Slashdot Mirror
Most Web Users Unable to Spot Spyware
Ben writes "According to a Spyware Quiz conducted by McAfee SiteAdvisor , a staggering 97% of Internet users are just one click away from infecting their PCs with spyware. One interesting conclusion from this study showed that even users with a high "Spyware IQ" have a nearly 100% chance of visiting a dangerous site during 30 days of typical online searching and browsing activity."
That has to be wrong, somehow. A lot of the people I know only go to trusted sites, virus-scan everything, etc etc. It only takes common sense and a slightly focused attention span to keep your machine clean.
McAfee will sell me the software to help save me.
Well, I wager that even though 100% of these "high IQ" users may visit one of these sites, 99.99% don't become infected by it.
That's why I'm using VMWare's non-persistent feature so that my internet-facing OS is always the same, except after updates have been installed.
Please stop entering code 2,2,7,6,6,4
But Mac and Linux users comprise more than 3% of Internet users!
The quiz in question has you choose which of two sites, based on screenshots, has spyware. The sites were all for things like screen savers, song lyrics, and free game downloads. That is a terrible, terrible way to judge a users capability to determine if something has spyware.
One interesting conclusion from this study showed that even users with a high "Spyware IQ" have a nearly 100% chance of visiting a dangerous site during 30 days of typical online searching and browsing activity.
Sure, we like to visit places like http://www.cracks.am, who actually write their own spyware. But I am not so sure that qualifies me as ever installing any of their garbage.
"When life gives you lemons, don't make lemonade. Make life take the lemons back!" -- Cave Johnson
How exactly does that matter if less than 97% can get infected with spyware, or were they only testing people with systems that didn't safeguard against such? I would assume more people are careless about such things because they have anti-spyware software installed or are running an OS other than Windows.
*Click*
Clearly the message is to just give up and pay the anti-virus/anti-spyware people a bunch of cash.
The real way to combat this is to hold website owners responsible if they are hosting such malware.
Free pr0n? Free laptop? Free Ipod? Yes!! *clikc*click*click*! 97% of internet users think free truly means free.
This is just like a "spot the phishing email" quiz I saw. Just looking at a picture gives you no context. Did you get the link from a reliable source? What OS/browser are you running. (I'm definitely more willing to check out something suspicious in Safari than Internet Explorer.) Are you dumb enough to download and run something from the site.
It contains no technical information or interactivity whatsoever. No status bar information, no ability to view page source, just screen grabs of random web sites.
This is a completely invalid, unsound test, as there is no technical way to determine the presence of malicious software simply by looking at a page as it initially loads in the absence of any ability to interact with it or at the very freaking least scroll up or down or hover a mouse... sheesh...
It's like blindfolding someone and then blaming them for not being able to catch a baseball pitch, facing away from the thrower, with their bare hands. Of course they won't be able to, if you take away every single useful tool for them to accomplish the task.
STOP . AMERICA . NOW
This quiz doesn't measure anything. Where's the option for "Both of these look suspicious and I wouldn't go near either of them"?
Since the quiz requires JavaScript, and since I have that by default disabled, I think I passed the test.
'Yes, firefox is indeed greater than women. Can women block pops up for you? No. Can Firefox show you naked women? Yes.'
I thought the site with active x spyware was a trick question. They clearly use Firefox and therefore don't suffer from such nonsense.
The quiz (http://www.siteadvisor.com/quizzes/spyware_0306.h tml) asks questions like "Which of these smiley download sites is safe?" The answer I'd pick is "I don't care which one is safe, I wouldn't ever download something so pointless and high risk to begin with", but that option isn't available.
Seriously, is McAfee trying to imply that some executable code you download off the Internet from people/organizations of unknown repute is safe?
BTW, if 3% of people answered their questions correctly, that means that 5 of 8 questions effectively had 50% odds. For example, if 50% of people were able to get questions 5-8 correct, and everyone just flipped a coin to answer questions 1-4, you'd get a 3% all-correct rate.
