as you may well have heard, the EFF and a bunch of security experts have written an open letter to the AV industry asking about any possible involvement by them in the mass spying scandal that has been in the headlines for much of this year. at first i thought this was old news for AV, since the issue of government trojans has actually been around a lot longer than the current spying revelations. i thought these people had simply failed to do their homework but, as time passed, the wheels began to turn and i started thinking differently. now i think the question we should all be asking ourselves is, what would AV's complicity look like?
some background, first. the subject of government trojans have been around for over a decade. magic lantern, for example, dates back to 2001 (or at least public awareness of it does). so it should come as little surprise that the question of whether the AV industry looks the other way has come up before. in 2007 cnet ran a story where 13 different vendors were asked about this very thing. they all more or less denied being a party to such shenanigans, but i suggest you read the article and pay careful attention to the answers.
now earlier this year one of the first controversial spying revelations to come about was about a program called PRISM which a whole bunch of well known, big name internet companies (including google, microsoft, yahoo, facebook, etc) were apparently involved with. the companies all denied it of course, and it turns out they may be legally required to do so.
that adds an interesting wrinkle to the question now being put towards the AV industry; would they be allowed to admit to any complicity that might be going on? they say actions speek louder than words, so maybe we should look for something other than the carefully crafted assurances of multi-million dollar corporations. maybe what we should be looking for is the same thing that alerted us to the mass spying in the first place - a leak. maybe then we can get a glimpse of their actions.
back in early 2011 a rather spectacular breach occurred. security firm hbgary was breached by some members of anonymous, and one of the things that leaked out was the fact that hbgary wrote malware for the government. in fact, it doesn't take much imagination to suppose that this would be the very type of malware the EFF et al are concerned the AV industry may have been asked to ignore.
it's unknown whether any AV vendor actually did field such a request. i have my doubts since traditional commercial malware writers seem to be perfectly capable of creating undetected malware without making such requests. that being said, one fact that became rather suspicious in light of the revelations about hbgary was the fact that they were partners with mcafee, one of the biggest AV vendors around and certainly one of the best known names in AV. i wrote about this apparent ethical conflict back in february of 2011, and then again in march of 2011 to note the tremendous non-reaction from the industry. i even went so far as to create a blog specifically for keeping an eye on the industry (though as an outsider myself there was little i could do on my own).
the EFF and others want to know if the AV industry has been complicit in the government's spying. well, one AV vendor was notably evasive when asked by cnet in 2007 about their handling of governmental trojans/police spyware. that same AV vendor was and still is partnered with a company that wrote government malware (in all likelihood for very purpose in question). furthermore, in the intervening years, nothing has come of it. no other vendor has said anything or done anything to call attention to or raise awareness of this partnership. even after the mass surveillance controversy started earlier this year, not a one bothered to raise the alarm and suggest that mcafee might at least in principle be compromised by that partnership, even though they certainly could have benefited from disrupting mcafee's market share. no one thought they could profit from it? no one thought it was their duty to warn people of a potential problem? to raise concerns that the protection mcafee's customers receive may suffer in some way because of their close ties with government malware writers? to give voice to the doubts this partnership creates even after publicly wringing their hands over how wrong what the government themselves were doing was?
AV vendors may or may not have been asked to turn a blind eye to government malware - we may never know, and it's impossible to prove a negative. but they've done a heck of a job turning a blind eye to the people who make government malware and to those in their own ranks who got in bed with government malware writers. i asked at the beginning what AV complicity would look like and i think when it comes to those whose job it is to raise an alarm, complicity would probably have to look like silence (and something about silence makes me sick).
(2013-10-29 13:21 - updated to change the open letter link to point to the blog post that includes the list of intended recipients as well as a link to the letter itself)
Showing posts with label spyware. Show all posts
Showing posts with label spyware. Show all posts
Tuesday, October 29, 2013
Sunday, February 12, 2012
is the iphone really malware free?
friday morning mikko hypponen posted a tweet about the folks behind flexispy changing the look of their site, and i took the opportunity to pose a question to him about iphone malware. you see, flexispy is (or was) a piece of mobile malware that f-secure posted about about 6 years ago. not only that, but there's a version of the software for the iphone, so i found mikko's repeated statement that there was no malware for the iphone to be a little strange in light of the fact that both he and his company have been aware of software that seems to contradict that claim for quite some time.
the resulting discussion with both mikko and his colleague sean sullivan lead in 2 separate directions, so let's look at them in turn. first mikko responded with the following:
so what people really mean when they say no malware for the iphone is that there's no malware in the app store. this is an important distinction, because the iphone ecosystem (and by extension, the threat landscape) extends beyond the app store. when chris di bona attempted to downplay the threat malware played to android devices by pointing to google's efforts to keep their android marketplace clean, a number of folks were quick to point out that the android ecosystem extended beyond google's android marketplace, so it seems strange that people would forget the same line of reasoning applies to the iphone as well.
one other thing (well, the only other thing, really) that mikko said was:
but such unqualified claims are, as mikko has revealed, not technically true. it's not that there's no malware for iphones, it's that there's no malware in the iphone app store.
but wait, is that really true? is there no malware in the app store at all? i'm not sure that's true when we've recently been made aware of apps in the app store that collect and send personal information to a remote server without the user's knowledge or consent. but it's about time i turned my attention towards the much more verbose and nuanced discussion that sean sullivan and i had on the subject. perhaps he can shed light on why these personal info stealing apps shouldn't be considered malware. while mikko didn't question the classification of flexispy as malware, sean informed me that f-secure no longer calls it malware.
why exactly that stops it from being malware in general or spyware in particular in the context of mobile device security i still can't fathom, but sean offered up two things by way of explanation. one being a concern over being sued... by malware vendors. this rationale is something i heard from dr. solomon years and years ago, but i have to admit i had hoped that the industry had become less spineless in the interim. i guess that was too much to hope for. google may stand up to the government on behalf of it's users (perhaps not always, and perhaps it doesn't always succeed, but it has tried), but apparently anti-malware vendors only stand up for their users when there's zero risk they'll be challenged.
the other thing he offered was the following definition of spyware from google:
now, sean also pointed me towards the anti-spyware coalition's risk model description document. i had hoped it would help me to learn more about this "self-install" concept that sean assured me was part of an industry agreed upon standard definition. things didn't turn out that way, since the term "self-install" doesn't appear in that document, but the topic of installation and distribution do figure prominently in the contexts of both risk factors and consent factors. unfortunately this document from 2007 appears once again to be geared to desktop computing rather than mobile computing. that's probably not too surprising considering it's 5 years old now, but it does highlight the age old problem of letting context into the classification process. mobile devices are easier to gain illicit physical access to, as well as being shared more freely (and more frequently) in social circumstances by their owners. the issue of consent at the point of install has far less significance as a risk mitigation for mobile devices. furthermore, the issue of consent at the point of install pretty clearly drops the ball in the case of trojans because it's not necessarily fully informed consent.
as the risk model description document demonstrates, somewhere along the line the industry gave up on basing it's classification system on functional definitions. sean insists that this is a "stricter process" but i think it's more correct to say that it utilizes more criteria than a functional definition system would. utilizing more criteria doesn't always lead to a stricter process because not all criteria are created equal and, at least in the case of the risk model description document, some of those criteria are used to create exceptions (which are generally not the hallmark of a strict process).
one of the last things sean wondered is how could the AV industry possibly use my (supposedly) broader definition(s) and not be accused of FUD. now, aside from the fact that the industry is already accused of FUD (and worse) pretty much regardless of what they do, i think it's important to spell out one of the key differences between a functional definition and the kind of definitions that sean sees in use. definitions that include contextual evaluation are judgements, they engender choice and leave room for agendas. a functional definition has no judgement, it is purely descriptive of the functional capabilities of what is being classified. you can no more be blamed for saying software that spies is spyware than you can for saying water is wet or the sky is blue. there's no silver bullet to make accusations go away, but if you take judgement out of the equation it should render those accusations baseless.
so why is all of this important? because it appears that we've somehow stumbled upon a way in which malware can be classified as "riskware" instead of malware. nobody hears about the riskware classification, nobody cares. they hear "No malware for iPhones" and they shut the rest out because that's all they needed to know (or at least according to traditional notions of malware that should have been all they needed to know). classifying malware as something other than malware seems to be what's enabling people to make the "No malware for iPhones" claim, like some kind of terminological shell game. "No malware for iPhones" makes people think the devices are safe and worry free, but there are risks, and not just for those who jailbreak."No malware for iPhones" is creating a false sense of security and with the revelations that have been made about apple's abject failure to lock down a particular type of personal information and the near ubiquitous exploitation of that failure by app developers, it seems like the stuff of snake-oil.
