that runs on Windows and Mac OS X....
remote activation tracking software. This included the now-discontinued "TheftTrack". While TheftTrack was not enabled by default on the software, the program allowed the school district to elect to activate it, and to choose which of the TheftTrack surveillance options the school wanted to enable.
TheftTrack allowed school district employees to secretly remotely activate a tiny webcam embedded in the student's laptop, above the laptop's screen. That allowed school officials to secretly take photos through the webcam, of whatever was in front of it and in its line of sight, and send the photos to the school's server. The LANrev software disabled the webcams for all other uses (
e.g., students were unable to use
Photo BoothPhoto Booth is a small software application for taking photos and videos with an iSight camera by Apple Inc. for Mac OS X and iOS .-Photo Booth:...
or video chat), so most students mistakenly believed their webcams did not work at all. In addition to webcam surveillance, TheftTrack allowed school officials to take screenshots, and send them to the school's server. In addition, LANrev allowed school officials to take snapshots of instant messages, web browsing, music playlists, and written compositions. The schools admitted to secretly snapping over 66,000 webshots and
screenshotA screenshot , screen capture , screen dump, screengrab , or print screen is an image taken by a computer to record the visible items displayed on the monitor, television, or another visual output device...
s, including webcam shots of students in their bedrooms.
Remedies and prevention
As the spyware threat has worsened, a number of techniques have emerged to counteract it. These include programs designed to remove or to block spyware, as well as various user practices which reduce the chance of getting spyware on a system.
Nonetheless, spyware remains a costly problem. When a large number of pieces of spyware have infected a Windows computer, the only remedy may involve backing up user data, and fully reinstalling the operating system. For instance, some versions of Vundo cannot be completely removed by Symantec, Microsoft, PC Tools, and others because it infects rootkit, Internet Explorer, and Windows' lsass.exe (Local Security Authority Subsystem Service) with a randomly-filenamed dll (dynamic link library).
Anti-spyware programs
Many programmers and some commercial firms have released products dedicated to remove or block spyware. Steve Gibson's
OptOut pioneered a growing category. Programs such as PC Tools'
Spyware DoctorSpyware Doctor is a spyware removal product for Microsoft Windows developed by PC Tools.-Features:Spyware Doctor is a program which scans a computer for spyware, examining files on the hard drive, objects in memory, the Windows registry, and cookies, and then attempts to quarantine or remove...
, Lavasoft's
Ad-Aware SE (free scans for non-commercial users, must pay for other features) and Patrick Kolla's
Spybot - Search & DestroySpybot Search & Destroy is a popular spyware and adware removal program compatible with Microsoft Windows 95 and later. It scans the computer hard disk and/or RAM for malicious software....
(all features free for non-commercial use) rapidly gained popularity as effective tools to remove, and in some cases intercept, spyware programs. On December 16, 2004,
MicrosoftMicrosoft Corporation is an American public multinational corporation headquartered in Redmond, Washington, USA that develops, manufactures, licenses, and supports a wide range of products and services predominantly related to computing through its various product divisions...
acquired the
GIANT AntiSpywareGIANT AntiSpyware was a spyware detection and removal application developed by GIANT Company Software, Inc.GIANT Company Software, Inc. was acquired by Microsoft Corporation on December 16, 2004...
software, rebranding it as
Windows AntiSpyware beta and releasing it as a free download for Genuine Windows XP and Windows 2003 users. In 2006,
MicrosoftMicrosoft Corporation is an American public multinational corporation headquartered in Redmond, Washington, USA that develops, manufactures, licenses, and supports a wide range of products and services predominantly related to computing through its various product divisions...
renamed the beta software to
Windows DefenderWindows Defender, formerly known as Microsoft AntiSpyware, is a software product from Microsoft to prevent, remove, and quarantine spyware in Microsoft Windows...
(free), and it was released as a free download in October 2006 and is included as standard with Windows Vista as well as Windows 7.
Major anti-virus firms such as
SymantecSymantec Corporation is the largest maker of security software for computers. The company is headquartered in Mountain View, California, and is a Fortune 500 company and a member of the S&P 500 stock market index.-History:...
