Spyware

1
Spyware
2
What is Spyware?

• A hidden software program that transmits user
  information via the internet.
• Also called adware.
• Information collected can include
• Browsing habits (sites visited, links clicked,
  etc.)
• Data entered into forms (including account names,
  passwords, text of web forms and web-based email,
  etc.)

3
Where is Spyware found?

• Spyware is typically found in free, banner
  ad-based software, in which the user exchanges
  the annoyance of banner or pop-up ads for the
  benefit of not having to pay for software.
• Types of software include download managers,
  games, demo software, ftp programs, windows
  utilities, and file-sharing software.

4
Software that is reported to have Spyware

• AudioGalaxy (from Oct-Nov of 2001)
• Go!Zilla
• Gator
• Comet Cursor
• Cute FTP
• FreeZip!
• PK Zip

• NetZip Download Demon
• KaZaa
• Mattel Broadcast
• Web3000
• Flyswat
• Many freeware games
• Many MP3 programs

5
Spyware EnginesAureate/Radiate

• Targets users while they are using the software.
• Can deliver advertising when users are not
  connected to the internet.
• Found in
• Go!Zilla, Advanced MP3 Search, FreeSaver MP3, MP3
  Album Finder, MP3 Cat, MP3 Fiend, MP3 Groupie,
  Planet MP3 Find, Download Minder, Download
  Wonder, Download Agent, DownLoader, Admiral Virus
  Scanner,

6
Spyware EnginesConducent Timesink

• Utilizes the internet to dynamically deliver
  content to desktop software. Once received,
  content can be displayed at any time.
• Click-through data is reported back to Conducent
  daily.
• Found in
• The Real MP3 Finder, Zip Code Finder, MailAlert,
  Sonic Mail, WebScan

7
Spyware EnginesCydoor

• Implants banner ads in software.
• Ads can be rotated while a user is online or
  offline.
• Found in
• Audio CD MP3 Studio, Abes MP3 Finder, MP3 Tag
  Studio, In Vircible Anti Virus, Zip Wrangler

8
Spyware EnginesComet Cursor

• Browser extension that gives web sites the power
  to change the users cursor.
• Comet collects IP address, referrer IDs, and
  other system information.
• Found in
• Web sites.

9
Spyware EngineseZula Toptext

• Takes control of your browser.
• Highlights keywords in web pages. Clicking on a
  keyword takes the user to an eZula client site.
• Found in
• KaZaa
• eZula web site

10
Spyware EnginesFlashpoint/Flashtrack

• Keeps track of web sites visited and
  click-throughs on banner ads.
• Provides the user with pop-up ads tailored to the
  users tastes.
• Found in
• Flashtrack web site

11
Spyware EnginesGator

• Software to help fill out forms and remember user
  names/passwords. It can also remember credit card
  information.
• Personal information is stored in a file on the
  users computer. This information can be accessed
  by Gator.
• Gator sells information to third parties and
  directs advertising based on web site behavior.
• Found in
• Web sites, AudioGalaxy, iMesh, LimeWire,

12
Spyware EnginesWeb 3000

• Provides banner ads, text ads, and popup ads.
• Collects information on web site behavior.
• Found in
• netSonic Internet Accelerator

13
Spyware EnginesBonzi Buddy

• Little animated purple gorilla that does cute
  things while you web surf.
• May or may not actually be spyware, but the
  potential is there.
• Found in
• Bonzi Buddy Web Site, BearShare, iMesh, KaZaa,
  LimeWire.

14
Is Spyware on my System?

• There are several products available to test for
  the presence of Spyware
• Ad-Aware by Lavasofthttp//www.lavasoftusa.com
• SpyChecker A web site with a database of known
  Spyware.http//www.spychecker.com/
• OptOut software by Steve Gibsonhttp//grc.com/opt
  out.htm

15
How do I remove Spyware?

• Removing the program through uninstall utilities
  or Add/Remove programs does not always remove the
  registry entries or DLLs associated with the
  Spyware. Some Spyware, such as Web3000, replaces
  windows sytem files with its own versions.
• Manual removal of registry entries and dlls, or
• Software is available to remove Spyware.

16
Spyware Removal Software

• Ad-Aware by Lavasoft The most highly
  recommendedhttp//www.lavasoftusa.com
• Opt-Out by Steve Gibsonhttp//grc.com/optout.htm
• ZoneAlarm Can be configured to block Spyware
  communicationhttp//www.zonelabs.com/

17
Ad-Aware 5.62 Screenshots
18
Ad-Aware 5.62 Screenshots
19
Ad-Aware 5.62 Screenshots
20
Ad-Aware 5.62 Screenshots
21
What happens after removal?

• If you remove the Spyware components from your
  software, the software will no longer work
  properly most of the time. Be prepared.
• If you had a particularly bad infestation, or
  tried to remove registry entries yourself and
  made errors, it may be necessary to reinstall
  Windows.

22
Recommendations

• Make sure Installation of Desktop Items is
  disabled in IE, or set to Prompt in the
  Security Settings for Internet and Restricted
  Zones.
• Download Signed ActiveX Controls should be set
  to Prompt (ToolsInternet Options) for IE.

23
Recommendations, Contd

• Netscape users should have Require Manual
  Confirmation of Each Install checked under Edit
  Preferences Advanced Smart Update.
• Restrict the installation of downloaded web
  software, by coding or by department policy.

24
Dangers of Spyware at TAMU

• Browsing information is collected. This could
  include URLs and IP addresses of confidential
  intranet sites.
• User logins, account information, and passwords
  could be collected by Spyware when input into web
  forms.
• SSL is not a barrier, so personal student or
  employee information could be gathered if that
  information is entered into a web form, even a
  secure intranet form.

25
Dangers of Spyware, Contd

• Many of the EULAs of Spyware-infested software
  (and the Spyware itself), make one agree to allow
  other software to be installed on the users
  computer, sometimes without the users knowledge.
  Most users of computers at TAMU do not have the
  right to agree to such a EULA.

26
More Information

• SimplytheBest Spyware Informationhttp//www.simpl
  ythebest.net/info/spyware.html
• Spyware Watchhttp//www.spyware.co.uk/
• ZD-Net What is Spyware?http//www.zdnet.com/prod
  ucts/stories/reviews/0,4161,2612053,00.html
• SpywareInfohttp//66.34.160.192/spywareinfo/
• Spycheckerhttp//www.spychecker.com/

27
Microsoft Windows Media Player

• According to The Register (http//www.theregus.com
  /content/55/24119.html) when you use it to watch
  a DVD, WMP for XP contacts a Microsoft server to
  get title and chapter information. It also
  identifies your player uniquely and keeps track
  of what you watch in a database on your computer.
• Technical details and a response from Microsoft
  http//www.computerbytesman.com/privacy/wmp8dvd.ht
  m
• Can be blocked, according to MS, by working
  Offline in WMP, or setting privacy level in IE to
  block all cookies.