Spyware on One in Twenty Computers?

SpaceDonkey writes "New Scientist reports that researchers at the University of Washington carried out a scan of the campus network for signs of spyware. They found spyware lurking on more than one in 20 machines and also discovered a serious vulnerability in two of the four spyware programs they looked for."

Comments

Excuse me for speaking the obvious

[JoeBaldwin]

But isn't the spyware in and of itself the vulnerability?

Damn, people need to get tough on this shit.

Re:Excuse me for speaking the obvious

[Syrrh]

Damn, people need to get tough on this shit.

That's really it.

Why the hell are antivirus companies so reluctant to add anti-spyware functions? I mean, boo-hoo that Gator got so upset when they were accused of making spyware, but calling it anything less than a trojan is a lie.

Firewall products have been offering popup stoppers and activity reporting for a while now. It's really time for the AV publishers to step up and do their part by keeping these things from getting a foothold. It's not like they can get in any legal trouble for blocking someone's program, since it's up to the user whether they trust McAfee or HotBar more.

Heh

[niko9]

No mention of the computer OS or archs.

Nice.

Re:Spyware flaw

[gid13]

Funny, but makes you wonder how much was there that they didn't detect. And as much as I love Spybot S&D and to a lesser extent Ad-Aware, I wonder how much they miss.

Only one in twenty?

[DarkFencer]

Going by my former help desk experience at a college, and by experience with friends and families computers I'd expect three in twenty would be more accurate.

Though I tell people when I fix their computers from spyware, that I will do it once, put Spybot on their computers, along with Mozilla Phoe^H^H Fireb^H^H Firefox on their computers.

If they get more spyware from using IE over Firefox, then I'll charge them to take it out next time.

Insidiousness

[Klatoo55]

Most spyware remains undetected because it makes copies and backups of itself that are near to invisible. Although spyware is easily visible on 1 in 20, it is probably present in some form on almost every computer with an internet connection.

1 : 1

[JediDan]

If you run windows there are registry keys used to track your usage of windows media player (unless you remove them) thus, the ratio is a lot closer to 1 : 1 of every windows computer out there, more so with more recent windows OSes.
It's not the only program either, use a firewall and don't install software that you don't need.

Re:Spyware flaw

[Chess_the_cat]

That's why I believe this 1-20 number. This is a relatively closed system monitored by an administrator and most likely governed by a usage policy. Perform the same study on machines found in copy shops or in homes and I'm sure the results would be quite different.

Re:Spyware flaw

[Erratio]

I'd think the number would probably remain about the same (at least relatively). Pretty much every computer I look at now has been slowed down by Spyware/Adware, so it seemed low to me initially, but these are also all computers for people who are using Kazaa and other programs they download on the Internet. Virtually all of those people will be infected (except for the few who know better), but also considering business users and people who use the Internet little or not at all (or don't download programs) the number is lowered. Not to mention people that don't run Windows. The number's probably higher in college environments but relatively similar all things considered.

Bad spyware, bad

[fm6]

Well, if spyware ever gets any good at hiding, your joke will be for real -- and we'd all be in big trouble. Truth is, spyware is never all that sophisticated. That's half the problem: if spyware did what it was supposed to and just spied on you without drawing attention to itself, people wouldn't be so nearly pissed off. Yeah, they'd hate losing their privacy, but not half as badly as they hate having their computers crash.

When they say "defective", they mean that the spyware is crap programming. Which is hardly suprising. People who distributespyware are the same kind of idiots who are responsible for most spam. It's a kind of spam, really, since it's a way of indiscriminately spreading information. The information itself, whether it's a blurb for some penis enlargment nostrum or a piece of buggy code that generates useless statistics about what sites you visit, is basically useless. How do make money distributing something that's useless? You distribute a lot!

Study Flaw

[DynaSoar]

At least in terms of the conclusion drawn: "One in twenty computers with an internet connection may be harbouring unwanted "spyware" programs..."

Their sample was computers at a college. You've got a highly wired place with people using them for all sorts of things, and comparatively little training on what and what not to do. Plus you've got younger users, many of which aren't old enough yet to not know everything, and feel free to ignore the warnings and admonishments (mark it flamebait if you like; I've taught such people and run a computerized lab. I know what they do and how they think, and so did I back then). Plus, you've got installs and re-installs (the common fix for everything Windozish) often being done by student workers with as comprehensive training in system security as they have in nuclear reactor operations.