,
PC ToolsPC Tools , formerly known as WinGuides.com, is a software company headquartered in Australia with offices in the USA, UK, Ireland and Ukraine. It develops and distributes security and optimization software for the Mac OS X and Microsoft Windows platforms. There are over 200 employees...
,
McAfeeMcAfee, Inc. is a computer security company headquartered in Santa Clara, California, USA. It markets software and services to home users, businesses and the public sector. On August 19, 2010, electronics company Intel agreed to purchase McAfee for $7.68 billion...
and
SophosSophos is a developer and vendor of security software and hardware, including anti-virus, anti-spyware, anti-spam, network access control, encryption software and data loss prevention for desktops, servers, email systems and other network gateways....
have come later to the table, adding anti-spyware features to their existing anti-virus products. Early on, anti-virus firms expressed reluctance to add anti-spyware functions, citing lawsuits brought by spyware authors against the authors of web sites and programs which described their products as "spyware". However, recent versions of these major firms' home and business anti-virus products do include anti-spyware functions, albeit treated differently from viruses. Symantec Anti-Virus, for instance, categorizes spyware programs as "extended threats" and now offers
real-time protectionReal-time protection, on-access scanning, background guard, resident shield, autoprotect, and other synonyms refer to the automatic protection provided by most antivirus, antispyware, and other antimalware programs, which is arguably their most important feature...
from them (as it does for viruses).
In June 2006, the anti-virus company Grisoft, creator of
AVG Anti-VirusAVG is a family of anti-virus and Internet security software for the Microsoft Windows, Linux, Mac OS X, and FreeBSD computing platforms, developed by AVG Technologies, a privately held Czech company formerly known as Grisoft.- History :...
, acquired anti-spyware firm Ewido Networks, re-labeling their Ewido anti-spyware program as AVG Anti-Spyware Professional Edition. AVG also used this product to add an integrated anti-spyware solution to some versions of the
AVG Anti-VirusAVG is a family of anti-virus and Internet security software for the Microsoft Windows, Linux, Mac OS X, and FreeBSD computing platforms, developed by AVG Technologies, a privately held Czech company formerly known as Grisoft.- History :...
family of products, and a
freewareFreeware is computer software that is available for use at no cost or for an optional fee, but usually with one or more restricted usage rights. Freeware is in contrast to commercial software, which is typically sold for profit, but might be distributed for a business or commercial purpose in the...
AVG Anti-Spyware Free Edition available for private and non-commercial use. This shows a trend by anti virus companies to launch a dedicated solution to spyware and malware. Zone Labs, creator of Zone Alarm
firewallA firewall is a device or set of devices designed to permit or deny network transmissions based upon a set of rules and is frequently used to protect networks from unauthorized access while permitting legitimate communications to pass....
have also released an anti-spyware program.
Anti-spyware programs can combat spyware in two ways:
- They can provide real time protection against the installation of spyware software on the computer. This type of spyware protection works the same way as that of anti-virus protection in that the anti-spyware software scans all incoming network data for spyware software and blocks any threats it comes across.
- Anti-spyware software programs can be used solely for detection and removal of spyware software that has already been installed onto the computer. This type of spyware protection is normally much easier to use and more popular. With this spyware protection software the user can schedule weekly, daily, or monthly scans of the computer to detect and remove any spyware software that have been installed on the computer. This type of anti-spyware software scans the contents of the windows registry, operating system files, and installed programs on the computer and will provide a list of any threats found, allowing the user to choose what to delete and what to keep.
Such programs inspect the contents of the Windows registry, the operating system files, and installed programs, and remove files and entries which match a list of known spyware components. Real-time protection from spyware works identically to real-time anti-virus protection: the software scans disk files at download time, and blocks the activity of components known to represent spyware. In some cases, it may also intercept attempts to install start-up items or to modify browser settings. Because many spyware and adware are installed as a result of browser exploits or user error, using security software (some of which are antispyware, though many are not) to
sandboxIn computer security, a sandbox is a security mechanism for separating running programs. It is often used to execute untested code, or untrusted programs from unverified third-parties, suppliers, untrusted users and untrusted websites....
browsers can also be effective to help restrict any damage done.