i tend to think that when people face risks they want to know about them rather than be told there's nothing to worry about, and i tend to think that when those risks come in the form of software that acts against the user's interests, informing the user is the AV industry's job. some people don't want that to happen, they want their own interests to take precedent. if the AV industry allows that to happen through inaction (or worse, facilitates it) then they don't deserve the reputation they have for protecting the user. the industry may not be able to put AV software on iphones yet, but they can certainly do a better job of raising awareness of the risks than going around telling people there's "No malware for iPhones". maybe when public awareness is raised apple will change their ways.
the resulting discussion with both mikko and his colleague sean sullivan lead in 2 separate directions, so let's look at them in turn. first mikko responded with the following:
@imaguid No malware for iPhones. If you jailbreak your phone: all bets are off. Flexispy runs on jailbroken only.now to me, this gets to one of the hearts of the matter. when people say there's no malware for the iphone, they're only talking about non-jailbroken phones. the pertinent difference between a normal iphone and a jailbroken iphone is that normal iphones can only install apps from the app store. the app store is a so-called walled garden where all the apps go through a screening process to keep out undesirable programs.
so what people really mean when they say no malware for the iphone is that there's no malware in the app store. this is an important distinction, because the iphone ecosystem (and by extension, the threat landscape) extends beyond the app store. when chris di bona attempted to downplay the threat malware played to android devices by pointing to google's efforts to keep their android marketplace clean, a number of folks were quick to point out that the android ecosystem extended beyond google's android marketplace, so it seems strange that people would forget the same line of reasoning applies to the iphone as well.
one other thing (well, the only other thing, really) that mikko said was:
@imaguid ...and to top it all: we couldn't do anything about iPhone malware anyway, as Apple won't allow Antivirus products to iPhone.and you know what? why should they allow them when there's apparently "No malware for iPhones"? whether or not there is malware for the iphone, apple doesn't want people to think there is. there is this (rather old) idea that computers can be as easy to use as an appliance (like a toaster). this idea is actually very appealing. it promises computers that just work, computers that don't get malware, computers that are easy and safe and worry free. that promise is part of the secret sauce behind apple's marketing, but if they allowed AV products in then it would dispel the illusion of the appliance computer and apple's products would lose their lustre. it's very convenient, then, that AV vendors are willing to be complicit in apple's marketing by repeating the claim that there's "No malware for iPhones".
but such unqualified claims are, as mikko has revealed, not technically true. it's not that there's no malware for iphones, it's that there's no malware in the iphone app store.
but wait, is that really true? is there no malware in the app store at all? i'm not sure that's true when we've recently been made aware of apps in the app store that collect and send personal information to a remote server without the user's knowledge or consent. but it's about time i turned my attention towards the much more verbose and nuanced discussion that sean sullivan and i had on the subject. perhaps he can shed light on why these personal info stealing apps shouldn't be considered malware. while mikko didn't question the classification of flexispy as malware, sean informed me that f-secure no longer calls it malware.
@imaguid @mikko But they then added an installation interface, and we have since categorized it as riskware.that's right - in spite of the fact that it is designed and marketed as a tool for spying on other people, it is not classified as spyware or malware because it was given an installation interface - meaning that the attacker has to have physical control of the phone for at least as long as it takes to install an app. now, on the desktop this might be a meaningful mitigating factor, but on mobile devices where physical access is so much easier to achieve? come on...
why exactly that stops it from being malware in general or spyware in particular in the context of mobile device security i still can't fathom, but sean offered up two things by way of explanation. one being a concern over being sued... by malware vendors. this rationale is something i heard from dr. solomon years and years ago, but i have to admit i had hoped that the industry had become less spineless in the interim. i guess that was too much to hope for. google may stand up to the government on behalf of it's users (perhaps not always, and perhaps it doesn't always succeed, but it has tried), but apparently anti-malware vendors only stand up for their users when there's zero risk they'll be challenged.
the other thing he offered was the following definition of spyware from google:
Software that self-installs on a computer, enabling information to be gathered covertly about a person's Internet use, passwords, etc.apparently it's not enough that the software spies on you in order for it to be called spyware, it has to "self-install" as well. now i'm sure i must be missing something, because this definition seems to exclude anything where the victim is socially engineered into installing the software (it's hard to call it self-installing if the victim is the one installing it). it also seems to exclude anything that utilizes the particular trojan horse case where the software actually does perform the function it claims to, so the payload is additional functionality instead of strictly misrepresented functionality. a game that also steals passwords, a text editor that also sniffs network traffic, webcam software that just happens to send the video stream to a second undisclosed location in addition to the intended recipient - all of these are examples of software that ought to be called spyware but which the victim actually knowingly installs (because the undesirable functionality is unreported) and thus fails to meet the "self-install" criteria. this is precisely the type of situation users of the photo sharing iphone app called path faced.
now, sean also pointed me towards the anti-spyware coalition's risk model description document. i had hoped it would help me to learn more about this "self-install" concept that sean assured me was part of an industry agreed upon standard definition. things didn't turn out that way, since the term "self-install" doesn't appear in that document, but the topic of installation and distribution do figure prominently in the contexts of both risk factors and consent factors. unfortunately this document from 2007 appears once again to be geared to desktop computing rather than mobile computing. that's probably not too surprising considering it's 5 years old now, but it does highlight the age old problem of letting context into the classification process. mobile devices are easier to gain illicit physical access to, as well as being shared more freely (and more frequently) in social circumstances by their owners. the issue of consent at the point of install has far less significance as a risk mitigation for mobile devices. furthermore, the issue of consent at the point of install pretty clearly drops the ball in the case of trojans because it's not necessarily fully informed consent.
as the risk model description document demonstrates, somewhere along the line the industry gave up on basing it's classification system on functional definitions. sean insists that this is a "stricter process" but i think it's more correct to say that it utilizes more criteria than a functional definition system would. utilizing more criteria doesn't always lead to a stricter process because not all criteria are created equal and, at least in the case of the risk model description document, some of those criteria are used to create exceptions (which are generally not the hallmark of a strict process).
one of the last things sean wondered is how could the AV industry possibly use my (supposedly) broader definition(s) and not be accused of FUD. now, aside from the fact that the industry is already accused of FUD (and worse) pretty much regardless of what they do, i think it's important to spell out one of the key differences between a functional definition and the kind of definitions that sean sees in use. definitions that include contextual evaluation are judgements, they engender choice and leave room for agendas. a functional definition has no judgement, it is purely descriptive of the functional capabilities of what is being classified. you can no more be blamed for saying software that spies is spyware than you can for saying water is wet or the sky is blue. there's no silver bullet to make accusations go away, but if you take judgement out of the equation it should render those accusations baseless.
so why is all of this important? because it appears that we've somehow stumbled upon a way in which malware can be classified as "riskware" instead of malware. nobody hears about the riskware classification, nobody cares. they hear "No malware for iPhones" and they shut the rest out because that's all they needed to know (or at least according to traditional notions of malware that should have been all they needed to know). classifying malware as something other than malware seems to be what's enabling people to make the "No malware for iPhones" claim, like some kind of terminological shell game. "No malware for iPhones" makes people think the devices are safe and worry free, but there are risks, and not just for those who jailbreak."No malware for iPhones" is creating a false sense of security and with the revelations that have been made about apple's abject failure to lock down a particular type of personal information and the near ubiquitous exploitation of that failure by app developers, it seems like the stuff of snake-oil.
i tend to think that when people face risks they want to know about them rather than be told there's nothing to worry about, and i tend to think that when those risks come in the form of software that acts against the user's interests, informing the user is the AV industry's job. some people don't want that to happen, they want their own interests to take precedent. if the AV industry allows that to happen through inaction (or worse, facilitates it) then they don't deserve the reputation they have for protecting the user. the industry may not be able to put AV software on iphones yet, but they can certainly do a better job of raising awareness of the risks than going around telling people there's "No malware for iPhones". maybe when public awareness is raised apple will change their ways.
 |
| image from secmeme.com |
Sunday, April 20, 2008
adware and why tracking usage sucks
phorm, the isp-side adware/spyware technology being tested out in the UK, has been getting a lot of attention in the press for the past couple of weeks... on reading the description of it on the f-secure blog i got to thinking about why exactly this sort of advertising is so bad...
leaving aside the question of all the company's past bad acts (which i know is important but i'm focusing on the type of advertising, not this particular instance) and the isp-side implementation (and all the consequences that has for informed consent), i want to look at just the basic idea of targeting ads based on where a user has browsed in the past...
