Can Spyware Be Stopped?

By Stacey McDaniel

Spyware and adware are global problems, and are proving to be hard to control. A 2004 survey by America OnLine and the National Cyber Security Alliance found that 80 percent of people surveyed had some kind of spyware or adware program on their computer. Internet Service Provider EarthLink announced earlier this year that it detected approximately 116.5 million instances of spyware, adware, and other unwanted software among its customers in 2004. EarthLink also found that instances of spyware monitoring software among its customers rose 230 percent last year.

Considering those findings, chances are quite good that these security risks have found their way onto computers inside your organization. Spyware and adware not only clog up and slow down computers -- they also can collect information about an individual or organization without their knowledge and use it for malicious purposes, such as identity theft. While all eyes are currently on the government to see what effect recent legislation will have against spyware and adware, there are some things you can do to keep these security risks from affecting your computers.

Distinguishing among the risks

Spyware and adware are in the same threat family as spam and phishing. Although spyware and adware are often used interchangeably, they have distinctly different characteristics:

• Spyware is a stand-alone program installed on a computer that can capture information stored on the computer, as well as Internet usage patterns, and relay it back to a third party. In some cases, spyware is intentionally used by corporations to monitor employee Internet usage or by parents to monitor their children's Internet activities. However, it may also represent less legitimate applications. Spyware programs can be surreptitiously placed on users' systems in order to gather confidential information such as passwords, login details, account numbers, and credit card details. This can be done through keystroke logging and by capturing email and instant messaging traffic. Because spyware can capture sensitive information before it is encrypted for transmission, it can bypass security measures such as firewalls, secure connections, and VPNs that may be in place. Spyware is a particular concern because of its potential use in identity theft and fraud.
• Adware refers to programs that display advertising content on a user's monitor, often without the user's prior consent or explicit knowledge. It is usually, but not always, presented in the form of pop-up windows. Adware is not necessarily a security risk. In some cases, it simply delivers an advertising message that appears on the user's screen. However, there are also many forms of adware that compromise the confidentiality, availability, or integrity of data on a computing system. This can be done by tracking and compiling a profile of a user's browsing habits (which can occupy excessive bandwidth, thereby diminishing the functionality and availability of a computing system), or by modifying the computer's settings in order to monitor the user's Web browsing habits.

Is help on the way?

As the general population becomes more aware of spyware, adware, and other cyber security and identity theft threats, many are looking to the federal government to become more accountable on these issues. A survey published in June by the Cyber Security Industry Alliance polled 1,003 likely voters from both Republican and Democratic parties and found a consensus that the federal government needs to do more to protect consumers on the Internet. The survey revealed that the public's awareness of spyware is not as high as spam, but the more voters learn about spyware, the more it scares them. Without the benefit of a statement describing spyware, two-thirds of voters rated it a serious problem. When fully informed of the nature of spyware, nearly all voters (93%) considered it a serious problem. Overall, 71 percent of voters believe new laws are needed to protect consumer privacy on the Internet. Voters are much more likely to believe that privacy protection should be left to the U.S. Congress (60%) than to state legislatures (35%).

There have been a number of legislative approaches taken recently to address spyware and adware. As of June 1, 2005, there were two federal bills introduced in the U.S. House of Representatives, and two bills in the Senate. Legislation known as the SPY ACT (Securely Protect Yourself Against Computer Trespassers) is sponsored by Congresswoman Mary Bono. The SPY ACT would generally make unacceptable behavior, such as installing software without your permission, illegal. The bill also stipulates that adware vendors must clearly state the functions of the software, the types of information being collected, and the purposes for collecting the information. The bill also says adware must give consumers the ability to decline installation or remove the software at any time without "undue effort." Another House bill, the I-SPY Prevention Act of 2005" (H.R. 744), was introduced by Congressman Bob Goodlatte on Feb. 10, 2005, and focuses largely on taking enforcement action and stiffening penalties against the bad actors. This bill adds a new Section 1030A to the Criminal Code titled "Illicit indirect use of protected computers" and creates three criminal prohibitions. Both House bills were overwhelmingly approved by their respective committees. However, neither has yet passed the House in a final vote.

In the Senate, the SPY BLOCK Act (S. 687) was introduced by Senator Burns with Senators Wyden and Boxer on March 20, 2005. The Act would prohibit installing software on somebody else's computer without notice and consent, requires reasonable uninstall procedures for all downloadable software, and includes a Good Samaritan provision to protect anti-spyware companies from frivolous tort and libel claims by spyware and adware companies. The "Enhanced Consumer Protection Against Spyware Act of 2005", introduced by Senator Allen with Senators' Smith and Ensign on May 11, 2005, would allow for the seizing of profits from companies and individuals secretly installing spyware on computers and seek significantly higher civil and criminal penalties for those trafficking spyware. It would also beef up the Federal Trade Commission's authority to prosecute spyware intrusions.

All four of the bills recognize that many of the technologies used for malicious and deceptive practices can also be used for beneficial and legitimate purposes. Being adware or spyware doesn't make the technology "bad" or "illegal." The bill only seeks to regulate the misuse of adware and spyware.

In addition to the federal legislative activity on spyware this year, more than 40 spyware bills have been introduced in the state legislatures.

The Federal Trade Commission has also taken notice of the spyware problem. In March 2005 it released a report entitled "Monitoring Software on Your PC: Spyware, Adware, and Other Software." The report outlines the problems associated with defining spyware, the risks spyware presents to consumers, and how the government and industry leaders can respond to the spyware problem.

Steps for detecting spyware

In order to protect your organization, you should continue to run and update your antivirus software, and take extra measures to ensure that client system patch levels are up-to-date. In addition, a defense in-depth should be employed, including the use of a properly configured firewall, as well as integrated antivirus and intrusion detection systems. Finally, users should be educated on the signs of adware and spyware, exercise caution when installing any software via a Web browser, and never download software from unknown sources.

Besides the deployment of defense in-depth, acceptable usage policies should be put in place and enforced. Systems should be regularly audited to ensure that no unauthorized software is installed or operating on the systems. Administrators and end users should also read the End User License Agreements (EULAs) of all software programs before agreeing to their conditions.

Conclusion

While it seems like much of the burden of stopping the spread of adware and spyware currently lies on the federal government's shoulders, legislation will never make these threats go away entirely. However, there are tools available that can help you effectively cut down on the impact of these threats. Being an educated user who knows how to identify and distinguish adware from spyware is extremely important, as is following through with a defense in-depth approach. Ultimately you should be confident that all the programs on your computers were installed intentionally, and that the information stored on them is intact and secure from intruders.

Stacey McDaniel has been writing about high-tech issues for more than six years.