Slashdot Mirror
U.S. To Impose Spyware Control Laws
ArbiterOne writes "BBC has the story: A bill has been introduced into the U.S. House of Representatives to control the proliferation of spyware and malware. The proposed bill would force programs to inform the user before installing programs, and require that spyware be easily removed. A study by EarthLink found that the average user has 28 spyware programs on their computer!"
NONE!
Will this bill make it illegal for "copy-protected" CDs to add malware to your computer through autorun? Will they be required to make it easy to remove the malware?
I had once to repair a user PC (average Joe's) with about 1447 installed whatnot... (according to adaware) It was taking the darn thing 35 minutes just to boot up and was veryyyy slow when operating. And she was having quite a powerfull machine too..
It is a shame that things like this need to be made law.
I expect that spyware already falls under the Computer Misuse Act 1990 in the UK regarding modification of a computer system without the user/owner being aware.
As far as I am aware, these bits of software are viruses and should be treated as such. Including the writers of said spyware.
Why is legislation necessary here? this is a problem that could be solved with just a little technical nous.
Instead, we get another law, pretend it's enough, and find it's as toothless as the paper it's written on.
Once installed, it can redirect web searches, install bookmarks or bombard a user with pop-up ads tailored to other search terms. It can also drain computing power, crash a machine and, in the case of the most malicious spyware, steal confidential information
A friend of mine works for a technical call center for a large US hardware manufacturer. The contract he works on is supporting notebook computers.
A customer recently called in because his computer was running slow. After installing and running ad-aware and spybot, the customer had over 4600 spyware programs. Yes, you read that right, over 4600 spyware programs. It's a miracle that thing ran at all.
Legislation to curtail spyware is long over due. An operating system that is resistant to spyware is already available, and it ain't Windows.
Ruby on Rails Screencast
Why is it that the Beeb has the scoop on a pending US bill, before I can find this story in any of the major US media outlets?
"BSD: Free as in speech. Linux: Free as in beer. Windows 10: Free as in herpes." --Man On Pink Corner in #52607549.
The average WINDOWS machine has 28 spyware programs on it.
boycott slashdot February 10th - 17th check out: altSlashdot.org
It would be interesting to see what percentage of these "victims" used IE as their browser exclusively. I only use IE for sites written by fanboys which require IE. Otherwise, I use Opera. For kicks, I ran spybot on my pc at work and all it found were about a dozen cookies. The techie who suggested doing this says that the typical pc on our network has anywhere from 20 to 50 bad things. Go figure.
"Would it kill you to put down the toilet seat?" -- Maya Angelou
It is, but I can't see it being useful.
Unless it contains decent punishments of course, like say.. Dragging the Spyware foisting bastards out into the street and shooting them in the back of the head, or some sort of testicle electrode device (like a "home detention" prisoner, goes off whenever the spyware "calls home")
The earth is 98% full, please delete anyone you can!
It uncovered an average of 28 spyware programs on each PC scanned during the first three months of the year.
How exactly was Earthlink able to detect the installed spyware? Tracking outgoing requests that were related to known spyware apps? Or did they allow users to run software that reported back to Earthlink for this survey?
C:\>
H.R. 2929 Safeguard Against Privacy Invasions Act sponsored by Mary Bono.
It's been on Slashdot mentioned before, but a good starting point for this kind of legislation is Google's Proposed Software Principles defining what honest programs should be doing.
a lot of spyware already 'informs you'... its just that the average public just clicks right through all of the legal stuff anyway.
Of course, the definition of "spyware" is critical. Legislatures in the past have had a hard time defining computer-related terms without making them too broad (for example, is your web browser spyware? After all, it's sending cookies back to all kinds of web sites!)
Have you read my blog lately?
I am sure this new law will be a overwhelming success story like the recent CANSPAM act.
And now excuse me, I need to clean my Inbox again.
