Anti-Spyware Protection: Behind How-To Tips

There is no doubt that "how-to articles" have become a separate genre. One can find such an article about almost anything; there are even some entitled "How to Write a How-To Article". And, of course, the Web is swarming with the ones like "10 Steps to Protect Your PC from Spyware"(if not 10, any number will do; odd ones like 5,7,9 are most popular) or "How to Forget About Spyware For Good". Please don't accuse me of being sarcastic -- I am not; all these articles by all means are informative and so very useful. They all include really handy tips to protect you from this recently emerged plague called spyware. But…

A typical how-to article is short and snappy, with all unnecessary particulars carefully avoided. An ideal one is a clear scheme of what to do and how (because it is a how-to article). Some essential facts will surely be omitted just for the sake of brevity. Let's look into the author's "trash bin" for info ruthlessly (and maybe baselessly) thrown away.

Hint one: What on earth is spyware?

When you decide to apply "anti-spyware protection", you'd better realize what you want to be protected against. Unfortunately, there is not such thing as complete security. And…

"There is no such thing as spyware in itself"-- you are perplexed, aren't you? I bet you are; what's more, it was Kaspersky who recently expressed this opinion. "The term spyware is basically a marketing gimmick," wrote Kaspersky in the company weblog on March 03, 2005. "Just to separate new ersatz-security products from traditional ones, just to push almost zero-value products to the security market."

This quote (extremely curtailed and out of the context) have already spread all over the Internet, but it is very useful to read the whole posting to see the whole picture, so visit http://www.viruslist.com/en/Weblog?Weblogid=156679222

Few definitions caused so much controversy and confusion as did "spyware". Eugeny Kaspersky blames marketers for having coined this term--and partially he is right. But only partially.

As a professional, he classified various malicious programs according to their structure and characteristics; in this classification there is indeed no place for "spyware", which is too vague term to exactly denote anything with a particular structure.

On the other hand, marketers and journalists needed an expressive, easy-to-remember word to name existing (!) information-stealing programs to tell users (who may be not so versed in software as its developers) how to protect their computers.

What is "spyware" then? Spyware is a commonly used general term for any type of software that gathers personal information about the user without his or her knowledge and transmits it to a destination specified by the author of the program. Spyware applications are frequently bundled in other programs--often freeware or shareware--that can be downloaded from the Internet.

So, the term is very general and doesn't reflect either structure or characteristics of such software. After all, it is only a conventional word for programs that steal information.

According to Kaspersky, programs which are now called spyware, have existed for years. It's true. Who disagrees? Password-stealing Trojans were actually known as far back as in 1996. But it's also true that most dangerous information-stealing programs are on the rise. Spy Audit survey made by ISP Earthlink and Webroot Software (the survey lasted for a whole year 2004) showed--16.48% of all scanned consumer PCs in 2004 had a system-monitor, 16.69% had a Trojan.

Another bitter truth is that some unscrupulous producers now are jumping at the chance of making quick money. There are lots of suspicious, low-performing, or adware-installing products. See, for example, the list at http://www.spywarewarrior.com/rogue_anti-spyware.htm But saying that all the dedicated anti-spyware solutions are like that…To put it mildly, it's a bit too much.

Hint Two: Too Many Promises Made -- Is it Possible to Keep them?

There are loads of software programs nowadays created for fighting spyware. An ordinary consumer tends to get lost in plenty of information and lots of products, which are supposed to help him get rid of spyware. If all the advertising claims were true, it would have been easy. In reality it isn't.

Anti- spyware and anti-viruses work almost the same way. The efficiency of most anti-spyware programs is determined (and restricted, too) by signature bases. The more code clips (i.e. signatures) there are in the base, the more effectively the program works – it means the more spyware programs it can identify. Only programs from the signature base are recognized as spyware; all other spy programs will be running unnoticed and unstopped.

So, absolutely all the signature- basis- containing programs are pretty much the same, whatever their ads say. They all rely on the same "match pattern"; the difference is only how many signatures each of them contains.

What conclusion we can make here? The bigger the signature base, the more reliable the product is, no matter whether it is anti-spyware or an anti-virus. If the software applies signature base, it's better to choose a product from a big company, which can afford spending plenty of money on research and updates.

