Tip of the Week

Tip for: 05.10.2004

Some Protection Against Spyware

Summary: More and more computer users are dealing with the problems of spyware being downloaded to their computer. Our tech department has provided some information on what spyware is and how to protect against it. We have copied this document below.

What is Spyware and how can I protect against it?

Edited by Melinda Tooley
5/10/04

The recent changes in online use, including large influxes of consumers now using the internet, broadband access being made available at home and the fact that internet use has become so easy and so common, have given rise to a new threat to computers and users. Spyware, or adware as it is sometimes called, has become as prolific and profitable as spam email.

Spyware is a term used to describe a broad group of applications that may be downloaded and installed with or without the user's consent. Spyware can capture information about computer and internet use and send it back to companies, without the user ever being aware that it is there. Many spyware applications gather information while the user is online or offline and then send it — at the earliest opportunity — to the company that created the spyware application. Some spyware can even capture each keystroke entered on the computer that is infected. Passwords, social security numbers, credit card numbers and more can potentially be sent out via spyware, and while the company that created the application may have the best of intentions and may not ever use that information, it may be possible for other parties to also gain access to that information.

Spyware can also generate annoying pop ups while users are connected to the internet. Not all pop ups are generated by spyware — some are launched by a site at a user's request. The pop ups that come up when the user is off line, has just connected or are not requested by the user may be launched by spyware.Spyware can slow a computer to a crawl. The processes that these hidden applications perform are constantly running, tying up the processor and memory with various searches for information.

Downloading spyware is like downloading cookies; anyone who spends enough time browsing the internet is bound to pick a few of each. The best way to avoid spyware is to use a browser that does not have much vulnerability and has advanced security. Another solution is to choose a browser that is not usually targeted by spyware.

Browser Solutions

Internet Explorer is the most widely used browser. Consequentially, Internet Explorer is the most exploited browser. This is not necessarily due to poor design; rather, it is due to the fact that spyware applications are designed to attack the most commonly used browsers and operating systems. Also, because Internet Explorer is an integrated part of the Windows operating system it has access to much more of the system — and that access can be exploited. Microsoft is aware of this growing threat and, as a result, will be adding additional security to their operating systems and browser to minimize the access that spyware has to the operating system and to lower the number of exploits available in the browser to download and execute spyware applications.

Until that time, it may be wise to adjust the security settings of Internet Explorer to limit the effectiveness of spyware. The security settings in Internet Explorer are complex and will limit access on certain websites, so they should be set with care.

Users may also choose to install a browser that is less popular or that is less vulnerable to exploits. Here is a list of browsers which are not affected as much by spyware; there are versions for both Macintosh and Windows, unless otherwise specified:

Netscape - http://channels.netscape.com/ns/browsers/download.jsp

Mozilla - http://www.mozilla.org/

Firefox (formally Phoenix) - http://www.mozilla.org/products/firefox/

Opera - http://www.opera.com/download/

Camino (formally Chimera) Macintosh only - http://www.mozilla.org/products/camino/

Safari Macintosh only - http://www.apple.com/safari/

K-Meleon Windows only - http://kmeleon.sourceforge.net/start/

While these browsers are less prone to spyware, note that almost every browser is susceptible to some form of spyware.

Spyware Countermeasures

To eliminate spyware, users can download any number of utilities that will clean their systems of known spyware applications. Since new spyware is developed daily, like virus protection software, anti-spyware software must be updated and scans run frequently.

Two free anti-spyware programs are Ad-aware (http://www.lavasoftusa.com/) created by Lavasoft and Spybot (http://www.safer-networking.org/) made by Patrick M. Kolla. These utilities are free to the public, but both organizations are supported by donations and purchases of full versions of their software.

Another countermeasure that is often employed is pop up blocking software. Pop up blocking software is very useful because it stops all pop up ads from loading, whether they were initiated by spyware or the website that is being viewed. There are some downsides to pop up blocking software. First, if a website launches a pop up window at the user's request, often times the pop up blocker will suppress that window. Secondly, many sites use browser plug-ins that are often stopped by pop up blockers, as a result, parts of the page may fail to load or may load improperly. This includes the Alexandria client installation page. Finally, many software applications now implement Java, which many pop up blockers prevent from loading. If the pop up blocker stops Java, the applications using Java will fail to run.

Another disadvantage of using a pop up blocker is that it treats the symptoms but not the source of spyware. Most spyware is designed to send data back to the company that created it. Simply suppressing the pop ups that some spyware applications generate does not eliminate the software; it simply hides its most apparent effect. Overall, the most effective way to deal with spyware is to run scans of all computers that connect to the internet with an updated anti-spyware application.

Yet another way to prevent spyware from sending information from a system is to put that system behind a firewall. A firewall is a program, a network device or a server that controls the information that flows to and from machines that are connected to the internet. Most firewalls can be configured to log internet access. A firewall can be hardware or software. It can protect an entire network or a single computer. Most firewalls can be configured to allow as much or as little information through them as the user sees fit.

Users that are behind a firewall that is configured by another entity should assume that the firewall does not prevent spyware from sending information.

A software firewall can be installed on local machines that will limit the information coming from, and going to, the internet. OS X and Windows XP both have built in firewall software; however both are extremely limited in the amount of control they offer. Zonealarm (http://www.zonelabs.com) from Zone Labs offers a more selective approach to controlling Internet use. Again, a firewall does not remove existing spyware, but it can prevent it from sending information, and it can alert the user to unauthorized communication which the spyware initiates. A utility that removes spyware is still preferable.

Spyware is not limited to machines running Microsoft operating systems, however, most spyware is written to run on the various versions of Windows. At this time, MacScan is probably the best software to handle spyware for OS X users. Currently there is not a Macintosh vendor that provides free anti-spyware software This is probably due to the fact that spyware is not as prolific on the Macintosh operating system. That said, many spyware programs work through the user's browser, and will run in Linux and UNIX based systems, which OS X borrows heavily from. As a result, spyware will become a more serious problem for Macintosh users in the future.

To recap, the best solution is to use a web browser that spyware is not being written for or a browser that contains sophisticated security or spyware countermeasures. Because it is likely that spyware will still infect any system that browses the internet, it is a good idea to use a utility to remove any spyware that may be present.