I wonder if this will destroy SunnComm's copy protected CD model? The CD installs software on a Windows machine without user permission to prevent them from accessing it directly. Obviously this can be bypassed with the infamous Shift Key "Hack" anyway, but it works for most people cause they don't know what it is doing in the background. This bill could force SunnComm to get the user's permission to install the software, and even Joe Shmoe could bypass it then.
28 pieces of spyware on the drive 28 pieces of spyware Go to download.com get a "Removal app" 29 pieces of spyware on the drive! _
But seriously, there are a lot of apps out there pretending to be "spyware removal programs" that are actually spyware themselves. ACCEPT NO IMITATIONS!
10 Bits= $.25
100 Bits= $.50
110 Bits= $.75
1000 Bits= 1 byte
I deal with a lot of spyware/adware at work, and one of the big problems is that the user usually has no idea why the advert windows are popping up, nor from where they're coming.
I'd love to see spyware makers be forced to provide a small link at the bottom of *each advert window* that says something like, "This advertisement is being shown to you by $NAME_OF_PROGRAM. Click here for more information." Then, you could click the link and be taken to a page with a brief description of what the program is and what it does, and how to remove it. If it was installed because you installed KaZaa or whatever, it should say so there, too.
Perhaps I should torture myself further by dreaming up more completely reasonable but totally impossible things...
28 spyware programs? No, that's not at all what Earthlink said. They did I study counting the number of spyware programs, adware programs and tracking cookies, and found an average of 28 per computer. Someone, either malevolently or ignorantly, decided to trumpet this as 28 spyware programs per PC. Even though the number seems on the face of it absurd (it is), most reporters and Slashdotters don't bother digging in & figuring out what the number really means.
So I don't know if the writer & editor thought it was funny or true, but either way, stating that the average computer has 28 instances of spyware is outright false.
Since we all know how technical majority of politicians are, I can just see them basing this whole bill on the definition of spyware. If you ask any of the companies that make spyware if their product is spyware, everyone will say that it isn't. This is just going to lead to millions of dollars being wasted on deliberations as to the definition of spyware etc.
This bill it just an attempt to treat one problem. Why don't they make an ethical software bill where all software is required to follow certain standards. Don't worry about the user being informed of the reporting of their personal info. There are too many ways to legally get the consent of the user like a 349575 page EULA. Just focus on things like being easy to find and uninstall. This would make all spyware as we know it illegal. Also, required all software list the legal name of the individual(s) or company that developed the software.
While I think that spyware and virus writers should be summarily executed, we all know that it is better to treat the source of the problem. Do something like imposing a small fine for every piece of software they install on your computer without giving you the ability to uninsall it with less than 10 clicks and no visiting a website (that doesn't exist) to complete the uninstall process. Figure $5 per violation, they'll be out of busines in no time.
If I drive fast enough at the red light, it'll appear green.
Do they mean 28 actual spyware programs? That seems pretty hard to swallow. Or do they mean 28 tracking cookies (which are OS independent).
-a
First, the BBC doesn't have a scoop. I've been reading about the story for days. This piece is almost certainly a pickup from Reuters or another agency. (If it was a Beeb piece, the story would have a Beeb byline.)
Second, you haven't seen it on the evening TV news because it isn't that much of a story. The bill, one of several on the same issue, made it through one House subcommittee. If it passes and is signed into law, then it might merit mentioning on "major US media outlets?.
If spyware wasn't in the news this week, you'd likely not be seeing this story get any play at all. The story is, in fact, getting play because it make a nice sidebar for the other story this week about most PC's being infested with dozens of spyware programs.
-- Slashdot: When Public Access TV Says "No"
"A study by EarthLink found that the average user has 28 spyware programs on their computer!"
:P
No, the average EarthLink user has 28 spyware programs on their computer
I'm head desktop geek for a publishing company in the United States, and I spend more time dealing with this crap than any other single problem.
:-)
I've been getting asked quite a bit lately what exactly it is I do when I clean up someone's machine. The problem is, while some of my techniques are easily documentable, alot of it comes from just eyeballing the situation and figuring out what doesn't look right.
