Slashdot Mirror
Every 5th Call At Dell Is Spyware-Related
prostoalex writes "Financial Express quotes a Dell executive saying that spyware is installed on roughly 90% computers out there. Right now 20% of all Dell phone support calls are spyware-related. University of Washington research this March published a moderate estimate of 5.1% PCs running spyware."
I think it's probably somewhere in between 5% and 90%...
From the article Spyware-related phone calls now make up as much as 20 percent of all help calls, compared with just 1 percent to 2 percent in August, 2003
Is this because users are now more aware of the existance of spyware, rather than the actual 19% increase?
For instance, in 2003, Joe-granpa probably didn't know/care why his modem's blinking non-stop, but he does now.
Rock that crushes, Paper & Scissors that don't matter.
... and get rid of it if you do...
Spybot Search&Destroy http://spybot.safer-networking.de/
and Ad-Aware http://www.lavasoftusa.com/software/adaware/
BTW, be sure to update the definitions or you're going to miss a lot of spyware.
They really went the distance to get the results they wanted...
And 20% of them may be calling Dell for help, another 20% or 30% calls their ISP instead.
Saying Java is nice because it works on all OS's is like saying that anal sex is nice because it works on all genders.
It didn't answer how many of the computers were infected with any spyware program, just those four.
Most schools don't trust their educated college students with electric cooking elements. Think about it...
Well as for Mac's -- I don't know if it's part of the culture of the things or what, but there are TONS of mac appps out there that "phone home" to an extent that is generally not tolerated in PC software. A lot of apps even spew network traffic when they start/while they are running to enforce licensing between machines on the LAN. Rather than protest the vendors' applications, though, the community responds as it typically does -- with a ~$10 app named "Little Snitch" that catches this activity. I have never tested it either, but I kind of wonder whether or not "Little Snitch" phones home also...
...I fully concur with that estimation, if not higher.
At least 8 of the 10 computers that I fix follow this routine:
Update and run AV program, if possible.
Install Adaware, update, run.
Install Spybot S&D, update, run.
Run CWShredder.
Fire up a HijackThis! log and manually remove the leftovers.
I'm getting pretty damn good at filtering out the hijackthis logs, too.
Seriously, if you familiarize yourself with spyware removal, you could make a killing on the home PC market. Manufacturers won't help you with spyware. It's getting to the point where the retail chains and PC shops won't deal with it either; they'll simply offer you a format/reinstall.
You can get a Dell with no OS, and with FreeDOS in the box. Or you can get a Dell Precision with RH pre-installed.
I have been using DOS then Windows since 1984 and have never had spyware or a virus either. In fact I don't even run checkers constantly, just every few weeks to double check. (And for the record I have been doing Linux since late 1991 and not had anything there either).
If you are prepared to put the time and effort into it, it is all pretty easy. You don't blindly run or view stuff from other sources, you don't steal software (if you don't have the originals then you have no idea what you are actually getting), you pay attention to the dialog boxes that various programs display etc. Heck I even read the contents of those dialog boxes with legal agreements in them before clicking Ok or Cancel. Most people just don't do that, and as a result their computers end up with more "helpful" software than they otherwise anticipated.
To say that Linux by design is invulnerable is nonsense. It doesn't take too much to infect an individual user (remember they aren't reading those dialog boxes either). And notice how on many Linuxen, when you try to run an admin tool on your ordinary user desktop, prompt for your (sudo) or the root password and which then leaves a key icon in your panel. That is one thing that can be abused to go from ordinary user to root. In many cases a piece of malware could probably just prompt and the average user would type in the necessary password.
Quite frankly I don't know the answer. Signing stuff doesn't work. User education is futile - why should someone have to know about the internals of their computer, operating system, access and authorisation models? It probably comes down the programmers and user interface. Every time the software has to ask a question, it is being stupid. We need to continually work on the software meeting the user's goals without needing to be babysat, and especially without them having to make these decisions all the time.
I'd venture to say that most non-tech savvy computers have some sort of spyware/adware installed. Why do these people get it?
1) They accidently click on something they didn't mean to, because of a popup. It goes downhill from there, since many spyware programs act like virii and have some friends join the fray.
2) Users that hit porn sites. These are the black hole of spyware, and while I've told them "stop looking at the porn and you wont get this crap", and they say they don't, yet I see their Internet Explorer history and its just filled with porn urls.
While my parents are largely #1, I've switched them to firefox and its gone down dramatically. I still catch them using IE for things like OWA and a few other IE-sites (and they will re-use the browser window to do other things).
I simply got tired of deal with them calling me about "CoolWebSearch" and tons of other junk that pisses me off.
I use Internet Explorer *and* firefox to browse the web, and I never get *any* spyware - I just know what to look out for. I'd say at least 80% of the people out there don't.
