The growing threat of spyware

01/31/2005. Until recently, terms like IT threat or malicious code would have referred exclusively to computer viruses. However, there are other types of applications that can cause damage as serious, or worse, than the classic viruses, worms or Trojans. These include spyware, adware and keyloggers, as well as spam and dialers. We are not talking about anything new, they have existed for many years, but for a long time their presence has been insignificant compared with the number of viruses in circulation. Recently however, they have begun to take on more importance. Such importance in fact, that a new term -malware- has been coined to encompass all these threats.

The word ‘malware’ (MALicious softWARE) could be defined as “any program document or message capable of causing damage to the users of IT systems”, and therefore includes computer viruses as well as any other program that can damage computers. For this reason, files like cookies, which are normally completely harmless, could also be included in the category of malware as they are sometimes used to steal confidential information from computers.

The basic reason for the proliferation of these types of malware lies in the potential financial benefits for their creators. For example, spyware gathers information about users that can then be sold to marketing firms to create databases for advertising. A similar story is behind the success of adware, which can offer rich pickings due to companies willing to pay well to ensure their adverts are seen, regardless of whether users have asked to see the ads or not.

Keyloggers on the other hand, are frequently used to collect financial data, such as account numbers, credit card details, passwords or PINs, to facilitate any number of online frauds. Finally, dialers are used -without users knowing- to redirect dial-up connections to high-rate toll numbers.

The types of malware discussed here can use a wide range of propagation channels, and generally speaking, they install themselves unseen on users’ computers. For this reason, it is not uncommon for computers without protection, when scanned with an anti-malware application, to turn out to be infested with dozens of malicious programs.

The spyware story
Spyware is a kind of malicious application designed to track the movements of users, particularly their use of the Internet. It can collect information about the types of pages viewed, the time spent on each page, or how often a certain site is visited. This type of information can be highly valuable in terms of advertising, as it can be used to construct user profiles that are used to send personalized junk mail advertising. Users for example, that frequently visit websites related to sport, would be likely to find themselves saturate with emails promoting sports equipment.

It wasn’t that long ago when the first spyware programs emerged. Two of the most famous are Gator and BargainBuddy, widely spread applications that are still highly active. In fact, it would be difficult to find an experienced Internet user that hasn’t at one time or other felt the effects of one of them.

Gator is a good example to take to explain how spyware works. This program takes the form of an application offering users some kind of free service, often a system for storing passwords so that users will be able to recover them easily should they forget them. The application is installed via a window that appears asking for authorization from the user, if they accept then the spyware will be installed along with the application. This then displays unsolicited advertising and snoops on the user’s Internet connections. Worst of all, had the user paid close attention to the terms for installing Gator, they would have read that they were being asked for permission to install the spyware.

It is more usual for spy programs to be installed secretly. Sometimes it is downloaded automatically on viewing a certain web page and accepting the installation of an ActiveX control; on other occasions it is installed on the system alongside another program.

The future of spyware
Just as with any other Internet threat, spyware is evolving towards even more sophisticated programs, capable of carrying out ever more complex actions and becoming increasingly difficult to detect and remove. At the same time, the creators of this type of malware are determined to see their creations spread as widely as possible to reap the benefits as quickly as possible. As spyware is often relatively large, it is not easy to spread these applications through channels such as email. For this reason there is an increase in the number of computer viruses -which are easier to propagate quickly- designed to download spyware onto the computers they infect. This has the added advantage for the culprits that one virus can insert multiple spy programs on a single computer.

Combat spyware
To prevent the threat of spyware, the key is to have updated anti-malware and a firewall that blocks ports through which information can be transmitted without users’ knowledge. One good solution is to use a security suite like Panda Platinum Internet Security 2005, which not only includes the most advanced antivirus technology, but also incorporates the most powerful systems for detecting and eliminating all kinds of Internet threats, including spyware. At the same time, this Panda Software solution includes a robust personal firewall and the new TruPrevent Technologies, capable of detecting and blocking unknown viruses and intruders.

Panda Software provides solutions for home users, professionals, small and medium sized businesses and corporate networks of any size or topology, which incorporate the most advanced systems to block and eliminate spyware. For more information visit: http://www.pandasoftware.com/products/

For more information about these and other malicious code, go to the Panda Software Virus Encyclopedia.

Oxygen3 24h-365d, by Panda Software
© Panda Software 2003

About PandaLabs

On receiving a possibly infected file, Panda Software´s technical staff get straight down to work. The file is analyzed and depending on the type, the action taken may include: disassembly, macro scanning, code analysis etc. If the file does in fact contain a new virus, the disinfection and detection routines are prepared and quickly distributed to users.
For more information: http://www.pandasoftware.com/virus_info/