Give users a cool, savvy looking test that makes them choose between two equally suspicious looking webpages, then reveal their horrible results. Oh no! But with SiteAdvisor, never fear... you'll have a handy site report to base your decisions off of!
/. as an indicator it's a shameless plug for their product, except the majority of intelligent Slashdotters is hardly prone to falling for this.
Yes, easy to see what the purpose of this test REALLY is... promotion promotion promotion! I'd even point to the fact that this is on
Then again, what do I know? I got a 5 out of 8 on the quiz. Boy, am I a dumb intarweb user! Better go install that SiteAdvisor after all...
I love it.
McAfee claims that one of the lyrics sites has "delivered adware through ActiveX" via Firefox.
Notice the Top Right of any pic. Thier FireFox is out of date.
And that is just another reason I don't use McAfee.
I came across a 7th grader who managed to load up a Win98 machine with 14 different pieces of spyware with 1 click in IE. We wiped the machine with an industrial strength removal program, installed Firefox, locked it down, and asked her to go out to the same website. NOTHING - not one single piece of spyware - got through on Firefox. At that moment, I converted for life.
Most Web Users Unable to Spot Spyware
Well, I guess that's why they call it spyware, don't they. I mean, what kind of spy would be easy to spot? Wouldn't be a very good spy, now would he.
The higher the technology, the sharper that two-edged sword.
Most web users are unable to tell what browser they are using. Or operating system, for that matter.
Support: What web browser are you using?
User: Microsoft Excel.
Support: Okay, what operating system are you using?
User: Um... Dell?
Find environmentally and socially responsible products on http://buy-right.net
I went to each one of the sites before answering. I still missed two of them.
:) And Kazaa has a long history of being full of crap that's bad for your system. Ugh.
First I missed the lyrics sites. One of them supposedly installs activeX adware. I couldn't tell this since I'm using Firefox in Linux.
Then I missed one of the P2P software sites. I incorrectly decided that Blubster was safe, even after looking through the site. They do mention that they take information given when you fill out a contact form, but I didn't see any mention in the terms of use or privacy policy regarding anything in the software itself.
Of course, I would have never actually downloaded that in the first place. I knew emule was safe though. Yay open source!
So yeah, I missed 2 of them, but would not have been infected by any of the bad sites. Mostly I just think this quiz is lame.
Nothing to see here
let's go through the quiz (if you want to see for yourself untainted, do so before reading this):
the first 4 questions have you determine which of two sites is safe, based on screen shots.
question 1: choose between two screen saver distrobution sites. like all the others, it's just a screenshot, and doesn't even show the whole front page, let alone users look at other pages. the only decernable difference is that the first one looks more professional, so heeding the remarks in the article that said most users seem to think that means it's safe, and "reading between the lines," I picked the other one, since there was no logical way to decide. I was wrong.
question 2: smilies. the one on the right looked more professional, and said "NO UNWANTED SOFTWARE" in a very easily spotted location, with big letters, and the other in regular sized font, in the bottom right, had a half cut off message that pretty clearly stated (even with incompete sentances) that it contained spyware, so I picked the one on the right, this time with some actual info to go on. I was right.
question 3: free games. the sites had no noticeable differences in professionalism, no warnings or advertising of spyware freeness either way, nothing to go on that really made any sense to actually use, so I decided that TotallyFunFreeStuff was trying to hard, and was probably hiding something, and picked the other. I was right.
question 4: Lyrics. important to note that this one used active X, so it's irrelevant to anyone who's not dumb enough to still regularly use IE anyways, which now that I mention it, I think I'll soon put a rant about McAffee and that that in my Journal (will be a first entry,) but it's to much of a tangent for this post. anyways, the one on the left looked more professional, and the one on the right had a "firefox blocked a popup" message on it, so I picked the left (entirely because of the message, I continue to mention the professionalism because the article made a stink about it.) I'd like to note that the thing I took as a tip off wouldn't be availible if I were seceptable to this at all, as it's a firefox message, which doesn't do active X. In any case, I was wrong.
the last 4 questions had you determine whether a file sharing program was safe based on the usual screenshot of the webpage.