Earlier versions of anti-spyware programs focused chiefly on detection and removal. Javacool Software's
SpywareBlasterSpywareBlaster is a killbit program for Microsoft Windows designed to block the installation of ActiveX malware.-Features:SpywareBlaster blocks the installation of most ActiveX-based spyware, adware, browser hijackers, dialers and other unwanted programs from the user's computer...
, one of the first to offer real-time protection, blocked the installation of
ActiveXActiveX is a framework for defining reusable software components in a programming language-independent way. Software applications can then be composed from one or more of these components in order to provide their functionality....
-based and other spyware programs.
Like most anti-virus software, many anti-spyware/adware tools require a frequently-updated database of threats. As new spyware programs are released, anti-spyware developers discover and evaluate them, making "signatures" or "definitions" which allow the software to detect and remove the spyware. As a result, anti-spyware software is of limited usefulness without a regular source of updates. Some vendors provide a subscription-based update service, while others provide updates free. Updates may be installed automatically on a schedule or before doing a scan, or may be done manually.
Not all programs rely on updated definitions. Some programs rely partly (for instance many antispyware programs such as Windows Defender,
SpybotSpybot Search & Destroy is a popular spyware and adware removal program compatible with Microsoft Windows 95 and later. It scans the computer hard disk and/or RAM for malicious software....
's TeaTimer and Spysweeper) or fully (programs falling under the class of
HIPSIntrusion Prevention Systems , also known as Intrusion Detection and Prevention Systems , are network security appliances that monitor network and/or system activities for malicious activity. The main functions of intrusion prevention systems are to identify malicious activity, log information...
such as BillP's WinPatrol) on historical observation. They watch certain configuration parameters (such as certain portions of the Windows registry or browser configuration) and report any change to the user, without judgment or recommendation. While they do not rely on updated definitions, which may allow them to spot newer spyware, they can offer no guidance. The user is left to determine "what did I just do, and is this configuration change appropriate?"
Windows DefenderWindows Defender, formerly known as Microsoft AntiSpyware, is a software product from Microsoft to prevent, remove, and quarantine spyware in Microsoft Windows...
's SpyNet attempts to alleviate this through offering a community to share information, which helps guide both users, who can look at decisions made by others, and analysts, who can spot fast-spreading spyware. A popular generic spyware removal tool used by those with a certain degree of expertise is
HijackThisHijackThis is a freeware enumerating tool for Microsoft Windows originally created by Merijn Bellekom, and later sold to Trend Micro. The program is notable for targeting browser-hijacking methods, rather than relying on a database of known spyware. It scans a user's computer quickly, and displays...
, which scans certain areas of the Windows OS where spyware often resides and presents a list with items to delete manually. As most of the items are legitimate windows files/registry entries it is advised for those who are less knowledgeable on this subject to post a HijackThis log on the numerous antispyware sites and let the experts decide what to delete.
If a spyware program is not blocked and manages to get itself installed, it may resist attempts to terminate or uninstall it. Some programs work in pairs: when an anti-spyware scanner (or the user) terminates one running process, the other one respawns the killed program. Likewise, some spyware will detect attempts to remove registry keys and immediately add them again. Usually, booting the infected computer in
safe modeSafe mode is a diagnostic mode of a computer operating system . It can also refer to a mode of operation by application software. Safe mode is intended to fix most, if not all problems within an operating system...
allows an anti-spyware program a better chance of removing persistent spyware. Killing the process tree may also work.
A new breed of spyware (Look2Me spyware by NicTechNetworks is a good example) hides inside system-critical processes and start up even in safe mode, see
rootkitA rootkit is software that enables continued privileged access to a computer while actively hiding its presence from administrators by subverting standard operating system functionality or other applications...
. With no process to terminate they are harder to detect and remove. Sometimes they do not even leave any on-disk signatures.
