Defining spyware and adware

The Microsoft security team has published an exhaustive white paper on the definitions of spyware and adware :

Unlike other forms of software, which tend to either be “good” or “bad,” spyware often exists in shades of “gray.” With the exception of malicious behaviors, many of the behaviors could have legitimate purposes. The potential for harm and disruption to the user’s PC experience depends on the specific behaviors demonstrated by a given program.

As a result, software classifications in the definition library for Windows AntiSpyware (Beta) not only capture the type of program (e.g., “adware,” “software bundler,” “browser modifier,” etc.) but also the degree of risk posed to the user. This is then communicated to the user, along with a recommended action. In Windows AntiSpyware (Beta), the user always has the ability to choose for themselves whether they want to “Always Ignore,” “Ignore,” “Quarantine,” or “Remove” a given program.

This is very, very thorough. I’ll read it more closely for sure.

(Thanks to Larry Seltzer and Alex Eckelberry for the pointer.)

Spyware via Firefox? It’s true.

Last weekend I passed along sketchy details of a news report that claimed spyware purveyors have found a way to get to Windows users even when they use Firefox as their primary browser. I’ve now had a chance to test this claim and I can report that it’s true.

The original article included enough details to help me track down the seemingly legitimate Web site that’s distributing this stuff. Like so many of these sites, it offers content designed to attract young people – in this case, a library of song lyrics. I visited the site using both Internet Explorer and Firefox. The results were surprising.

Continue reading “Spyware via Firefox? It’s true.” →

Why you can’t count on the government to stop spyware

Last week, the Federal Trade Commission released a 62-page staff report on spyware (PDF version here). The conclusions are sound, the writing is crystal clear, and there are excellent recommendations in the report. The brief press release summarizes the issues well:

Based on discussions at the workshop and more than 750 comments submitted to supplement the workshop record, the FTC staff has concluded that spyware is a real and growing problem and that spyware can impair the operation of computers and create substantial privacy and security risks for consumers’ information.

[…]

[T]he problems caused by spyware can be reduced if the private sector and the government take action. The report suggests that technological solutions – firewalls, anti-spyware software, and improved browsers and operating systems – can provide significant protection to consumers from the risks related to spyware. The report recommends that industry identify what constitutes spyware and how information about spyware should be disclosed to consumers; expand efforts to educate consumers about spyware risks; and assist law enforcement. The report further recommends that the government increase criminal and civil prosecution under existing laws of those who distribute spyware and increase efforts to educate consumers about the risks of spyware.

So what’s the problem? This report was issued in March 2005. It was based on a one-day workshop held in April 2004. When it takes 11 months just to publish a report, you know you’re dealing with a bureaucracy that simply doesn’t know how to respond to a “real and growing problem.”

P2P programs spread spyware. Here’s the proof.

Ben Edelman has done an epic research project to establish just how bad most peer-to-peer file-sharing programs are. In What P2P Programs Install What Spyware? he looks at five extremely popular programs:

Request a peer-to-peer filesharing program, and you may be surprised what else gets installed too. I’ve tested five major P2P programs and analyzed their bundled software. Licenses stretch to as long as 22,000+ words and 180+ on-screen pages. Some P2P apps add additional programs disclosed only in license agreement scroll boxes. And it’s not uncommon for a P2P app to create thousands of registry entries.

The full test results prove in nearly clinical detail what you probably already suspected. Kazaa, Morpheus, iMesh, and eDonkey are riddled with bundled software that tracks your Web-browsing activity and shows ads in or around your Web browser. Kazaa’s license is the antithesis of transparency – if you want to read all 22,606 words you’ll need to hit the Page Down key 182 times.

Surprisingly, Limewire (which paid for Ben’s research) was the only program that installed no third-party software except the Java run-time engine, and whose only ads are for its paid version.

Excellent work.

Spyware in Firefox?

Vitalsecurity.org has an interesting report of a potential spyware/adware infestation that directly attacks Firefox users, using the Sun Java Virtual Machine as its installation engine. (In the comments, a security expert from the Mozilla Foundation notes that this exploit could attack Opera users as well.)