Bearshare: site looks professional, there's a link for a "FREE Sponsored version," sponsored sets off a red flag in my mind, I say no. I'm right.
eMule: worst site design of the four astheticly, says it's open source, I've heard of it, I say yes. I'm right.
blubster: pretty sleek front page design, though it feels like a splash screen, so there's almost no information. nothing to go on really except that it says it's 100% free, which given the fact that OSS/Free software tends to advertize itself as such, and they didn't, probably meant add supported, but for some incomprehensible reason I still picked yes. I'm wrong.
Kazaa: slick page, big "NO SPYWARE" label on the font page, there's a main section for the privacy thing, which I bet a lot of people would have looked at if it were a page, not a picture, but instead just trusted it because the label was all they had to go on. I was familiar with the software though, so
No single raindrop believes that it is responsible for the storm.
Most www users are not geeks and cannot tell the boundary between their computer and the internet, let alone know how to drive a hosts file etc. Any advice of this form is completely useless to most www users. If the computer says "click on this" they will. Don't expect them to tell the difference between something from MS or the OS and a phishing scheme or other attack.
It is also not reasonable to say that people should know this stuff to use the www. Nonsense! Do you need to know the difference between a knit and purl stich to wear a sweater? Do you need to know what advance and retard are to drive a car? Why the hell should you know what a hosts file is to use the www?
Engineering is the art of compromise.
By analogy, this quiz is the rough equivelent of having people pick from a group of crack-head prostitutes the one without disease, and when they fail, telling them they know nothing about safe sex. Safe sex, like safe browsing, ended before the the first question on the test. There is no safe sex by trying to pick only the disease-free crackhead prostitutes. There is no safe browsing by trying to pick the free smilies site that won't blow your computer up. There is value in mininimizing risk where it's found, but to me, safe browsing and downloading FREE SMILIES!!! from some popup window are mutually exclusive activities. That said, their product does have merit, probably. I just wished it was marketed as what it is: "You're a dumbass, and are going to do dumbass things. Maybe you need a net."
exceptio probat regulam in casibus non exceptis
I get the point that when you go to a screensaver site and see 2 menupoints and 4 screensavers, that is suspicious, ....
,,, )
but in most cases they seem to tell me, that a simple design vs bling means that the simple design will sell you spyware
dunno, i think any download is a potentional spyware, especially the spyware programs (that my wife installed on her mom's computer adter a popup : your computer mught be infected
well at home she uses linux so did not get a clue......
ohh that crap also has the important message: all p2p programs are spyware laden....
For sites that direct your browser to an IP address URL this hosts file does nothing. (http://123.22.33.44/grabyoubytheshorthairs.php)
1. We present you with a 32x32 pixel cropped screenshot from two sites. One of those contains dangerous spyware! Which one is it!
*click*
Ahahah, it's both you loser!
Now go buy our software.
2. Next question: what you see is 32 bytes from two EXE files. Which one of those installs adware?...
-Cypheros
I took my usual paranoid route. For the first four questions, I didn't select either site (which, as it asks which site you trust, seems to me to implicitly state that I don't trust either site). For the last four sites, I specified that all of them potentially had spyware.
My result? Well, acccording to this "survey" I only scored 3 out of 8, as my not trusting sites which didn't have spyware (as they could find) counted against me, and I distrusted one site which the survey claims has no spyware. So apparantly, because I don't trust ANY of the 8 sites referenced in the survey, I'm "At Risk", and my "...answers would have infected your PC with adware and spyware many times over.".
Uh huh. Not trusting any of the 8 sites is putting me at risk? Spyware and adware many times over? Let's ignore for a moment that I'm running Mac OS X, and that I wouldn't visit any of those sites in the first place, and don't download screensavers, wallpapers, or smilies, but apparantly according to SiteAdvisor my distrust of all their sites puts me at risk.