RootkitA rootkit is software that enables continued privileged access to a computer while actively hiding its presence from administrators by subverting standard operating system functionality or other applications...
technology is also seeing increasing use, as is the use of
NTFSNTFS is the standard file system of Windows NT, including its later versions Windows 2000, Windows XP, Windows Server 2003, Windows Server 2008, Windows Vista, and Windows 7....
alternate data streamsIn a computer file system, a fork is byte stream associated with a file system object. Every non-empty file must have at least one fork, and depending on the file system, a file may have one or more other associated forks, which in turn may contain primary data integral to the file, or just metadata...
. Newer spyware programs also have specific countermeasures against well known anti-malware products and may prevent them from running or being installed, or even uninstall them. An example of one that uses all three methods is Gromozon, a new breed of malware. It uses alternate data streams to hide. A
rootkitA rootkit is software that enables continued privileged access to a computer while actively hiding its presence from administrators by subverting standard operating system functionality or other applications...
hides it even from alternate data streams scanners and actively stops popular
rootkitA rootkit is software that enables continued privileged access to a computer while actively hiding its presence from administrators by subverting standard operating system functionality or other applications...
scanners from running.
Security practices
To detect spyware, computer users have found several practices useful in addition to installing anti-spyware programs.
Many system operators install a
web browserA web browser is a software application for retrieving, presenting, and traversing information resources on the World Wide Web. An information resource is identified by a Uniform Resource Identifier and may be a web page, image, video, or other piece of content...
other than IE, such as
OperaOpera is a web browser and Internet suite developed by Opera Software with over 200 million users worldwide. The browser handles common Internet-related tasks such as displaying web sites, sending and receiving e-mail messages, managing contacts, chatting on IRC, downloading files via BitTorrent,...
,
Google ChromeGoogle Chrome is a web browser developed by Google that uses the WebKit layout engine. It was first released as a beta version for Microsoft Windows on September 2, 2008, and the public stable release was on December 11, 2008. The name is derived from the graphical user interface frame, or...
or
Mozilla FirefoxMozilla Firefox is a free and open source web browser descended from the Mozilla Application Suite and managed by Mozilla Corporation. , Firefox is the second most widely used browser, with approximately 25% of worldwide usage share of web browsers...
. Though no browser is completely safe, Internet Explorer is at a greater risk for spyware infection due to its large user base as well as vulnerabilities such as
ActiveXActiveX is a framework for defining reusable software components in a programming language-independent way. Software applications can then be composed from one or more of these components in order to provide their functionality....
.
Some ISPs—particularly
collegeA college is an educational institution or a constituent part of an educational institution. Usage varies in English-speaking nations...
s and universities—have taken a different approach to blocking spyware: they use their network firewalls and web proxies to block access to Web sites known to install spyware. On March 31, 2005,
Cornell UniversityCornell University is an Ivy League university located in Ithaca, New York, United States. It is a private land-grant university, receiving annual funding from the State of New York for certain educational missions...
's Information Technology department released a report detailing the behavior of one particular piece of proxy-based spyware,
Marketscore, and the steps the university took to intercept it. Many other educational institutions have taken similar steps. Spyware programs which redirect network traffic cause greater technical-support problems than programs which merely display ads or monitor users' behavior, and so may more readily attract institutional attention.
Some users install a large
hosts fileThe hosts file is a computer file used in an operating system to map hostnames to IP addresses. The hosts file is a plain-text file and is conventionally named hosts.-Purpose:...
which prevents the user's computer from connecting to known spyware-related web addresses. However, by connecting to the numeric IP address, rather than the domain name, spyware may bypass this sort of protection.
Spyware may get installed via certain
sharewareThe term shareware is a proprietary software that is provided to users without payment on a trial basis and is often limited by any combination of functionality, availability, or convenience. Shareware is often offered as a download from an Internet website or as a compact disc included with a...
programs offered for download. Downloading programs only from reputable sources can provide some protection from this source of attack. Recently,
CNetCNET is a tech media website that publishes news articles, blogs, and podcasts on technology and consumer electronics. Originally founded in 1994 by Halsey Minor and Shelby Bonnie, it was the flagship brand of CNET Networks and became a brand of CBS Interactive through CNET Networks' acquisition...
revamped its download directory: it has stated that it will only keep files that pass inspection by Ad-Aware and
Spyware DoctorSpyware Doctor is a spyware removal product for Microsoft Windows developed by PC Tools.-Features:Spyware Doctor is a program which scans a computer for spyware, examining files on the hard drive, objects in memory, the Windows registry, and cookies, and then attempts to quarantine or remove...