obviously this requires tracking the user's activities and adware companies will no doubt try to assuage our privacy fears by claiming they don't keep identifying information... for my purposes i'm going to assume they live up to their word, regardless of how unlikely that may seem... my contention is that simply displaying ads based on past browsing behaviour represents a privacy breach because we very often don't use our computers in a vacuum...
what do i mean by that? let's consider the scenario of the road warrior employee... he (or she) has a laptop they take with them on the road and most likely also take home with them... chances are good they will do some personal browsing at some point... chances are also good that at some point they're going to come back into the office and turn on their computer... what happens then is that their co-workers or perhaps even their boss may see ads linked to browsing they were doing while in the privacy of their own home... maybe the ads are of an adult nature (porn), maybe they're of an immature nature (cartoons), or maybe they reveal employment intentions the employee isn't prepared to share with their boss (why are there ads for monster.com on your computer?)...
of course there are those who would say that such an employee shouldn't be doing private browsing on the work computer anyways (ignoring the possibility that they're actually doing work on their own personal laptop - something that can happen in smaller companies) so how about a more reasonable scenario... lets say you're a single guy browsing the web the way single guys do... lets further say you get a new girlfriend and she comes over to spend time with you... at some point she may ask to use your computer to check her webmail because she's been staying over quite a bit and hasn't been home in a while... you concede because letting her use your computer is the least you can do for her considering all the time the two of you have been spending together... then she sees the ads linked to your past browsing behaviours and stops coming over and doesn't return your calls anymore... alternatively, perhaps you're over at her place fairly often and all of a sudden dating site ads start showing up on her computer...
accurately targeted ads are a wet dream for the advertising industry - their efforts would be so much better received and have so much more impact if only they could get the right ads in front of the right people at the right time... developing sophisticated profiles based on past usage makes a certain amount of sense in that context... unfortunately, when it comes to computer use it's pretty much impossible to accurately tell who's looking at the screen, so there's a very real risk of revealing things about people and what has meaning to them to the people around them if your ad targeting is based on anything other than what the user is doing right this instant... you cannot capitalize on knowledge of the user through ad targeting without revealing that knowledge to the user and possibly others as well...
when people can start inferring things about you based on ads targeted at you then then the ads themselves represent a privacy breach, regardless of what personal information the ad company may or may not be keeping... the more accurate the targeting the more likely you are to breach the user's privacy... the more you try to protect the user's privacy by throwing random ads into the mix, the less accurate the targeting becomes and the less impact the ads have because they get buried amongst garbage ads...
advertising is big (and arguably legitimate) business, but those considering the kind of optimization that phorm or really any kind of targeted ad serving represents should be aware of these kinds of less obvious privacy implications...
leaving aside the question of all the company's past bad acts (which i know is important but i'm focusing on the type of advertising, not this particular instance) and the isp-side implementation (and all the consequences that has for informed consent), i want to look at just the basic idea of targeting ads based on where a user has browsed in the past...
obviously this requires tracking the user's activities and adware companies will no doubt try to assuage our privacy fears by claiming they don't keep identifying information... for my purposes i'm going to assume they live up to their word, regardless of how unlikely that may seem... my contention is that simply displaying ads based on past browsing behaviour represents a privacy breach because we very often don't use our computers in a vacuum...
what do i mean by that? let's consider the scenario of the road warrior employee... he (or she) has a laptop they take with them on the road and most likely also take home with them... chances are good they will do some personal browsing at some point... chances are also good that at some point they're going to come back into the office and turn on their computer... what happens then is that their co-workers or perhaps even their boss may see ads linked to browsing they were doing while in the privacy of their own home... maybe the ads are of an adult nature (porn), maybe they're of an immature nature (cartoons), or maybe they reveal employment intentions the employee isn't prepared to share with their boss (why are there ads for monster.com on your computer?)...
of course there are those who would say that such an employee shouldn't be doing private browsing on the work computer anyways (ignoring the possibility that they're actually doing work on their own personal laptop - something that can happen in smaller companies) so how about a more reasonable scenario... lets say you're a single guy browsing the web the way single guys do... lets further say you get a new girlfriend and she comes over to spend time with you... at some point she may ask to use your computer to check her webmail because she's been staying over quite a bit and hasn't been home in a while... you concede because letting her use your computer is the least you can do for her considering all the time the two of you have been spending together... then she sees the ads linked to your past browsing behaviours and stops coming over and doesn't return your calls anymore... alternatively, perhaps you're over at her place fairly often and all of a sudden dating site ads start showing up on her computer...
accurately targeted ads are a wet dream for the advertising industry - their efforts would be so much better received and have so much more impact if only they could get the right ads in front of the right people at the right time... developing sophisticated profiles based on past usage makes a certain amount of sense in that context... unfortunately, when it comes to computer use it's pretty much impossible to accurately tell who's looking at the screen, so there's a very real risk of revealing things about people and what has meaning to them to the people around them if your ad targeting is based on anything other than what the user is doing right this instant... you cannot capitalize on knowledge of the user through ad targeting without revealing that knowledge to the user and possibly others as well...
when people can start inferring things about you based on ads targeted at you then then the ads themselves represent a privacy breach, regardless of what personal information the ad company may or may not be keeping... the more accurate the targeting the more likely you are to breach the user's privacy... the more you try to protect the user's privacy by throwing random ads into the mix, the less accurate the targeting becomes and the less impact the ads have because they get buried amongst garbage ads...
advertising is big (and arguably legitimate) business, but those considering the kind of optimization that phorm or really any kind of targeted ad serving represents should be aware of these kinds of less obvious privacy implications...
Tuesday, July 17, 2007
microsoft's anti-malware ethical conflict
regular readers can probably recall me saying that anti-virus companies don't hire virus writers on occasion... i've called the notion that anti-virus companies are paying for the creation of viruses an urban myth because it would just be too hard to keep that sort of thing secret from their competitors and if their competitors found out about it they'd use it to hurt the company and free up some of it's market share for themselves... each company acts as a watchdog for the others, waiting to blow the whistle on ethical misconduct and in this way they actually help to keep each other honest...
now you'd think this same principle would work for other forms of malware besides viruses, but as i've shown in the past (here and here) that's not always the case... still, it should probably come as a surprise that microsoft, after sinking untold amounts of resources into entering the anti-malware market, has filed for patents on adware/spyware technology... no, not anti-adware/anti-spyware technology, literally technology to serve you ads (adware) based on the contents of your hard drive (spyware)...
so not only does microsoft have conflict where their anti-malware software may prove a disincentive to fixing vulnerabilities in their other software (not to mention that they're charging you money to protect against threats exploiting flaws in their other software) but now they have an ethical conflict where they're considering producing malware and anti-malware at the same time... apparently some of the PHBs at microsoft haven't gotten the memo yet about the new ethical constraints of the company now that it produces anti-malware software... let me put it as bluntly as possible: if you're going to be an anti-malware company you have to be anti-malware... that means no malware creation or malware-based revenue for you...
i, for one, would neither feel comfortable using nor endorsing the use of anti-malware software produced by an entity that ever seriously considered producing malware, never mind one that did so while producing the anti-malware in question at the same time...
now you'd think this same principle would work for other forms of malware besides viruses, but as i've shown in the past (here and here) that's not always the case... still, it should probably come as a surprise that microsoft, after sinking untold amounts of resources into entering the anti-malware market, has filed for patents on adware/spyware technology... no, not anti-adware/anti-spyware technology, literally technology to serve you ads (adware) based on the contents of your hard drive (spyware)...
so not only does microsoft have conflict where their anti-malware software may prove a disincentive to fixing vulnerabilities in their other software (not to mention that they're charging you money to protect against threats exploiting flaws in their other software) but now they have an ethical conflict where they're considering producing malware and anti-malware at the same time... apparently some of the PHBs at microsoft haven't gotten the memo yet about the new ethical constraints of the company now that it produces anti-malware software... let me put it as bluntly as possible: if you're going to be an anti-malware company you have to be anti-malware... that means no malware creation or malware-based revenue for you...
i, for one, would neither feel comfortable using nor endorsing the use of anti-malware software produced by an entity that ever seriously considered producing malware, never mind one that did so while producing the anti-malware in question at the same time...