How about a major ISP asking customers to allow them to scan for them? How about running a similar study on a large corporate system where downloading and installing external software is far more likely to be noticed, and results in far more than "Geez, we told you not to".

Biased sample, bad result. It may be right, but without better data, it's still bad.

Re:Study Flaw

[lrucker]

You've got a highly wired place with people using them for all sorts of things, and comparatively little training on what and what not to do.

That also describes most sales & marketing departments, even at high-tech companies.

Re:Study Flaw

[El Volio]

You've got a highly wired place with people using them for all sorts of things, and comparatively little training on what and what not to do. Plus you've got younger users, many of which aren't old enough yet to not know everything, and feel free to ignore the warnings and admonishments...

That sounds like a pretty common representation of the average user to me. Although many users outside of education may not be "younger", many of the characteristics hold. In fact, I would say such a user might even be more common than locked-down corporate environments. And if a major ISP ever were able to do such a scan on their customer's hosts, it wouldn't be much different.

Is that a "biased" sample? Depends on what population you're comparing against. If you're extrapolating to corporate environments, then systematic differences from the true mean may very well exist. But if you're comparing against the population of all Internet users a potentially far more interesting and useful population to study, though more difficult as well then the bias is more difficult to measure.

the obvious question here is

[SweetAndSourJesus]

Why do you allow your users to install software?

Re:the obvious question here is

[daviddennis]

Because for better or for worse, I'm not a corporate drone. I believe users are people, not abstractions, and so I believe in giving them as much freedom as I can.

And I really, really don't like being called every time the clock drifts on one of the PCs and someone wants me to fix it.

I have better things to do than fixing it or installing software. So I delegate the power, and as much of the responsibility as people can bear, down to the users.

And users love me, because they know I have respect and sympathy for them.

I'm never going to be a Nazi-class administrator, even though I know it would solve a lot of my problems -- by, no doubt, creating newer and more frustrating ones.

D

Re:Spyware flaw

[glk572]

Way more than one in twenty. I would conceder my parents to be typical home users. I visit them every couple months, and when I do I give their computers a check up, part of this is running ad aware, and every time I do I find something. Last time I checked my mom's pc I found over 200 items, from almost a dozen pieces of spyware. She had so much crap that she had actually stopped using her computer because of all the pop ups. I'm usually pretty cautious, but will occasionally find spyware on my system, even though I have an antivirus that supposedly block's it.

If I were to guess at a number I would say that at any given moment that more than half of home computers running windows have some kind of spyware/adware running. This comes from helping out many friends with spyware related problems.

UW found so few instances because I'm sure that they limit users? ability to install software on their lab computers. As for dorm computers, many types of spyware can't be detected by a port scan, the only way to pick them up would be through a carnivore type system, even then not all of them would be found.

The only way to stop spyware is to start prosecuting the companies who make it; it should be pretty easy under one of the laws for protecting children on the internet. After all if opening popup windows advertising porn with every page load isn?t illegal under these laws what is?

Re:Type

[Anonymous Coward]

The truly scary thing is they don't care. The also have about 40 programs running on their systray, so it takes 15 minutes for their insanely fast computer to boot up, and its swapping out to disk constantly despite the fact they have 512 meg of ram!

I've noticed certain people will complain and tinker with their computer all the time, no matter how well it is currently running. Most others will just *ACCEPT* popups, spam, spyware, crashing, viruses, and so forth. I have called people to let them know they have a worm (but i call it a virus for them, so they dont get confused), their computer is constantly spamming everybody with virus laden email, blah blah blah. Sometimes they say "So?" These people should not own computers. Hell, they should not be allowed to reproduce

I Must Agree

[fire-eyes]

I gotta agree with this. I'm an admin and have to clean up this kind of crap both in the office and at customer sites.

Often times there are odd, often random errors in applications, and it begins to get worse. Or the system even if it's fast begins to crawl. I would say that 8 out of 10 times, it's spyware. In one case I found, according to SpyBot Search and Destroy (excellent tool by the way), 311 spybots and adware shits. This particular system went from the mouse barely moving on a 2.4GHz P4 with DDR ram to what it should have been.

User education is key here. But that is a depressing role to try to be educator, because it's almost all completely ignored.

there's a difference?

[NumbThumb]

Educating users and fighting windmills feel about the same to me...

Oh, wait... windmills at least do not say "but i didn't *do* anything! really!"...