I’ll look at this in more detail when I get back in the office.

How to fumble a security update

Microsoft’s response to the current flap over “poisoned” Windows Media files is a case study in how not to respond to a security issue. On February 15, Microsoft issued two updates to Windows Media Player 10 – a comprehensive roll-up that changes the version number from 3646 to 3802, and a smaller patch that reportedly adds “additional integrity checks to the DRM [digital rights management] system.” Members of the company’s public relations team then made the rounds of the mainstream PC press announcing that the problem was solved.

No, it wasn’t. Based on my analysis, the current “fix” is inadequate, and many if not most Windows users remain unprotected from an important security flaw.

Continue reading “How to fumble a security update” →

An update on the Windows Media Player security snafu

eWeek’s Ryan Naraine has an excellent update on the “poisoned Windows Media files” controversy that I’ve been covering here for the past few weeks. (See this post for a roundup of the confusion over the WMP10 update; and see “Someone at Microsoft doesn’t get it,” which I posted on January 14, for details on the problem itself and Microsoft’s response.) Ryan writes:

Redmond has hemmed and hawed on its response to the threat and the circumstances of the latest admission isn’t sitting well with security researchers.

When the first red flag was raised in early January, Microsoft made it clear that the use of rigged .wmv files to exploit the DRM (digital rights management) mechanism was not a software flaw.

A week later, the company reversed course and promised new versions of WMP within 30 days. “While this issue is not the result of any exploit of Windows Media DRM, we do recognize it may cause problems for some of our customers,” the company said in a statement. To help mitigate these problems, Microsoft said the software would be tweaked to “allow the end-user more control over when and how any pop-ups display in the license acquisition process.”

I’ve just re-tested some samples of the infected Windows Media files using the latest build of Windows Media Player 10. I can’t see any difference in behavior. Meanwhile, as Ben Edelman has already documented, anyone using Windows Media Player 9 Series is still at risk, and the Windows Media Player 10 update is not listed as a Critical Update. Microsoft now says they will issue a “down-level patch” for Windows Media Player 9 users. No word on when it will be available.

Ben and I are quoted extensively in this story. As I told eWeek, I can’t figure out why no one from Microsoft bothered to call or e-mail Ben, Eric L. Howes, or me, back in January, when all of us had conducted extensive tests and published our findings. I’m also baffled that Microsoft’s Security Response Center hasn’t taken ownership of this problem. As I told eWeek, “If Windows Media Player is going to be a part of the operating system, it has to play by the same rules as the rest of the Windows team.” That means taking reports like this one seriously and making sure the update actually fixes the problem.

iDownload: Follow the money

Yesterday I published two articles about iDownload.com, a company that makes a product called iSearch, which is installed using deceptive techniques. The company has recently sent cease-and-desist letters to the owners of several Web sites that referred to iSearch as “spyware” or “malware.” It also makes commercial security products, including Virus Hunter, which it sells using questionable techniques.

This morning I read the latest issue of the Windows Secret newsletter, which leads with an article by Brian Livingston that neatly sums up the issues with iDownload. I’ve done some of my own investigations, and the details collectively add up to a picture of exactly how the makers of this type of software get rich by preying on the innocent.

Continue reading “iDownload: Follow the money” →

Kids’ laptop riddled with spyware!

I was depressed to read this post from a Microsoft blogger who claims to be involved with security: Argh! Kids’ laptop riddled with spyware!

I downloaded the current beta version of MS’ new Anti-SpyWare tool yesterday and installed it on my kids’ laptop. When I ran the scan, I found something like 16 different types of SpyWare installed. The trigger was starting up IE on the machine and being greeted with something called the “Megasearch” tool bar!

I can say that the new Anti-SpyWare tool seems to do a really good job. Of course with SpyWare, you don’t know what you don’t know. There could be another dozen SpyWare packages installed on my system that the tool didn’t detect, but at least I know I got some. Oh well, what are you going to do?…

Jeebus, the last thing I want to hear from someone who works at Microsoft is this sort of defeatist attitude. Especially when they’re involved in security. What are you going to do? Back up the kid’s data. Wipe the hard disk and reinstall Windows and all programs. Set up safeguards to make sure no unwanted programs get installed again. Ban Kazaa and anything lke it. Give the kid a Limited user account.