Friday, May 26, 2006
does µTorrent contain adware / spyware?
i recently became aware some controversy over the possibility that the popular bittorrent client µTorrent contains adware and/or spyware...
there are a number of threads on the µTorrent forums about so i thought i'd use this an an object lesson in how to make these determinations for yourself - and as an added bonus, we're going to do it without even downloading the software...
we can do that by looking at what the software's author had to say about the issue here...
the interesting thing (at least to me) is that there is no 3rd party adware client software - the ad-serving functionality is built by the same person(s) who built the µTorrent client... it's an option i didn't cover in my post about software developers who go the adware route but it's an important one none-the-less... if a software developer finds s/he needs ad revenue, creating the ad serving engine in-house is an excellent way to avoid the pitfalls of potentially nefarious behaviour from 3rd party adware clients... a software developer has the potential to offer users a far more benign adware client if they go this route than if they just accept whatever some 3rd party hands them...
unfortunately that potential seems to be lost in this case... for one thing, the ad-supported nature is not disclosed on the front page of the site nor on the download page - probably because the author doesn't want to admit that it's adware (just because you make it yourself doesn't mean it's not adware)... potential users need to be informed about this sort of thing, they need to be able to make an informed decision about whether they want to install software that displays ads before they download and install it... not disclosing it (whether one is in denial or for some other reason) is a breach of good faith...
the other thing that negates it's potential to be benign is the spyware issue...
there are a number of threads on the µTorrent forums about so i thought i'd use this an an object lesson in how to make these determinations for yourself - and as an added bonus, we're going to do it without even downloading the software...
we can do that by looking at what the software's author had to say about the issue here...
“Nothing is placed on the user's machine [when the NanoTorrent browser opens,]” Ludvid explains. “It's an advertisement inside the web browser only, the ad comes from a webserver owned by me, and it's removed when the window is closed. No cookies at all are installed, not even my own…The ads are generated by the script on the webserver. The µTorrent client as such does not contain any ads. They are generated by the webserver and shown through a php script to the webbrowser when the user searches.”so it does in fact display ads - and not just by accident, the browser is directed to his own site to display ads hosted there... the fact that the ads are not contained in the bittorrent client is not really an issue - adware doesn't need to contain the ads it displays, it just needs to display ads... the fact that the client isn't actually displaying the ads in a window that's part of the client itself but instead uses a browser window is also not really an issue, plenty of adware uses browser windows to display their ads (it saves them from having to reinvent the wheel)...
the interesting thing (at least to me) is that there is no 3rd party adware client software - the ad-serving functionality is built by the same person(s) who built the µTorrent client... it's an option i didn't cover in my post about software developers who go the adware route but it's an important one none-the-less... if a software developer finds s/he needs ad revenue, creating the ad serving engine in-house is an excellent way to avoid the pitfalls of potentially nefarious behaviour from 3rd party adware clients... a software developer has the potential to offer users a far more benign adware client if they go this route than if they just accept whatever some 3rd party hands them...
unfortunately that potential seems to be lost in this case... for one thing, the ad-supported nature is not disclosed on the front page of the site nor on the download page - probably because the author doesn't want to admit that it's adware (just because you make it yourself doesn't mean it's not adware)... potential users need to be informed about this sort of thing, they need to be able to make an informed decision about whether they want to install software that displays ads before they download and install it... not disclosing it (whether one is in denial or for some other reason) is a breach of good faith...
the other thing that negates it's potential to be benign is the spyware issue...
The latest version of µTorrent, version 1.5, contains an integrated search feature. The end user can opt to search several of the major search engines, such as Mininova, ThePirateBay, TorrentSpy, and isoHunt. Once the search is conducted, an independent browser window is opened. Instead of going to the Mininova.org domain however, the browser is directed to NanoTorrent.com.that basically tells me that my search queries are being sent somewhere other than the search engine they were intended for... oh, they get to their intended destination eventually, but not before going through a middle-man first... we're assured that the information is not collected or used in any way, but that's not the point (nor is it something we can verify)... spyware isn't spyware because the information it gives a 3rd party is abused, it's spyware because it gives a 3rd party (in this case nanotorrent.com, owned and operated by the same guy) your information (in this case your search queries)... personally, i would rather my search queries not go through middle-men - not because i search for things that i'd be ashamed to let others know about but rather purely on the basis of principle - what i search for is between me and my search engine of choice...
Saturday, April 08, 2006
attention visitors from subeltblog - please read this
i'm getting an influx of traffic from sunbeltblog readers over the adware comment thread to end all adware comment threads that i wrote about earlier...
i would like to ask you all, before you send me hate-mail for being an 'adware apologist' (which i'm not), please take some courses in abstract reasoning and critical analysis - because once you actually have a handle on those skills you will probably understand what i was talking about in that comment thread...
the synopsis goes like so:
an anti-spyware website criticized an anti-spyware application (labelled it rogue, actually) in part because it was bundled with adware...
the question is, does installing program B make program A bad? the answer is yes if:
while many adware clients are also spyware of one form or another, the anti-spyware website in question never established that the adware in question was also spyware so number 1 above is out... that just leaves us with number 2, but again the anti-spyware website in question failed to show that program B was bad, opting instead to simply indicate who created it...
being created by bad people (in this case very bad people) doesn't make software bad (john mcafee became a pariah in the av industry for his practices, but his software was still good)... furthermore, just because most of the software made by those bad people is bad doesn't mean this one in particular is bad... you can't prove they've never made good software (because you can't prove a negative), but you can prove that this one was bad if it really was - either indicate how the program was bad or indicate that it matches a program that was previously analyzed and determined to be bad...
does just being adware make it bad? no it does not.. not all adware installs in secret (and in this case the adware's presence was fully disclosed), not all adware has pop-ups, not all adware is also spyware... none of those really bad things most people associate with adware are actually inherent to adware, they're simply present in the vast majority of cases...
was this particular instance of adware bad? probably... most (possibly all) instances of adware produced by it's creators were spyware and those creators are now paying the price for it...
was the anti-spyware app it was bundled with really rogue? definitely... aside from bundling probable spyware with an anti-spyware app, it used deceptive practices to get users to install it and there is serious question as to whether it actually detects and/or removes any spyware...
unfortunately for me, i use a functional definition for adware that is unencumbered by emotional baggage related to it's association with other types of malware and so i create contraversy and get hate-mail... but using an adware defintion that is abstracted from other forms of malware doesn't make me an adware apologist, it makes me a computer scientist and anyone who doesn't like it can stick it where the sun don't shine...
i would like to ask you all, before you send me hate-mail for being an 'adware apologist' (which i'm not), please take some courses in abstract reasoning and critical analysis - because once you actually have a handle on those skills you will probably understand what i was talking about in that comment thread...
the synopsis goes like so:
an anti-spyware website criticized an anti-spyware application (labelled it rogue, actually) in part because it was bundled with adware...
the question is, does installing program B make program A bad? the answer is yes if:
1. program A (an anti-spyware app) was supposed to stop program B (an adware client)
or
2. program B can be shown to be bad itself
while many adware clients are also spyware of one form or another, the anti-spyware website in question never established that the adware in question was also spyware so number 1 above is out... that just leaves us with number 2, but again the anti-spyware website in question failed to show that program B was bad, opting instead to simply indicate who created it...
being created by bad people (in this case very bad people) doesn't make software bad (john mcafee became a pariah in the av industry for his practices, but his software was still good)... furthermore, just because most of the software made by those bad people is bad doesn't mean this one in particular is bad... you can't prove they've never made good software (because you can't prove a negative), but you can prove that this one was bad if it really was - either indicate how the program was bad or indicate that it matches a program that was previously analyzed and determined to be bad...
does just being adware make it bad? no it does not.. not all adware installs in secret (and in this case the adware's presence was fully disclosed), not all adware has pop-ups, not all adware is also spyware... none of those really bad things most people associate with adware are actually inherent to adware, they're simply present in the vast majority of cases...
was this particular instance of adware bad? probably... most (possibly all) instances of adware produced by it's creators were spyware and those creators are now paying the price for it...
was the anti-spyware app it was bundled with really rogue? definitely... aside from bundling probable spyware with an anti-spyware app, it used deceptive practices to get users to install it and there is serious question as to whether it actually detects and/or removes any spyware...
unfortunately for me, i use a functional definition for adware that is unencumbered by emotional baggage related to it's association with other types of malware and so i create contraversy and get hate-mail... but using an adware defintion that is abstracted from other forms of malware doesn't make me an adware apologist, it makes me a computer scientist and anyone who doesn't like it can stick it where the sun don't shine...
cellphone spyware part 2 1/2
ok so there's apparently some confusion over my previous post about neo-call... i'm going to try and make this as simple as possible, both for the benefit of the confused and as an object lesson for everyone else...
