Put a Stop to Spyware

At this moment, computer systems in your organization are probably communicating with companies whose names neither you nor your systems' users have ever heard of, whose countries of origin make them immune to US criminal and civil laws, and whose identities are often purposely obscured. In many cases, these companies have administrative access to systems on your internal network and might be regularly installing software on and making configuration changes to those systems, causing a significant increase in your Web traffic and raising the likelihood that your organization will be the victim of corporate identity theft. If this news takes you by surprise, you aren't alone. The method these nefarious intruders are using—spyware—is one of the most misunderstood risks in the IT industry.

Know the Enemy
Originally, the term spyware referred to a category of surveillance software that law enforcement agencies and others use to monitor a computer user's activity. More recently, the term has taken on a broader meaning that includes any software that monitors or controls a computer without the clear and direct consent of the user. (That definition is now the more common one and the one I use here.) Spyware consists of three main categories: adware, snoopware, and malware.

Adware. Adware is used to deliver advertisements to users or to collect information for use by advertisers. This type of spyware is probably the most common and typically has three objectives: to monitor user activity, to keep the adware software installed and updated, and to display advertisements to the user. Familiar adware includes BargainBuddy, Coolsavings, DashBar, and n-CASE.

Once installed, adware runs either as a standalone process launched at startup or as a DLL attached to an existing process. Adware programs can monitor just about any user activity or configuration information. Figure 1 shows a typical adware operation. The program uses one or more URLs to communicate with Web servers owned by the adware publisher. These publishers often use multiple redundant Web servers to confound content filters. To get its communications through firewalls, adware uses HTTP, often encrypting the data to mask the details of its operations. As a result, adware traffic is usually indistinguishable from general Web traffic within an organization. Adware uses a GUID—often a hardware-specific token (e.g., the affected system's MAC address)—to let the adware publisher maintain a running historical profile of specific activity on the affected system.

The communication between a system running adware and the adware server is initiated either by a specific user activity, such as browsing to a Web site, or on a timed basis. A typical exchange of information involves the adware providing its server with information about recent user activity and the adware server then providing a targeted advertisement based on this activity. For example, a user in your company is planning to attend a conference and goes to a travel Web site to look for a ticket. If the user's computer is running adware, an ad for a different travel site, belonging to the adware publisher's sponsor, might pop up.

Snoopware. Snoopware is used to surreptitiously monitor the activity of a computer user. This software has two objectives: to monitor user activity and to ensure that the monitored user remains unaware of the monitoring. Snoopware is most commonly associated with identity theft and corporate spying. Common snoopware products include Catch Cheat Spy, SpectorSoft EBlaster and Spector, and WinWhatWhere Investigator.

Snoopware integrates with a system in numerous ways, including installing keyloggers, browser plugins, or standalone monitoring processes and even by replacing system software. The information that the snoopware monitors varies from product to product but typically includes screen shots, keystrokes, application activity, Web surfing, Instant Messaging (IM) communications, and email messages.

Snoopware either stores captured information in a database on the local machine or sends the information to a centralized server. Products that locally store the information use encryption and hidden folders to avoid discovery, then use email to regularly deliver the collected information to the monitoring party. The monitoring entity also often has local access to the collected information by way of special hotkeys that the snoopware installs on the monitored system. Snoopware that stores collected information on a remote centralized server sends the information in real time via HTTP Secure (HTTPS). Figure 2 shows a typical distributed snoopware operation, which lets the monitoring entity view the collected information from a remote computer by using a Web browser.

Malware. Malware (short for malicious software) is designed to disrupt the normal operation of a system. Whereas the term malware has traditionally been applied to viruses, worms, and Trojan horses, new types of malware include browser hijackers, parasites, and dialers. Browser hijackers can change a browser's default home page or redirect all Web requests to remote sites. Parasites can alter existing tracking links so that the malware publisher can get referral credits for online purchases. Dialers take over modems connected to the affected system and make remote phone calls (e.g., to pay-per-call pornographic lines). Well-known malware includes CoolWebSearch, MarketScore, New.Net, Mail Wiper Spy Wiper, and Virtual Bouncer. Figure 3 shows a typical malware operation.

Watch Your Back
So how does spyware get on your systems? Such programs are typically installed through the following means:

Spyware distributed by free, bundled, or licensed software typically comes with an End User License Agreement (EULA) that the user must accept before installation. These EULAs often provide detailed information about what rights the user is granting the spyware publisher and what activities the publisher might monitor. (They also complicate legal actions against spyware companies, as the sidebar "Is Spyware Legal" explains.) A typical EULA, such as the one that comes with DashBar, is 12 pages and grants the publisher the ability to "occasionally install and/or update software components," among other rights. Drive-by and silent downloads almost never present EULAs and therefore represent a greater risk to organizations because their publishers make no commitment about the rights and limitations of the software.

Understand the Risks
Would you let end users randomly establish VPNs to remote organizations without your knowledge and approval? If your answer is "No!" but your organization doesn't have policies or infrastructure in place to prevent spyware, you might be surprised by the real risks to which you're open. Table 1 lists these risks and their relative likelihood (which might vary from business to business). Of these risks, the two most misunderstood are reduced security posture and increased bandwidth usage. If you need a reason to get approval for preventative measures, the following information might come in handy.

Reduced security posture. Each time a system on your network becomes infected with spyware, the overall security of your organization is compromised. Spyware often runs with administrative-level privileges to systems on which it is installed, giving it the ability to communicate on the network and download and install software. The only limitations of these escalated privileges are those imposed by the spyware publisher. In addition, many types of spyware directly alter the security settings of the affected system to better enable the spyware's operation or to prevent its removal. Some spyware adds sites to Microsoft Internet Explorer (IE's) trusted zone, alters Web browser security settings, adds entries to a HOSTS file, or even disables antispyware and antivirus software. Even after you remove spyware, general configuration changes made to the system often remain, leaving the computer vulnerable to other spyware programs.

Increased bandwidth usage. All types of spyware use your bandwidth to communicate with remote systems. In lab tests, I found that each spyware product adds an average of two times the standard network traffic (e.g., for a system infected with 10 spyware products, 30KB of inbound/outbound traffic for a Google search averages 600KB of traffic). In one test, a system running only WeatherBug generated 133KB of traffic just by opening a Web browser to the default Google home page. Only 1.7KB of this traffic resulted from communication with the Google Web server; the rest was the result of communications between the system and two Web servers registered under different organizations (but both in fact representing the same spyware publisher).

Arm Yourself
By now you're asking, "How do you get rid of this stuff?" Unfortunately, no one product or technology can eliminate the risk of spyware within your organization. However, you can control spyware by establishing a defense-in-depth strategy that involves a combination of use policies, user education, and technology.

The typical foundation of such a strategy is often an acceptable use policy that defines what users can and can't do with their systems and—most importantly—establishes penalties for not adhering to the policies. Typical policies cover Web browsing, downloading, and installing software. User education is often the next layer in your defensive strategy. Spyware can be confusing to IT administrators; it's often incomprehensible to end users. Still, given a proper education, many users can be taught the risks of visiting questionable Web sites, accepting ActiveX controls, or installing software from unknown or questionable organizations. Of course, no defense is complete without the help of the proper technology. Several categories of software can be used to fight spyware (see "Learning Path," page 62, for suggestions about where to find more information about some of these types of products):

A Real and Present Danger
Spyware in all its forms—adware, snoopware, and malware—represents a real and present danger to businesses, in the form of increased security and legal risks. Understanding what spyware is, how it gets on your systems, and how it can negatively affect your business is an essential part of developing a strategy to protect your organization.