It works.

Support the fight against spyware

This makes my blood boil. At Spyware Warrior, Suzi just posted the full text of a letter she received from the legal counsel for iDownload. They’re demanding that she remove pages that refer to their product as spyware and/or malware. Suzi says:

As owner of this domain, netrn.net, the home of this blog, I am currently obtaining legal counsel and evaluating my options. I will post additional details as they develop.

I have firsthand experience with this company’s products. When I was doing testing for a post on “poisoned media files” I ran across a Windows Media video file that attempted to install the iDownload product on my computer. The ActiveX dialog box called it a “Required: Media Player Version 9 Update.” It is, of course, no such thing. That description is an out-and-out lie. Eric L. Howes documented the installation process at Broadband Reports and captured the following screen:

Legal bills are expensive. Even when you’re right, you can go bankrupt just protecting yourself and your good name. Which is why I just clicked the PayPal Donate button on Suzi’s blog and sent her some financial support.

This appears to be an orchestrated campaign to stifle all criticism of this company, because the same legal team sent a nearly identical letter to CastleCops.com as well. In addition, someone recently targeted anti-spyware activist Ben Edelman’s site for a massive denial-of-service attack.

Is iDownload’s software bad for you? I don’t have enough personal knowledge to say. But many authoritative sources seem to believe it is so.

Symantec, an acknowledged leader in the security software industry and maker of Norton AntiVirus, unequivocally labels iDownload’s iSearch Toolbar as “spyware.” The Symantec listing describes its behavior as follows: “Spyware.ISearch is an Internet Explorer Browser Helper Object and functions as a toolbar. It is a search hijacker and also tracks user activity on a remote server at isearch.com.”
Trend Micro, a respected maker of AntiVirus software, calls the iDownload.com product Adware. Its description begins: “This adware may be downloaded while browsing the Internet without a user’s consent. It attempts to block popup windows and redirect a browser to its server, which is http://www.isearch.com.”
Tenebril, a respected maker of security software, lists iSearch in its Spyware Research Center. Its description says, “ This is a hijacker application. Hijackers take control of your web browser’s settings, and usually change your homepage, search page or other default pages to point to web sites owned by the hijacker. Since the hijackers can make money just based on the number of visits to their web sites, they benefit from forcing you to view their web sites each time your web browser opens.”
The database at Spywaredata.com includes seven instances of iDownload’s toolbar.dll, all of them classified under the parasite label.

The license agreement for the iSearch software includes the following text:

By installing the Software, you understand and agree that the Software may, without any further prior notice to you, automatically perform the following: display advertisements of advertisers who pay a fee to iSearch and/or it’s partners, in the form of pop-up ads, pop-under ads, interstitials ads and various other ad formats, display links to and advertisements of related websites based on the information you view and the websites you visit; store non-personally identifiable statistics of the websites you have visited; redirect certain URLs including your browser default 404-error page to or through the Software; provide advertisements, links or information in response to search terms you use at third-party websites; provide search functionality or capabilities; automatically update the Software and install added features or functionality or additional software, including search clients and toolbars, conveniently without your input or interaction; install desktop icons and installation files; install software from iSearch affiliates; and install Third Party Software.

In addition, you further understand and agree, by installing the Software, that iSearch and/or the Software may, without any further prior notice to you, remove, disable or render inoperative other adware programs resident on your computer, which, in turn, may disable or render inoperative, other software resident on your computer, including software bundled with such adware, or have other adverse impacts on your computer.

This company lies when it offers the software to an unsuspecting user. The license agreement this company wrote, which they know the average user will not read, admits that the software may install additional software or remove programs already on your computer without your knowledge or input (or obviously, your consent). And the company freely admits that its software may have “other adverse impacts on your computer.”

Does this sound like a program you want to install?

Please, support Suzi. Click the PayPal Donate button on Suzi’s blog and help her out.

Updated: Suzi responds to iDownload.