softWARE that can SPY on someone is SPYWARE... this shouldn't be rocket science to anyone... flexispy and neo-call's spyphone both enable spying and so are both spyware...
software that does something bad (like for example spying on people) without disclosing that fact is a trojan horse program... neither flexispy nor neo-call's spyphone let the person being spied on know that it's spying on them, they both do something bad without disclosing the fact and thus are both trojans...
the fact that neo-call's spyphone is several times more expensive than flexispy doesn't stop it from being spyware or a trojan, it just makes it an expensive spyware trojan...
the fact that the installer generated by neo-call, when you give them the code for the target phone, can only be used on that phone doesn't stop it from being a spyware trojan, it just makes it a more limited spyware trojan...
the fact that flexispy can be installed on many phones does not make it a virus... many programs can be installed on many phones, that has nothing to do with being a virus and being a virus has nothing to do with why f-secure added detection for flexispy...
the fact that flexispy has a hidden menu is not what makes it bad and the absense of a similar menu doesn't make neo-call's spyphone good... flexispy is bad because it hides it's menu and every other indication that it's installed (in other words, it doesn't disclose it's spying nature) - neo-call's spyphone has no menu to hide but still hides all the other indications that it's installed and therefore is equally bad...
in short - neo-call's spyphone is just as bad as flexispy, it is just as much a spyware trojan as flexispy... it's limitations (the high cost per installation) make it a much smaller risk to the public, however, and that is why anti-virus vendors don't take it as seriously as they do flexispy...
softWARE that can SPY on someone is SPYWARE... this shouldn't be rocket science to anyone... flexispy and neo-call's spyphone both enable spying and so are both spyware...
software that does something bad (like for example spying on people) without disclosing that fact is a trojan horse program... neither flexispy nor neo-call's spyphone let the person being spied on know that it's spying on them, they both do something bad without disclosing the fact and thus are both trojans...
the fact that neo-call's spyphone is several times more expensive than flexispy doesn't stop it from being spyware or a trojan, it just makes it an expensive spyware trojan...
the fact that the installer generated by neo-call, when you give them the code for the target phone, can only be used on that phone doesn't stop it from being a spyware trojan, it just makes it a more limited spyware trojan...
the fact that flexispy can be installed on many phones does not make it a virus... many programs can be installed on many phones, that has nothing to do with being a virus and being a virus has nothing to do with why f-secure added detection for flexispy...
the fact that flexispy has a hidden menu is not what makes it bad and the absense of a similar menu doesn't make neo-call's spyphone good... flexispy is bad because it hides it's menu and every other indication that it's installed (in other words, it doesn't disclose it's spying nature) - neo-call's spyphone has no menu to hide but still hides all the other indications that it's installed and therefore is equally bad...
in short - neo-call's spyphone is just as bad as flexispy, it is just as much a spyware trojan as flexispy... it's limitations (the high cost per installation) make it a much smaller risk to the public, however, and that is why anti-virus vendors don't take it as seriously as they do flexispy...
Tuesday, April 04, 2006
cellphone spyware part deux
so my last posting about cellphone spyware (flexispy) apparently was interesting enough to someone for them to send me my very first non-spam feedback... specifically, someone claiming to be affiliated with neo-call sent me a nice little email with their views on the flexispy story...
this is actually pretty amazing, because apparently the neo-call folks (being industry leaders) developed superior cellphone spying technology months ago and nobody paid any attention to them or talked about them (awwwww)... the email goes on to say that it's very interesting that f-secure picked up on the flexispy story a day after the software was released - and i agree... if it really was only a day after the software was released it would appear that vervata decided that getting a examined by anti-virus vendors would make for a good publicity stunt, and i suppose they may be right... on the other hand, f-secure now detects their product as a spyware trojan so i guess that kinda backfired on them since that detection is going to limit the marketability product (who wants to pay for spyware that an anti-virus product can already detect?)...
finally, the email finished off with a lament about how neo-call is an industry leader (in the field of cellphone spyware, apparently) and how it's a shame that nobody is paying any attention to them or talking about them at all.. clearly they're jealous of all the special lovin' the boys and girls and f-secure have been giving flexispy and they want in on some of that action - and it appears they may be deserving... their product forwards sms messages, lo-jack's the phone through GSM localization, and i gather there's even a bonus add-on for listening in on calls - definitely sounds spyware to me... oh, and get this, the FAQ clearly states that you can't tell the product is installed by examining the phone - yup, it fails to disclose it's true nature just like flexispy, isn't that wonderfully up-front of them to admit to it's trojan nature?
mikko and the rest of the gang at f-secure - these guys are obviously looking for some of your special attention, so go ahead and hook 'em up..
[edit april 7 2006: i don't know what i was thinking posting links to a malware distributor, i guess i must have been laughing too hard to realize what i was doing]
this is actually pretty amazing, because apparently the neo-call folks (being industry leaders) developed superior cellphone spying technology months ago and nobody paid any attention to them or talked about them (awwwww)... the email goes on to say that it's very interesting that f-secure picked up on the flexispy story a day after the software was released - and i agree... if it really was only a day after the software was released it would appear that vervata decided that getting a examined by anti-virus vendors would make for a good publicity stunt, and i suppose they may be right... on the other hand, f-secure now detects their product as a spyware trojan so i guess that kinda backfired on them since that detection is going to limit the marketability product (who wants to pay for spyware that an anti-virus product can already detect?)...
finally, the email finished off with a lament about how neo-call is an industry leader (in the field of cellphone spyware, apparently) and how it's a shame that nobody is paying any attention to them or talking about them at all.. clearly they're jealous of all the special lovin' the boys and girls and f-secure have been giving flexispy and they want in on some of that action - and it appears they may be deserving... their product forwards sms messages, lo-jack's the phone through GSM localization, and i gather there's even a bonus add-on for listening in on calls - definitely sounds spyware to me... oh, and get this, the FAQ clearly states that you can't tell the product is installed by examining the phone - yup, it fails to disclose it's true nature just like flexispy, isn't that wonderfully up-front of them to admit to it's trojan nature?
mikko and the rest of the gang at f-secure - these guys are obviously looking for some of your special attention, so go ahead and hook 'em up..
[edit april 7 2006: i don't know what i was thinking posting links to a malware distributor, i guess i must have been laughing too hard to realize what i was doing]
Thursday, March 30, 2006
flexispy vs. the anti-malware industry
if you haven't heard about flexispy (the first spyware trojan for symbian cell phones) then i'd suggest reading about it here and here...
i don't really think it's all that interesting that someone has finally made spyware for cellphones - what i think is amazing, however, is that a member of the commercial spyware industry (vervata) seems to actually not understand why their product (flexispy) is being called a spyware trojan by f-secure...
imagine, you make software that you yourself call a "spy application" and then don't understand why people call it spyware... hello!?!? it's software that spies on you, what do you think people are going to call it?... are these guys for real? well, either they really don't get it, or they think that there are enough other people who don't get it that it's worth it to bother making such a ridiculous argument...
but why is that? well, i think it serves as a stong indication that the anti-malware industry/community in general, and the anti-spyware industry/community in particular, have failed the public in an important way... they've failed to make the threats understandable to ordinary people... look at the anti-spyware coalition's glossary, is their definition of spyware as straight forward as 'software that spys on you'? no, in fact they have 2 separate and contradictory definitions, one of which makes spyware an umbrella term... i've already blogged about stopbadware.org's use of a colloquialism from wikipedia as their definition for spyware, and then there's sunbelt's listing criteria that i was recently made aware of and which is about as easy to read as an end user license agreement unless you already have some familiarity with the malware field...
how are people suppose to get this stuff with literature like that? if it were common knowledge that spyware is software that spies on you then vervata would have no reasonable way to claim ignorance, much less argue the fact... and if it were common knowledge that trojans were programs that do bad things that you thought they didn't do then vervata also should have known that their product (which fails to disclose it's true nature) can be made into a trojan simply by saying it's something good or by installing it on someone's phone and leading (or leaving) them to believe that everying on the phone is normal...
of course, i'm not all about pointing the finger at other people here... while writing this i've realized that even my own definitions could stand some improvement in this area... as much as i try to make the definitions themselves short and sweet (with explanations afterwards for those interested in more detail) they could still be simpler and retain their correctness at the same time... i think we need to compose our definitions like we were talking to 4 year olds, not because people are stupid but because most simply don't have enough of a foundation here to grasp our meaning when we write for other people people in the anti-malware field... i think if we really understand what we're talking about then that shouldn't be too difficult a task... so i guess i'll be tweaking some existing blog entries in the not too distant future..