.
The first step to removing spyware is to put a computer on "lockdown". This can be done in various ways, such as using anti-virus software or simply disconnecting the computer from the internet. Disconnecting the internet prevents controllers of the spyware from being able to remotely control or access the computer. The second step to removing the spyware is to locate it and remove it, manually or through use of credible anti-spyware software. During and after lockdown, potentially threatening websites should be avoided.
Programs distributed with spyware
- Bonzi Buddy
- Dope Wars
- EDonkey2000
eDonkey2000 was a peer-to-peer file sharing application developed by US company MetaMachine, using the Multisource File Transfer Protocol...
- Grokster
Grokster Ltd. was a privately owned software company based in Nevis, West Indies that created the Grokster peer-to-peer file-sharing client in 2001 that utilized the FastTrack protocol. Grokster Ltd. was rendered extinct in late 2005 by the United States Supreme Court's decision in MGM Studios,...
- Kazaa
Kazaa Media Desktop started as a peer-to-peer file sharing application using the FastTrack protocol licensed by Joltid Ltd. and operated as Kazaa by Sharman Networks...
- Morpheus
Morpheus was a file sharing and searching peer-to-peer client for Microsoft Windows, developed and distributed by the company StreamCast, that originally used the Opennap protocol, but later supported many different peer-to-peer protocols...
- Printable-Greetings (computer program) "http://www.printable-greetings.com" ESET: Win32/AdWare.FunWeb application
- RadLight
- WeatherBug
WeatherBug is a brand owned by Earth Networks, Ask.com and IAC/InterActiveCorp based in Germantown, Maryland, that provides live weather data and maintains continuously monitored weather stations throughout the United States, mainly located at public and private schools, educational institutions...
- WildTangent
WildTangent is a Redmond, Washington based game network, privately held in the United States that powers game services for several PC manufacturers including HP, Dell, Toshiba, Gateway, Samsung, Acer and Lenovo...
Programs formerly distributed with spyware
- AOL Instant Messenger
AOL Instant Messenger is an instant messaging and presence computer program which uses the proprietary OSCAR instant messaging protocol and the TOC protocol to allow registered users to communicate in real time. It was released by AOL in May 1997...
(AOL Instant Messenger still packages Viewpoint Media Player, and WildTangent)
- DivX
DivX is a brand name of products created by DivX, Inc. , including the DivX Codec which has become popular due to its ability to compress lengthy video segments into small sizes while maintaining relatively high visual quality.There are two DivX codecs; the regular MPEG-4 Part 2 DivX codec and the...
- FlashGet
FlashGet is a freeware download manager for Microsoft Windows...
- magicJack
MagicJack is a device that plugs into a USB port on the user's computer and that has a standard RJ-11 phone jack into which any standard phone can be plugged. This allows the user to make phone calls to almost any phone in the U.S...
Rogue anti-spyware programs
Malicious programmers have released a large number of rogue (fake) anti-spyware programs, and widely distributed Web banner ads now spuriously warn users that their computers have been infected with spyware, directing them to purchase programs which do not actually remove spyware—or else, may add more spyware of their own.
The proliferation of fake or spoofed antivirus products has occasioned some concern. Such products often bill themselves as antispyware, antivirus, or registry cleaners, and sometimes feature popups prompting users to install them. This software is called
rogue softwareRogue security software is a form of computer malware that deceives or misleads users into paying for the fake or simulated removal of malware, or that installs other malware...
.
It is recommended that users do not install any freeware claiming to be anti-spyware unless it is verified to be legitimate. Some known offenders include:
- AntiVirus 360
- Antivirus 2008
- Antivirus 2009
- AntiVirus Gold
AntiVirus Gold is rogue software developed by ICommerce Solutions S.A. that poses as a legitimate antivirus program. It attempts to persuade users to buy the software by displaying ads and other nagware...