I watch the Slashdot threads regarding spyware often and, until recently, have merely lurked. Today I registered, so I can share this with everyone. It may be a bit off topic, but let us be real - legislation isn't going to take care of this problem anymore than it has spam. Some of you probably know all this already, but I hope that those who don't get some use out of it. Obviously I can't take any responsibility if you screw up your computer, so be careful out there!
Note: Use Mozilla or Firefox. Not using IE will prevent 99% of all spyware infection. I highly recommend it, for yourself and your friends and family. This is the number one step you can take to prevent spyware and hijacking, as well as preventing weekend trips to the inlaws/cousins/siblings to clean up their infected machines
What is Spyware?
Spyware, Adware, Malware, Crapware, Roachware (because just when you think you've gotten them all...); all of these terms refer to a virus-like category of software which is placed on a computer for the purpose of generating revenue, usually either by displaying popup ads, redirecting search requests from within the browser, or collecting demographic information.
The programs themselves can end up in a number of different places:
- As an item in the Run key in the registry (the listing of startup programs you
see in MSConfig) - Specifically,
HKEY_LOCAL_MACHINE\Software\Microso ft\Windows\Curr entVersion\Run or
HKEY_CURRENT_USER\Software\Microsoft\Windows\C urre ntVersion\Run
- As a Browser Helper Object (BHO), a class of ActiveX control originally designed for extensions to Internet Explorer, such as Toolbars. The Google Toolbar, Yahoo! Companion, and Acrobat Reader plugin are all examples of BHOs
- As a link, EXE or DLL file which is placed in a URL, such as a default Search URL or the Home Page. IE uses a set of URLs to control its automatic search behavior. When these URLs are triggered - or the home page is opened - either the page is opened containing ads which the URL is designed to impress, or the EXE or DLL is called to generate popups, verify it is still installed, etc
- As a registered DLL which is loaded on startup as an operating system component (Nasty!)
For the executable files loaded on startup, these programs - in addition to their main ad generating function - will generally check to see if their components are still properly installed, and if they are not, they will reinstall themselves. This is why you will often see spyware mysteriously come back after you think you've succeeded in removing it.
Many of these programs will also alter Home Page and Search URL strings, so that every time the browser is opened or a search takes place, an ad impression or page hit is generated by the program's controller.
The nastiest of all these programs will have more than one process running at any given time, watching its companion processes - so that if you kill one, its partner launches itself again. It's like Whack-a-Mole, but without the cheap prizes they give you for tickets.
Most of this stuff gets installed piggyback with things like Comet Cursor, browser "skinners", various toolbars, downloadable games, etc. The nasty ones, however, will use security holes in IE to install themselves without the user having any clue. Others act as "gateway programs" - once one of them gets on, the others get carte blanche.
Now that you've got the basics on what this stuff is, it's time to look at removal techniques.
*** formica has quit IRC (connection reset by phear)
don'tcha just love it when one hand of Corporate America Chops Off the other hand? It's kind of like watching a slow motion train wreck, or a circular firing squad.
RS
Shoes for Industry. Shoes for the Dead.
A good portion of my day is spent dealing with spyware. I've noticed that in the past several months it has gotten worse, in some cases far worse.
A law in the United States will only affect those companies with a legal presence in the United States. Many, many companies that offer software aren't in the U.S. Even if the law is effective on companies here, it will just migrate to somewhere that it isn't regulated and those Kaaza type companies will still be immune.
While I hope you are right, I think that you are wrong and I guess that my attitude is that it is probably better dealt with using technology than laws. The loopholes in technology are easier to close.
My ideal solution would be a system that would detect all types of malware and security threats and know how to fix them automatically. I'd like to see one component be "forward looking" where it would monitor computers and forward suspicious activity to a database that would be used to identify new threats in an almost real time manner. Of course this in and of itself could be considered "spyware" by some (because it would be reporting activity on your computer). But if all of a sudden xyzabc.dll started appearing on hundreds of computers in a short period of time, a human could evaluate it and figure out if it is a threat. If it is, it could be blocked on uninfected machines.