i don't really think it's all that interesting that someone has finally made spyware for cellphones - what i think is amazing, however, is that a member of the commercial spyware industry (vervata) seems to actually not understand why their product (flexispy) is being called a spyware trojan by f-secure...
imagine, you make software that you yourself call a "spy application" and then don't understand why people call it spyware... hello!?!? it's software that spies on you, what do you think people are going to call it?... are these guys for real? well, either they really don't get it, or they think that there are enough other people who don't get it that it's worth it to bother making such a ridiculous argument...
but why is that? well, i think it serves as a stong indication that the anti-malware industry/community in general, and the anti-spyware industry/community in particular, have failed the public in an important way... they've failed to make the threats understandable to ordinary people... look at the anti-spyware coalition's glossary, is their definition of spyware as straight forward as 'software that spys on you'? no, in fact they have 2 separate and contradictory definitions, one of which makes spyware an umbrella term... i've already blogged about stopbadware.org's use of a colloquialism from wikipedia as their definition for spyware, and then there's sunbelt's listing criteria that i was recently made aware of and which is about as easy to read as an end user license agreement unless you already have some familiarity with the malware field...
how are people suppose to get this stuff with literature like that? if it were common knowledge that spyware is software that spies on you then vervata would have no reasonable way to claim ignorance, much less argue the fact... and if it were common knowledge that trojans were programs that do bad things that you thought they didn't do then vervata also should have known that their product (which fails to disclose it's true nature) can be made into a trojan simply by saying it's something good or by installing it on someone's phone and leading (or leaving) them to believe that everying on the phone is normal...
of course, i'm not all about pointing the finger at other people here... while writing this i've realized that even my own definitions could stand some improvement in this area... as much as i try to make the definitions themselves short and sweet (with explanations afterwards for those interested in more detail) they could still be simpler and retain their correctness at the same time... i think we need to compose our definitions like we were talking to 4 year olds, not because people are stupid but because most simply don't have enough of a foundation here to grasp our meaning when we write for other people people in the anti-malware field... i think if we really understand what we're talking about then that shouldn't be too difficult a task... so i guess i'll be tweaking some existing blog entries in the not too distant future..
Thursday, March 23, 2006
are good spyware simulators still a bad idea
so apparently someone came up with the idea of creating spyware simulators collectively known as spycar (apparently a play on the eicar test file) for testing the effectiveness of anti-spyware applications...
the idea, basically, is that a bunch of these tiny applications could be written that each do some small spyware-like thing... supposedly this is meant to test how well an anti-spyware app can detect spyware they don't already know about - the more of these spyware simulators the anti-spyware detects the better it is (in theory)...
this idea came up before in the virus realm years ago and i'll direct you now to sarah gordon's paper are good virus simulators still a bad idea... i suggest reading the entire thing through but for now just scroll down to the conclusion and replace "virus" with "spyware" and it will be about as valid...
essentially, for testing the effectiveness of your security app, using simulators only tells you how good the app is at detecting simulations rather than the real thing... to assume that anti-spyware vendors won't simply add signatures for the simulations is naive, especially when their work starts being judged on how well it detects the simulations... there's no way this effort on it's own is ever going to force the vendors to improve their generic detection techniques, it's just not a cost effective way for the vendors to deal with the simulations...
as for using these things as test files to see if your anti-spyware app is installed correctly (as their namesake the eicar standard anti-virus test file was intended for) the anti-spyware vendors could just as easily use the eicar test file directly for that purpose... there's no need to implement any particular behaviour in the test file if all you're doing is checking if the app can detect something it already knows about; it's not like the eicar test file has any virus-like behaviours, nothing of the sort was required to test the sanity of an installation, all it does is display a string of text on the screen (at the command prompt) when executed...
clearly, if folks in the anti-spyware field are just now coming up with an idea that was debunked in the anti-virus field over a decade ago, the anti-spyware field isn't anywhere near as mature... the question is are the anti-spyware principals looking into learning from what the anti-virus community and industry have already figured out?...
the idea, basically, is that a bunch of these tiny applications could be written that each do some small spyware-like thing... supposedly this is meant to test how well an anti-spyware app can detect spyware they don't already know about - the more of these spyware simulators the anti-spyware detects the better it is (in theory)...
this idea came up before in the virus realm years ago and i'll direct you now to sarah gordon's paper are good virus simulators still a bad idea... i suggest reading the entire thing through but for now just scroll down to the conclusion and replace "virus" with "spyware" and it will be about as valid...
essentially, for testing the effectiveness of your security app, using simulators only tells you how good the app is at detecting simulations rather than the real thing... to assume that anti-spyware vendors won't simply add signatures for the simulations is naive, especially when their work starts being judged on how well it detects the simulations... there's no way this effort on it's own is ever going to force the vendors to improve their generic detection techniques, it's just not a cost effective way for the vendors to deal with the simulations...
as for using these things as test files to see if your anti-spyware app is installed correctly (as their namesake the eicar standard anti-virus test file was intended for) the anti-spyware vendors could just as easily use the eicar test file directly for that purpose... there's no need to implement any particular behaviour in the test file if all you're doing is checking if the app can detect something it already knows about; it's not like the eicar test file has any virus-like behaviours, nothing of the sort was required to test the sanity of an installation, all it does is display a string of text on the screen (at the command prompt) when executed...
clearly, if folks in the anti-spyware field are just now coming up with an idea that was debunked in the anti-virus field over a decade ago, the anti-spyware field isn't anywhere near as mature... the question is are the anti-spyware principals looking into learning from what the anti-virus community and industry have already figured out?...
Wednesday, March 22, 2006
stopbadware.org should check their own sources
in the recently released report on kazaa, stopbadware.org states:
unfortunately, if they'd actually read the anti-spyware coalition's glossary they'd know that in technical settings the anti-spyware coalition uses a definition not unlike sharman networks' definition...
this isn't a deal-killer... at least some of the adware bundled with kazaa is also spyware (even by narrow definitions like my own or the anti-spyware coalition's narrow spyware definition), so sharman networks' claim of no spyware is false...
the problem is what is being communicated to the reader... stopbadware.org is using wikipedia's entry alone as their definition and in my experience wikipedia is not a good authoritative source (a fine informative source, mind you) on much of anything malware related... as the anti-spyware coalition's glossary clearly states, that is not the industry agreed upon definition for spyware - it is a colloquialism that they are forced to recognize in popular usage...
so what? well think about this: with the people backing stopbadware.org, they are invariably going to be regarded by most as authorities in the field - so their use of colloquial definitions rather than formal technical definitions will only serve to reinforce the misconceptions those colloquial definitions represent and lead astray those members of the public who are actually trying to distill meaning out of the various souces in this field...
part of me is tempted to say oh well... after all, what do you expect from people who invented the term "badware" (apparently not aware that the "mal" in malware comes from latin and means "bad") to describe "malicious software that tracks your moves online and feeds that information back to shady marketing groups", which basically boils down to advertising-related spyware (which is a much more descriptive term, come to think of it)... but you know what, misinformation coming from a source this high profile and seemingly authoritative is just not a good thing...
Sharman Networks claims that Kazaa has "NO SPYWARE", based on a highly restricted definition of spyware (namely, that no personally identifiable information is sent by the program). However, Kazaa's installation includes several bundled programs that are considered spyware under the common definition of spyware as software that subverts the computer's operation for the benefit of a third party (see Anti-Spyware Coalition and Wikipedia's article on "Spyware").
unfortunately, if they'd actually read the anti-spyware coalition's glossary they'd know that in technical settings the anti-spyware coalition uses a definition not unlike sharman networks' definition...
this isn't a deal-killer... at least some of the adware bundled with kazaa is also spyware (even by narrow definitions like my own or the anti-spyware coalition's narrow spyware definition), so sharman networks' claim of no spyware is false...
the problem is what is being communicated to the reader... stopbadware.org is using wikipedia's entry alone as their definition and in my experience wikipedia is not a good authoritative source (a fine informative source, mind you) on much of anything malware related... as the anti-spyware coalition's glossary clearly states, that is not the industry agreed upon definition for spyware - it is a colloquialism that they are forced to recognize in popular usage...
so what? well think about this: with the people backing stopbadware.org, they are invariably going to be regarded by most as authorities in the field - so their use of colloquial definitions rather than formal technical definitions will only serve to reinforce the misconceptions those colloquial definitions represent and lead astray those members of the public who are actually trying to distill meaning out of the various souces in this field...
part of me is tempted to say oh well... after all, what do you expect from people who invented the term "badware" (apparently not aware that the "mal" in malware comes from latin and means "bad") to describe "malicious software that tracks your moves online and feeds that information back to shady marketing groups", which basically boils down to advertising-related spyware (which is a much more descriptive term, come to think of it)... but you know what, misinformation coming from a source this high profile and seemingly authoritative is just not a good thing...
