Joel Spolsky of Joel on Software is rightly considered one of the smartest developers around. When he writes something, it gets read – especially in Redmond. So his remarks yesterday on Microsoft AntiSpyware deserve a fair parsing:

So far, it looks like this is a nifty program, and consumers should be happy that Microsoft has announced it will be free, but it really, really would have been nice for us here in the software industry if Microsoft had set a price on this thing just to provide some air cover for the other companies working on spyware removal. This is not a software category where a monopoly monoculture will be a good thing.

I think he got this one wrong on two counts. First, the antispyware industry has already established itself as a category where most programs are free. Ad-Aware and Spybot S&D are the two most widely used utilities. Lavasoft, which makes Ad-Aware, has a free version that is presumably its most popular product; Patrick M. Kolla, developer of Spybot S&D, gives the program away for free. There are paid antispyware programs (most notably PestPatrol) but increasingly antispyware features are being folded into larger security suites as added features. Both Symantec and Trend Micro have begun adding spyware detection and removal features to their flagship antivirus programs, for instance.

Which leads me to my second point: Antispyware software should be free. There are gazillions of unethical companies out there that make a living selling deceptive programs that fool unsuspecting users into paying for their worthless “protection” by falsely detecting threats where none exist. When this type of software is a profitable category, it encourages companies to use hype and scare tactics to create threats where none exist.

Joel continues:

Not only that, but I wonder if Microsoft can run an antispyware product without huge conflicts of interest. For example, will they block all the spyware that Real installs on your system? While Real is suing them? Especially when blocking spyware from Real will just give Real more ammunition to use against Microsoft in court? And the next time Microsoft needs a DRM favor from your friendly neighborhood media conglomerate, will the media conglomerate demand exemption from Antispyware removal for their adware in exchange for supporting Windows Media 37.0, with the new brain-zapping feature that prevents you from humming any song unless you bought the performance rights?

Well, that’s a problem already with the the “free” product, as Lavasoft and PestPatrol discovered earlier this week when they removed one widely derided adware program (WhenU) without alerting users.

There’s always going to be suspicion when a single company is making go/no-go decisions on whether a program should be considered a threat or benign. That’s why I like the community-based approach introduced by GIANT AntiSpyware (the original developer of the antispyware product that Microsoft purchased). Microsoft has committed to keeping the SpyNet community as a key part of the final release.

I would like to see as much transparency as possible from all security vendors, especially when you’re talking about products that are legal but unethical. The products in this category aren’t viruses, pushed into the world by anonymous vandals. These are typically commercial products, released by identified companies. The bar to removal should be high (although the user should be able to make the level of protection more stringent). One thing I like about Microsoft AntiSpyware is that it is first and foremost a preventive measure. It alerts you when a program is trying to sneak an auto-starting module into the Registry or change your home page, and it gives you the power to stop damage before it can occur. The real problem with spyware comes when it sneaks onto a computer. Anything that Microsoft can do to prevent Windows from being misused in this fashion is a Good Thing.

If you’re using the beta release of Windows AntiSpyware, be sure to get the latest update:

Since releasing Windows AntiSpyware (Beta) on January 6, 2005, we have received feedback from customers and have made enhancements to the software based on this feedback. We have enhanced some of the real-time protection agents, added new threat categories, and improved stability and performance. If you are using a previous version you can simply upgrade to the refreshed version.

I haven’t looked carefully at this yet, but based on the description it sounds like a fairly modest update.

Ben Edelman explains How VeriSign Could Stop Drive-By Downloads. VeriSign, in case you don’t recognize the name, is the company that controls 95% of the digital certificates used on the Internet today. These certificates are passed out like bubble gum cards to any company that has an address and a check (typically between $200 and $600) for the certificate registration fee. When you visit a Web site that wants to install an ActiveX control on your computer to extend the capabilities of Internet Explorer, VeriSign gets involved by displaying information contained in the official record for the company’s digital signature.

There are countless legitimate and ethical companies that use ActiveX technology for good purposes. Unfortunately, there’s also a disproportionately active community of scammers and charlatans intent on exploiting the trust that is implicit in a digital signature. An enormous amount of crapware has been dumped onto countless computers by this latter group, who use ActiveX permission dialog boxes to sucker unwitting users into “agreeing” to install software that they invariably regret later.

If VeriSign chose to enforce its license agreements, it could revoke the certificates of those companies that misuse the trust they inherit through a digital certificate. And without a certificate, virtually all versions of Windows will reject the proposed software cold, without subjecting the user to a misleading prompt. Ben explains:

Through existing software systems, already built into Internet Explorer and already implemented by VeriSign servers, VeriSign has the ability to revoke any certificate it has previously issued, disabling ActiveX installations that use that certificate. See VeriSign’s Certificate Revocation List server (crl.verisign.com) and Microsoft Certificates documentation of the revocation system.

I suggest that VeriSign can and should use its existing certificate revocation system to disable those certificates issued or used in violation of applicable VeriSign rules.

Ben documents three products that clearly violate the VeriSign contract. After presenting the proof, he writes:

Each of these misleading installations is contrary to VeriSign contract, contrary to VeriSign’s duty to its users, and contrary to VeriSign’s many promises of trustworthiness. In the first installer, VeriSign affirmatively certified the “click yes to continue” company name — although it seems that there exists no company by that name, and although that company name is facially misleading as to the purpose of the installation prompt. In the second and third examples, VeriSign certified companies that subsequently used VeriSign’s certification as a necessary step in deceiving users as to the function of and (alleged) need for their programs.