And that right there is enough to tell you the quality of this so called "survey".
Yaz.
If you're not on windows, you're probably not going to be visiting mcafee's site.
it should read "3% of visitors to mcafee's site who took a spyware quiz are unable to spot every spyware site from a screenshot of part of the webpage."
--TheOrangeSquid Is it any wonder things seem so awry? We swim in a sea of confusion and don't have to think to survive
The reason is simple. The test is loaded.
You are asked to choose between various free sites and have to judge just buy a screenshot wich one is save. That of course is very hard to do. Worse is that you can't choose the answer "none of the above" wich I think is the only real answer.
Frankly I wouldn't trust any screensaver or smiley site. Period full stop end of story.
Oh and as for people using virus scanners. Well yeah. Because others have hit them over the head and tied them to a chair and then installed the virus scanner for them and then trained them with a cattle prod not to remove it. They still go out of their way to make live hard for the virus scanners and still basically just get it.
Virus scanner == safety belt. Wearing a safety belt doesn't make you a safe driver.
It only takes common sense to keep your machine clean. Right the same common sense that tells you to limit your speed in dangerous road conditions?
Common sense is a misnomer because whatever it is it sure as hell ain't common.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
But that was not an option.
Anyway perhaps linux users are even worse. How many of use just install packages from your distro without ever checking who actually wrote them? Just because no-one included a spyware package yet doesn't mean you are being safe. Just lucky.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
If you restart firefox you see the following, you also see the agreement before downloading. I think we can assume they speak the truth, then it looks very decent. This is what you see for slashdot http://www.siteadvisor.com/sites/slashdot.org?safe s k
And this for astalavista
http://www.siteadvisor.com/sites/astalavista.box.
I think it looks very good and can give a good insight if a site is safe.
The agreement:
How SiteAdvisor Works and How we Protect Your Privacy
As you use SiteAdvisor's software, it checks our master database in order to display our safety ratings about the sites you visit. We do this because our database of safety ratings is far too large and too frequently changing for us to send it to you in advance when you download our software.
We never store information about where specific users go online or about what they do online. We do keep master anonymous logs of which sites our users visit so we can prioritize those sites for retesting. These logs contain no information about which users visited which sites -- no personally identifying information, and not even users' IP addresses.
For more information on how we protect your privacy, see our privacy policy.
Step 1: don't follow your sig's advice. (:
Whoever stated that signature sizes should be limited to one hundred and twenty characters can just go ahead and kiss my
No, that's the wrong approach entirely (a little knowledge can be a dangerous thing indeed), you can't possibly hope to keep track of all the hosts required, it's a losing battle.
The correct approach is to use better software, that blocks Spyware by design.
I found the test to be a classic push poll approach.
This is like lining up 16 Nigerian hookers, two at a time , and asking you you to screw one and see if you get AIDS. Well, statistically one in four has AIDS, so by the 16th hooker, you have AIDS -- guaranteed.
But, would you actually screw a Nigerian hooker? Not if you had any knowledge of what you're getting into.
Anyone who goes to a free screensaver website deserves every single virus they ever get. In fact, they deserve to be booted in the head.
The test is rigged in a fashion that ensures that even competent people end up in the mid-range.
In all seriousness, how many web savvy people are going to the types of sites they depict? None.
I scream. You scream. I assume that means we're both acquainted with the problem. We proceed.
In a recent study, a major condom manufacturer showed photos of men and women to internet users. Surprisingly, most people were not able to distinguish those with an STD from those without.
Conclusion: most internet users are in serious danger of contracting AIDS.
[note to moderators. this is a parody.]
I chose that ALL sites were unsafe (take no chances) and assumed they were risky.
Then the stupid quiz told me I was at risk. I call bullshit on the results--it doesn't account for "paranoid" mode.
I might know what I'm talkin' about, but then again, this is Slashdot...