Tuesday, March 21, 2006
practical suggestions for bundling adware
i was reading a blog post over at stopbadware.org about adware bundling and it struck me that there doesn't really seem to be much in the way of constructive practical suggestions for those software developers who are in the unfortunate position of needing financial assistance from an adware company...
as the stopbadware post suggests, if the adware you bundle with is bad you are going to be held accountable for it's actions because you chose to bundle it so lets go through some steps that may help to avoid that...
i know that sounds like an aweful lot of work but guess what, there's no such thing as a free lunch and making the choice to bundle adware isn't a way to get free money...
i don't know how easy it will be to find an adware provider that meets these requirements, perhaps there aren't any yet but you know what? adware companies don't get any money unless people bundle their software so as much as you may need them they need you too so don't be afraid to put some pressure on them to get the terms you want, eventually an adware company will come along that's willing to do business on those terms if there's enough demand for it... they're businesses after all and they have to bend to market pressure or go out of business... it's just another form of voting with your wallet...
and what should you do if you still feel like you have no leverage over the adware company? do what many groups of 'little guys' have done before you - organize... find like-minded software developers who also need the help of an adware company but are uncomfortable with the typical adware's shenanigans and go after what you want as a united group... and i'm not just talking about folks who haven't signed up with an adware company yet; there are plenty of folks who came before who wish their current agreement with their adware partner was better than it is - these are people who are in the market for a new adware partner and so can be added to your collective voice...
as the stopbadware post suggests, if the adware you bundle with is bad you are going to be held accountable for it's actions because you chose to bundle it so lets go through some steps that may help to avoid that...
- be up front about the presence of the adware, say right on your front page or on your download page (and not in a small font) that the software is ad supported... you should even go so far as to specify the adware provider so that people downloading your product know what they're getting... i know this will probably drive away customers because of the bad name adware has (often deservedly so) but if you don't tell them then it will be much worse for the long term viability of your product... better to have slow adoption than a big backlash...
- take personal responsibility for the quality of the adware you're bundling - make sure it's not buggy, make sure it doesn't contain spyware or take any other actions that would send personal information back to anyone, make sure it doesn't install silently/secretly, make sure it uninstalls cleanly, make sure it doesn't install anything unexpected or provide a platform for advertisers to install things secretly/silently through the ad windows themselves, make sure it doesn't interfer with what the user is trying to do by popping up lots of windows or playing with window z order or any other tricks to put their ads overtop of what the user is working on...
- make sure your contract with the adware company clearly specifies what kind of behaviour is acceptable from their adware so they can't play any kind of bait and switch game using an innocuous test version and an offensive upgrade, and make sure they can't change the terms of that contract unilaterally...
- research the company's history in order to get some idea of how likely they are to keep their word/not violate that contract, also to get an idea of what kind of ethics they've displayed in the past and how good they've been about fixing bugs and addressing concerns...
- keep up to date on issues relating to the adware in your bundle... for example if there's a bug, post information about it on your site and direct affected users to where ever they need to go to correct the problem...
- inform your users of the exact measures you go through to make sure the adware you're bundling with is safe for them to install...
i know that sounds like an aweful lot of work but guess what, there's no such thing as a free lunch and making the choice to bundle adware isn't a way to get free money...
i don't know how easy it will be to find an adware provider that meets these requirements, perhaps there aren't any yet but you know what? adware companies don't get any money unless people bundle their software so as much as you may need them they need you too so don't be afraid to put some pressure on them to get the terms you want, eventually an adware company will come along that's willing to do business on those terms if there's enough demand for it... they're businesses after all and they have to bend to market pressure or go out of business... it's just another form of voting with your wallet...
and what should you do if you still feel like you have no leverage over the adware company? do what many groups of 'little guys' have done before you - organize... find like-minded software developers who also need the help of an adware company but are uncomfortable with the typical adware's shenanigans and go after what you want as a united group... and i'm not just talking about folks who haven't signed up with an adware company yet; there are plenty of folks who came before who wish their current agreement with their adware partner was better than it is - these are people who are in the market for a new adware partner and so can be added to your collective voice...
Wednesday, March 01, 2006
what is spyware?
spyware is any program that reports information about you, your activities, or your system back to a 3rd party...
like adware, spyware can sometimes have legitimate uses... for example winamp can (if so configured) report usage statistics back to nullsoft... windows xp, upon encountering a crashed application will offer to send a memory dump of the application to microsoft... even your browser reports information about you back to the websites you're on so that those websites can show you data that is appropriate for you such as the contents of your online shopping cart if you happen to be on an online store's site...
as the name suggests, however, there are more sinister uses for spyware such as stealing passwords or credit card information... this type of spyware generally gets installed or reports to a 3rd party without the user's knowledge and/or permission...
spyware that spies on you without your knowledge and/or permission qualifies as a type of trojan... in fact, the term spyware is so pejorative that it is almost exclusively used to refer to those examples that also qualify as trojan horse programs...
there is a complication in the spyware landscape, however... this complication arises because sometimes the user of a computer and the owner of that computer are not the same person... some organizations use spyware to monitor what their workers are doing on the organization's computers and while the spyware qualify as a trojan in more conventional circumstances it's (arguably) not a trojan in these particular contexts because it has permission from the person/people who matter...
back to index
like adware, spyware can sometimes have legitimate uses... for example winamp can (if so configured) report usage statistics back to nullsoft... windows xp, upon encountering a crashed application will offer to send a memory dump of the application to microsoft... even your browser reports information about you back to the websites you're on so that those websites can show you data that is appropriate for you such as the contents of your online shopping cart if you happen to be on an online store's site...
as the name suggests, however, there are more sinister uses for spyware such as stealing passwords or credit card information... this type of spyware generally gets installed or reports to a 3rd party without the user's knowledge and/or permission...
spyware that spies on you without your knowledge and/or permission qualifies as a type of trojan... in fact, the term spyware is so pejorative that it is almost exclusively used to refer to those examples that also qualify as trojan horse programs...
there is a complication in the spyware landscape, however... this complication arises because sometimes the user of a computer and the owner of that computer are not the same person... some organizations use spyware to monitor what their workers are doing on the organization's computers and while the spyware qualify as a trojan in more conventional circumstances it's (arguably) not a trojan in these particular contexts because it has permission from the person/people who matter...
back to index
Tuesday, July 12, 2005
the importance of good definitions
Techdirt has an article on the recent attempts by a group of organizations to come up with an agreed upon set of definitions for spyware and adware... predictably, Techdirt gets it all horribly, horribly wrong...
the author feels that what the software does or doesn't do is immaterial - that any unwanted application that got on one's machine by unknown means should be classified as spyware... he's not the only one who feels that way but there's a BIG problem with this line of reasoning...
the problem is that classifying instances of software on the basis of how they make some nebulous real world group of users feel (which is essentially what the author's position boils down to) is ridiculously difficult on a number of levels... not only will countless millions be spent on navel-gazing exercises trying to divine whether a particular instance of software in a particular software bundle is going to be unwanted and unnoticed at install time by some fictional average computer user or one if his/her 3.2 kids, but countless millions more will be spent defending against a deluge of specious lawsuits on the grounds that each classification was arbitrary and prejudicial - ultimately leading to a system where the courts, rather than the industry decide which program is spyware and which isn't..
we're computer scientists, not mind readers - we don't deal with this eye of the beholder crap unless we absolutely have to - and in this case we don't have to... we already have an umbrella term for all bad software - it's "malware"... if we're going to classify software for anti-whatever purposes we need to do it based on functional definitions (definitions based on what functions the software performs rather than definitions based on guessing how users will react to it)... we already have one malware classification saddled with an eye of the beholder definition, it's known as the "trojan", and that non-functional catch-all definition has been the bane of anti-trojan detection for years and is probably the reason we've had to make so many other classifications because it's proven totally unworkable as a classification that people can agree upon... classification based on eye of the beholder type criteria excludes widespread agreement by definition...
functional definitions, on the other hand, are much more reasonable... no guessing is involved and legal defense is practically a non-issue - define something based on it's function and it becomes much more feasible to demonstrate that a particular thing belongs or doesn't belong in that class...
on reading the actual document that the group of organizations (the anti-spyware coalition) came up with i think that for the most part the definitions are reasonable but a little on the wordy side... adware, for example could be much more simply defined as any software that advertizes a product or service other than itself... likewise spyware can be defined as any software that surreptitiously collects information from the user's system and sends it back to a remote 3rd party...
they did miss the mark on rootkits again, but the most notable problem is their adoption of spyware as an umbrella term for just about all bad software... they justify this by saying that the public at large is calling it that but this is foolish; 2 years ago the public at large was calling all bad software viruses, 2 years in the future they'll be using yet another term... how will this system cope with that? better to ignore the foibles of the unwashed masses and simply strive for internal consistency... trying to accomodate terminology misuse by people who don't know what they're talking about will never work because the people who don't know what they're talking about will not be consistent over time - leaving those of us who do know what we're talking about having to guess what they're talking about regardless of how accomodating we try to be...