Another conclusion we can make is that all such software without constant updating pretty quickly becomes useless and even dangerous, because users still expect it to protect their PCs. New spyware is constantly being developed, and anti-spyware developers have to catch up with it all the time. This race started when very first malicious programs appeared, and it is impossible to say whether it will ever end.

Information Security for E-businessmen: Just a Couple of Ideas

If you constantly deal with bank or electronic accounts, it must be
your worst nightmare--to wake up and learn that you are a bankrupt.
Some crook stole your personal data and all the money you have been
sweating blood for years has flown to somebody else's account. Almost
everybody must have heard that such a tradegy is called identity theft
and millions of people in the USA alone suffer the same every year.
Poor consolation for its victims, isn't it?

Unfortunately, businessmen frequently are targets for identity
thieves, especially online. Lots of articles on identity theft,
"how-to-avoid" tips, and scary stories about the victims circulate
through the Web and other media. The authors remind people again and
again that they should be cautious when giving anybody their private
info as well as care for their PCs' security. But in spite of all
their effort identity theft is still the most rapidly growing crime.

Software developers are doing their best, too. They can't be of much
help if somebody plainly looks over your shoulder and writes your
credit card number down. It's for you to take care and never reveal
your personal info to anybody who asks for it. What they can do is to
create new solutions to the urgent problems like data stealing.
Keylogging spyware--the very programs that make lots of such crime
possible--are pretty much written about lately. These programs
secretly monitor everything users do on their PCs.

Keyloggers are used--by themselves or as a part of a virus or a Trojan
-- much more widely than PC users think; it is an open secret that the
lion's share of identity theft that happens online is because of
keylogging spyware. The losses caused by stealing PINs, logins, and
other valuable data, are well comparable with the damage from viruses.
Actually, if a virus or a Trojan contains a built-in key logger module
(and it often does), the end user finds himself in a pretty tough
situation. The problem is that most anti-keylogging programs warn
users when it is too late. The data have already been captured and
sent. Why does it happen?

Almost all anti-spy software existing at the present moment works
using the same scheme: spy program is detected and then blocked or
eliminated. Detecting viruses or spy software is the crucial step of
the whole process--all the protection depends on whether the anti-spy
software is able to detect as many spies as possible. Signature bases
which all these products depend on, is actually the "list" of
signatures – small pieces of spy programs' codes. Anti-virus or
anti-spy program actually scans the system and compares its codes with
those in signature bases. So, in this case only the spies whose
signatures already are in the base will be detected and eventually
"caught". As long as anti-spy software is regularly updated and the
system doesn't come across some unknown spyware product, everything is
all right.

The problem is that lots of programs which could be used for stealing
data are not included into signature bases right now. Some of them
will never be.

There is good deal of people capable of creating something brand-new
spy, unknown to anti-spyware developers. The period of time when a new
spy already exists, but the updates have not been released yet, is the
very time when hackers make their biggest profits.

Spy programs can be created for the specific purpose, such as
industrial espionage, so they will never be represented in the base.
Moreover, some monitoring programs can be used as spy programs as
well, though they are not always included into signature bases. As we
can see, a signature base is the weak spot of anti-spy protection; it
is, so to speak, a joint in the armor. Information thieves also know
about it.

Fortunately, software developers are constantly looking for new
solutions. One of the new trends in anti-spyware developing is not to
use signature bases as means of detecting spyware. There is three
basic advantages in such an approach. First, the product gets rid of
its the least reliable part; second, there is no so urgent need for
updates anymore; and last, but certainly not least-–the product
becomes capable of blocking the destructive activity of even unknown
spyware. To read more about this new approach follow the link in the
signature.

When products of such a kind become widespread, there would be much
more problems for hackers in future. However, there is no guarantee
that no innovative spy software appears in response.

Whether we like it or not, all malware "evolves" very quickly; new
schemes are being developed, and new software which online criminals
create and utilize becomes more and more malicious and "selective".
New keyloggers as well as keylogger-containing viruses and Trojans,
appear all the time; the losses these programs may cause to a business
are enormous. That is why in some businesses there is an acute need
for separate anti-keylogging protection.