It also helps if you surf the web as a non-priveldged account - those are, for the most part, invulnerable to spyware. Just as none of you would use any web browser on linux as root -
agressiv
A worm outbreak today is an acute disorder -- the bulk of the damage is done in one day, even a handful of hours or minutes. Even though recovering a business or department from it can take longer, the outbreak itself burns through the vulnerable population pretty quickly, and starves itself. Spyware, because it's rooted in long-standing bad security practices both by Microsoft and by Windows users, is a chronic disorder -- it doesn't just shut you down for a day or so; it degrades your online life over a long, nasty time.
To extend the analogy perhaps too far: A flash worm is like Ebola: it kills its victims quickly and messily and leaves a disgusting corpse. Everyone knows when it's in town because of the gory sacks of flesh lying around the streets. Spyware is like cirrhosis of the liver. It comes from doing something bad over a long period of time. It doesn't spread to others materially, though long-term excessive drinking (which causes it) can "spread" memetically in a population, as do bad Windows security practices. And, eventually, it causes the affected organ to be overwhelmed and just shut down.
The spyware situation today is one created by a nexus of influences:
The first two are well-known and I will not address them further. The latter are not.
What I call contract date-rape is the evil represented by so-called "end-user license agreements" and other documents which purport to represent agreements between software publishers and computer owners. The unethical business practice of software publishers is as follows: The computer owner buys a piece of software and installs it, only to find that it is designed so that it cannot be run without "accepting" an "agreement" which waives the owner's rights -- such as resale rights, rights to a refund for defective merchandise, or even free-speech rights. Then, when the software does something harmful and the owner seeks recourse, he is told that he "consented" to whatever harm was done, simply by the act of using what he purchased.
It is contract date-rape which puts the lie to that old FUD about open-source software: "But whom do you sue when it breaks and doesn't get fixed?" The owner of a computer using proprietary software under a Microsoft-style EULA does not have any enforceable rights against the publisher. Windows does break in many ways that Microsoft doesn't fix, but nobody is suing Microsoft for it. Why? Whether the EULA is in fact legally binding or not, both Microsoft and computer owners regard it as leaving Microsoft with no obligations.
(Of course, software was not always sold on "as-is" terms that were intended in law for used and defective products. Nor was it sold on terms that used copyright law as a cudgel with which to deprive users of rights such as fair comment and resale. Contract date-rape is not an endemic problem of proprietary software; it is one that proprietary software publishers have chosen for themselves.)
And it is the methodical use of contract date-rape which leads to the situation we have with spyware today. Spyware gets into a computer owner's property unannounced, alongside some piece of (presumably) desired software. It is a Trojan horse in the original sense -- sooner or later, it bursts open and out pour the soldiers of the enemy, who go about merrily burning w
I use my firewall as a snitch. Not only do plenty of apps phone home but so many of them that do still work perfectly well despite being blockaded from the internet. I do however get quite annoyed by applications that you configure to not use the internet that then still go ahead and try to access the internet.
I find it ironic that half of the stuff that Dell ships on their prebuilt computers makes computers run ust as slow as a lot of spyware. I know that when clients of mine buy a new Dell computer, they're disappointed at how slow it runs. Reformatting the HD always makes the computer run 10 times+ faster.
The spyware situation today is one created by a nexus of influences:
I can't argue with 3) or 4). But as for 1) [and it touches a little on 2)], we've been running Windows NT & Windows 2000 for more than five years now, and we've NEVER had a SINGLE piece of spyware installed on any of our systems. [Never had a virus or a worm either, although I hope I didn't just jinx myself by saying that.]
You know why? BECAUSE NONE OF OUR END-USERS LOG ON AS ADMINISTRATORS!!! That's it - it's that simple. They don't have Administrative rights, and they can't install spyware [or viruses, or worms]. [Of course, yours truly installs the latest security patches as soon as they appear, and has always had all of his users behind a fire wall, but that's not the important point here.]
If you surf the web as an Administrator [Root] on OSX, or if you surf the web as an Administrator [Root] on Linux, you're every bit as prone to this stuff as any Microsoft user surfing the web as an Administrator [or you would be, if those operating systems had large enough market share for the spyware people to be bothered with writing spyware for them].
I tried to set my friends up that way. It isn't hard, XP comes with that ability, even in the home version. Setting up is easy enough. Making it work is another matter though. Nearly half of the programs my friends want to run do not work correctly without administrator rights. This includes software for XP from Microsoft!
In the end I gave up, ideally they wouldn't use the administrator account except when needed, but practically their computer didn't work without it. Switching users takes time and is a pain. Not hard, and it doesn't take long, but annoying enough that I can't call it a solution.
Remember this is a home environment, not a work environment. They don't have someone checking out software from various competitors to see if it meets requirements. If Best Buy sells it they buy it, and expect it to work. (note that you can almost never return software after finding out that it doesn't work without administrator rights)