- ContraVirus
ContraVirus is a Rogue Spyware application that poses as a legitimate anti-spyware program. The application uses a false scanner to force computer users to pay for the removal of non-existent spyware items. It may also be known as ExpertAntivirus....
- MacSweeper
MacSweeper is a rogue application that misleads users by exaggerating reports about spyware, adware or viruses on their computer. It is the first known "rogue" application for the Mac OS X operating system...
- Pest Trap
- PSGuard
- Spy Wiper
- Spydawn
- Spylocked
SpyLocked, also known as SpywareLocked, is rogue software that seeks to trick the user into purchasing its full rogue version. SpyLocked issues false security messages alleging that the user's computer is infected with malicious spyware...
- Spysheriff
SpySheriff is malware that disguises itself as an anti-spyware program. SpySheriff is also known as Brave Sentry, Pest Trap, SpyTrooper, and SpywareNo. The program attempts to trick the user of an infected computer into buying the program by repeatedly informing them of false threats to their system...
- SpyShredder
- Spyware Quake
- SpywareStrike
SpywareStrike is a fake anti-spyware program for Microsoft Windows. It is similar in operation to SpySheriff....
- UltimateCleaner
UltimateCleaner 2007 was a rogue anti-spyware program that created fake Windows security messages and other security warnings in order to trick users into believing that computer was infected with spyware threats and that they needed to purchase the full version of UltimateCleaner 2007 to remove...
- WinAntiVirus Pro 2006
- Windows Police Pro
Windows Police Pro is a rogue antivirus program that displays false scan reports intended to convince the user that his or her computer is infected with various forms of malware. This misleading software will tell the user that he or she needs to purchase the full version of the software to remove...
- WinFixer
WinFixerAlso known under various other names including: WinAntiVirusPro, ErrorSafe, SystemDoctor, WinAntiSpyware, AVSystemCare, WinAntiSpy, Windows Police Pro, Performance Optimizer, StorageProtector, PrivacyProtector, WinReanimator, DriveCleaner, WinspywareProtect, PCTurboPro, FreePCSecure,...
- WorldAntiSpy
- XP Security
Fake antivirus products constitute 15 percent of all malware.
On January 26, 2006, Microsoft and the Washington state attorney general filed suit against Secure Computer for its Spyware Cleaner product.
On December 4, 2006, the Washington attorney general announced that Secure Computer had paid $1 million to settle with the state. As of that date, Microsoft's case against Secure Computer remained pending.
See also
- Computer insecurity
Computer insecurity refers to the concept that a computer system is always vulnerable to attack, and that this fact creates a constant battle between those looking to improve security, and those looking to circumvent security.-Security and systems design:...
- Computer surveillance
Computer surveillance is the act of performing surveillance of computer activity, and of data stored on a hard drive or being transferred over the Internet....
- Cyber spying
Cyber spying or Cyber espionage is the act or practice of obtaining secrets without the permission of the holder of the information , from individuals, competitors, rivals, groups, governments and enemies for personal, economic, political or military advantage using illegal exploitation methods on...
- Defensive computing
Defensive computing is a form of practice for computer users to help reduce the risk of computing problems, by avoiding dangerous computing practices. The primary goal of this method of computing is to be able to anticipate and prepare for potentially problematic situations prior to their...
- Employee monitoring software
Employee monitoring software is a means of employee monitoring, and allows company administrators to monitor and supervise all their employee computers from a central location...
- Industrial espionage
Industrial espionage, economic espionage or corporate espionage is a form of espionage conducted for commercial purposes instead of purely national security purposes...
- Phoning home
Phoning home, in computing, refers to an act of client to server communication where a client device or client application software reports its location on a network, the currently logged on user, or any other information to a server computer...
- Spy-phishing
Spy-phishing is a term coined by Jeffrey Aboud of Trend Micro at the Virus Bulletin 2006 conference in Montreal.Defined as "crimeware" , spy-phishing capitalizes on the trend of "blended threats", it borrows techniques from both phishing and spyware...
External links
- StopBadware.org — A non-profit group (sponsored by Google, , and Sun) that aims to provide "reliable, objective information about downloadable applications".