EDIT (07/19/2005): i retract what i said about their definition of rootkits - i don't know what i was looking at before but now it looks fine... turning spyware into an umbrella term is still bad though...
the author feels that what the software does or doesn't do is immaterial - that any unwanted application that got on one's machine by unknown means should be classified as spyware... he's not the only one who feels that way but there's a BIG problem with this line of reasoning...
the problem is that classifying instances of software on the basis of how they make some nebulous real world group of users feel (which is essentially what the author's position boils down to) is ridiculously difficult on a number of levels... not only will countless millions be spent on navel-gazing exercises trying to divine whether a particular instance of software in a particular software bundle is going to be unwanted and unnoticed at install time by some fictional average computer user or one if his/her 3.2 kids, but countless millions more will be spent defending against a deluge of specious lawsuits on the grounds that each classification was arbitrary and prejudicial - ultimately leading to a system where the courts, rather than the industry decide which program is spyware and which isn't..
we're computer scientists, not mind readers - we don't deal with this eye of the beholder crap unless we absolutely have to - and in this case we don't have to... we already have an umbrella term for all bad software - it's "malware"... if we're going to classify software for anti-whatever purposes we need to do it based on functional definitions (definitions based on what functions the software performs rather than definitions based on guessing how users will react to it)... we already have one malware classification saddled with an eye of the beholder definition, it's known as the "trojan", and that non-functional catch-all definition has been the bane of anti-trojan detection for years and is probably the reason we've had to make so many other classifications because it's proven totally unworkable as a classification that people can agree upon... classification based on eye of the beholder type criteria excludes widespread agreement by definition...
functional definitions, on the other hand, are much more reasonable... no guessing is involved and legal defense is practically a non-issue - define something based on it's function and it becomes much more feasible to demonstrate that a particular thing belongs or doesn't belong in that class...
on reading the actual document that the group of organizations (the anti-spyware coalition) came up with i think that for the most part the definitions are reasonable but a little on the wordy side... adware, for example could be much more simply defined as any software that advertizes a product or service other than itself... likewise spyware can be defined as any software that surreptitiously collects information from the user's system and sends it back to a remote 3rd party...
they did miss the mark on rootkits again, but the most notable problem is their adoption of spyware as an umbrella term for just about all bad software... they justify this by saying that the public at large is calling it that but this is foolish; 2 years ago the public at large was calling all bad software viruses, 2 years in the future they'll be using yet another term... how will this system cope with that? better to ignore the foibles of the unwashed masses and simply strive for internal consistency... trying to accomodate terminology misuse by people who don't know what they're talking about will never work because the people who don't know what they're talking about will not be consistent over time - leaving those of us who do know what we're talking about having to guess what they're talking about regardless of how accomodating we try to be...
EDIT (07/19/2005): i retract what i said about their definition of rootkits - i don't know what i was looking at before but now it looks fine... turning spyware into an umbrella term is still bad though...
Monday, July 04, 2005
the end of anti-adware/spyware software
it seems like only yesterday that microsoft stepped into the anti-adware/spyware business and now it's probably going to collapse...
why? well, the thing about adware and spyware in the past was, despite being a pain in the ass to remove they were relatively easy to detect... stand-alone programs or dlls that are discrete and easily removed, that use various registry or other startup tricks to make sure the the adware/spyware runs also gives away their location...
unfortunately, just as our cyber-innocence was lost 20 some odd years ago by the advent of computer viruses, some of it's final vestiges that managed to stick around are again under siege by file infecting adware...
you're probably wondering why i would take such an alarmist stance on this, since i rarely do so... the reason is simple - existing anti-adware/spyware technologies simply can't cope with file infection, it is in no way comparable to what those products were doing before, the only thing that can deal with file infection right now is anti-virus technology... so we're back in the position of needing the anti-virus industry to provide all-in-one 'solutions' again and the anti-whatever-else industries will be left in the dust because AV technology is neither cheap nor easy to develop and the AV industry has an incredible headstart...
this is actually really sad for the people involved... we had all these new types of threats and whole new industries spring up to try and deal with them, and then someone goes and adds file infection to them and it all falls down... the only 2 ways this won't happen is if file infection doesn't catch on as a big trend in adware/spyware, or if the anti-virus industry sits on their hands and (intentionally or otherwise) gives the anti-adware/spyware guys a chance to catch up...
of course, you could (quite correctly) argue that they should have seen file infecting adware/spyware coming and developed their products with that in mind, but that doesn't make things any less sad for the employees (who generally don't have a huge say in the architecture of the product) of those companies...
[edited to fix totally borked link - thanks for pointing that out nick]
why? well, the thing about adware and spyware in the past was, despite being a pain in the ass to remove they were relatively easy to detect... stand-alone programs or dlls that are discrete and easily removed, that use various registry or other startup tricks to make sure the the adware/spyware runs also gives away their location...
unfortunately, just as our cyber-innocence was lost 20 some odd years ago by the advent of computer viruses, some of it's final vestiges that managed to stick around are again under siege by file infecting adware...
you're probably wondering why i would take such an alarmist stance on this, since i rarely do so... the reason is simple - existing anti-adware/spyware technologies simply can't cope with file infection, it is in no way comparable to what those products were doing before, the only thing that can deal with file infection right now is anti-virus technology... so we're back in the position of needing the anti-virus industry to provide all-in-one 'solutions' again and the anti-whatever-else industries will be left in the dust because AV technology is neither cheap nor easy to develop and the AV industry has an incredible headstart...
this is actually really sad for the people involved... we had all these new types of threats and whole new industries spring up to try and deal with them, and then someone goes and adds file infection to them and it all falls down... the only 2 ways this won't happen is if file infection doesn't catch on as a big trend in adware/spyware, or if the anti-virus industry sits on their hands and (intentionally or otherwise) gives the anti-adware/spyware guys a chance to catch up...
of course, you could (quite correctly) argue that they should have seen file infecting adware/spyware coming and developed their products with that in mind, but that doesn't make things any less sad for the employees (who generally don't have a huge say in the architecture of the product) of those companies...
[edited to fix totally borked link - thanks for pointing that out nick]
Friday, June 25, 2004
terminology proposal
i hear a lot about people's machines becoming infected with spyware or infected with trojans or infected with adware or ...
i'm sorry, since when are these things considered infectious? if i connect to a network that has a spyware infected machine on it, is my computer going to become infected? how about if i share disks/programs/word documents/etc with such a machine? no, of course not...
VIRUSES infect, not spyware or adware or whatever... i realize people need a way to indicate that very bad software has been installed on their system but lets not confuse the issue by using terms that already have a different meaning in this field, lets try a new word shall we?
we could use "contaminate"... 'my machine became contaminated with spyware'...
but maybe "contaminate" is too fancy (thus "afflict" is also out of the question) or maybe just not pejorative enough... then the answer is simple - the word we want is "poison"... 'my machine has been poisoned with spyware'... that conveys that something noxious has gotten onto the system and it is quite pejorative...
i'm sorry, since when are these things considered infectious? if i connect to a network that has a spyware infected machine on it, is my computer going to become infected? how about if i share disks/programs/word documents/etc with such a machine? no, of course not...
VIRUSES infect, not spyware or adware or whatever... i realize people need a way to indicate that very bad software has been installed on their system but lets not confuse the issue by using terms that already have a different meaning in this field, lets try a new word shall we?
we could use "contaminate"... 'my machine became contaminated with spyware'...
but maybe "contaminate" is too fancy (thus "afflict" is also out of the question) or maybe just not pejorative enough... then the answer is simple - the word we want is "poison"... 'my machine has been poisoned with spyware'... that conveys that something noxious has gotten onto the system and it is quite pejorative...
Subscribe to:
Posts (Atom)