Given VeriSign’s claims (such as its old motto, “the value of trust”), VeriSign should want to put an end to these practices. When VeriSign certificates are issued wrongfully (as in the first example) or are used deceptively (as in the second and third), VeriSign should take action to protect users from being tricked. In particular, when an application offers a facially invalid and misleading company name, VeriSign should refuse to issue the requested certificate. When an applicant violates basic standards of truth-telling and fair dealing, VeriSign should revoke any certificates previously issued to that applicant.

Read Ben’s article. If you think VeriSign should follow through on its responsibility to you and me as users of their digital signature technology, why not give CEO Stratton Sclavos a call at 650-961-7500? If he’s not there, ask for Judy Lin, Executive Vice President, Security Services. (If anyone has a good e-mail address for either of these individuals, let me know and I’ll update this post.) Update: Send your e-mail to stratton@verisign.com.

And spread the link to this post and to Ben’s article. There’s nothing like a little publicity to help big companies like VeriSign understand their responsibilities to their ultimate customers – us.

Last week, in “Ten things you need to know about spyware,” I got some vigorous disagreement with two items on my list. It was good feedback, so I wanted to revisit both issues. In item #4, I wrote: “If you have to scan your system for spyware every week, you’re doing something wrong. … Running a weekly scan is probably not a bad idea, from a belt-and-suspenders point of view. But it shouldn’t be necessary…”

Suzi at Spyware Warrior took issue with that statement:

Well, perhaps for knowledgable users who understand how to protect their computers, that might be true. Truth be told, I don’t scan my computer very often, but that’s because I know exactly what’s going into and and leaving it all the time. How many users can say that? A very small percentage of current internet users, I’d say. Pehaps Ed’s blog is targeted to savvy users, I don’t know. For the average user, I’d certainly recommend scanning at least few days, maybe every day for frequent web flyers. An exception would be for users surfing with an alternative browser such as Firefox or Opera.

I think we’re closer to agreeing on this issue than it might sound at first. Suzi doesn’t need to scan her computer regularly, because she knows exactly what’s going into and leaving her computer at any time. So do I. So does my co-author Carl. So do friends and clients of mine who have asked for my help in keeping their systems free of spyware and viruses. And so can anyone who is willing to learn about the problem of spyware. If you incorporate some basic technological solutions and modify your behavior using common-sense guidelines, you can keep your PC spyware-free. (See “Six steps you can take to block unwanted software” for more details.)

But simply installing an anti-spyware program (or two or three) on an average user’s computer and telling them to scan daily or weekly isn’t enough unless you also train them in effective techniques for keeping crapware at bay. If you do that job right, the clean spyware scan becomes the weekly report card that proves they learned the lesson.

I have Microsoft AntiSpyware Beta 1 installed here and I allow it to do its nightly scan. It’s unobtrusive and the only real side effect is a dialog box that I need to dismiss each morning. It never finds anything. Over the past few months, during the course of researching the upcoming Windows Networking and Security Inside Out, I’ve experimented with just about every available anti-spyware program. They never find anything except cookies (which are not spyware and can easily be managed) and false positives.

Look, I have antivirus software on my computer. It’s constantly intercepting and quarantining infected attachments that arrive via e-mail. Every week, the antivirus program scans my system to verify that I am not infected with any viruses. It never finds anything. If it does, I know I have a serious problem and that I need to figure out how the unwanted software slipped past my defenses. The same is true with spyware. If your weekly scan reveals that you’ve picked up an unwanted and potentially hostile program, you need to remove it. And then you need to figure out how it got there and fix your defenses so it doesn’t happen again.

So, based on Suzi’s feedback, I’m changing item #4 to read: “If you have to scan your system for spyware and remove unwanted programs every week, you’re doing something wrong.”

In a follow-up post, I’ll address the controversy over how many spyware scanners you should use. One, two, as many as it takes?

Last week, I published “Ten things you need to know about spyware” and got some great feedback. Today, I’m following up with some advice on how you can prevent unwanted software from ending up on your PC in the first place. This piece, like the last one, is an extremely condensed (and preliminary) version of content that will appear in an updated version of Windows Security Inside Out, which is due to be published this spring.

As I noted last week, trying to remove spyware/adware/viruses is a difficult proposition. You’re much better off if you can prevent an unwanted program from being installed in the first place. This is the advice I give to clients in my consulting practice, and it’s been successful. If you follow this advice, your likelihood of being attacked should drop to nearly zero.

If you have comments or questions, add them in the comments or create an entry on your own site and give me a trackback link. The list appears in the full version of this post. (If you’re reading this in Bloglines or another reader that doesn’t properly handle extended posts, click here to continue.)

Continue reading “Six steps you can take to block unwanted software” →

Update: I’ve made some small but significant changes to this list based on excellent feedback from the anti-spyware community. I’ve also published a second installment in this series. See “Six steps you can take to block unwanted software.”

Carl Siechert and I are currently working on an update to our 2002 book Windows Security Inside Out. It’s been only a little over two years, but a lot has changed in the computer security landscape during that time. So much, in fact, that the update is much more extensive than we originally envisioned.

The biggest change, in my opinion, is the explosive growth in what’s commonly called spyware. We spent about four paragraphs on the topic in the first edition, basically telling readers to install a firewall and use Ad-Aware. In this edition, we’re devoting an entire chapter to spyware, and we’ll have significant coverage of related topics in at least four other chapters.

One frustrating aspect of the whole spyware topic is the extraordinary amount of misinformation floating around about what spyware is, how it gets on your computer, and how you can protect yourself most effectively from being a victim. To organize my thinking, I’ve put together the following list of ten essential facts about spyware. This list forms the basis of the spyware coverage in the new edition. I recognize that some of these statements may be controversial, and I’m open to alternative points of view. (If you want to reply, add a comment or create your own blog entry and send me a trackback.)

The list begins after the jump.

Continue reading “Ten things you need to know about spyware” →