Slashdot Mirror
The State Of Grayware On the PC
Checkers and Pogo writes "Grayware inhabits a murky area between pure malware and useful apps, and it's a growing problem. 38.1% of all malicious PC software falls into the grayware category, and so-called 'grayware 2.0' is targeting social-networking sites. Ars Technica's Jeremy Reimer notes, 'The "threat" of rogue applications like SuperWall wasn't immediately obvious: they seemed more like annoyances than real security risks. But as users entered more and more personal information into their Facebook accounts, it became clear that the possibilities for abuse were rampant. For example, because Facebook allows users to "tag" photos with the names of friends, it is possible for third-party apps to distribute photos that a user might only want to be seen by their inner circle of friends.'"
Yeah, WinAmp was bad. But I'll never forget the day in college when my roommate downloaded and installed BonziBUDDY on my computer!
That goddamn ad injecting mal-ware sporting purple gorilla that was based on the dead soul of Clippy can rot in hell for eternity!
There's "free" as in gratis and libre and then there's a third kind of "free" as in wake-up-in-a-bathtub-packed-with-ice-minus-one-kidney free.
My work here is dung.
These are the most popular examples of Grayware - avoid whenever possible:
-Norton anything
-Mcaffee anything
-Microsoft anything
-Myspace anything
-Facebook anything
-Sony anything
-iTunes
-"Quick"time
-Realplayer
Also:
-Never click on the duck
-Never click on the monkey
-Never click on the blinkenlights
-Never click on "yes" or "I agree" -If you still manage to get a popup, consult your country's extrortion laws
You've been warned.
The article defines this "greyware" "vectors of attack." PROTIP: If the software has any sort of vector to launch any sort of attack on any machine, it is malware, pure and simple. Calling it "greyware" is a whitewash of some dark stuff.
Ok, /.ers don't RTFA anyway but I'll sum up the 5 pages. History of malware...gator....trojans et al....there will always be malware that avoids detection...in the future mobile devices are going to be targeted more than they are now. Constantly updating browsers are good...yadda yadda...don't be stupid and be skeptical.
Tada!
Absolute power corrupts absolutely. indymedia
the software which would remember your passwords for you.
what could be more stupider than this software? I guess the people using it.
it was later found out it could easily phone home with your information. *BANGS HEAD ON DESK*
captcha: threats
For example, because Facebook allows users to "tag" photos with the names of friends, it is possible for third-party apps to distribute photos that a user might only want to be seen by their inner circle of friends.
I can't even conceive of a threat to national security larger than this!
“Common sense is not so common.” — Voltaire
Even coining the term 'greyware' is just a form of social engineering. "Oh it can't be THAT bad. I mean, it's grey, not black."
Malware is malware. If it looks like a duck and quacks like a duck, I call it a duck. There is no such thing as 'greyware'.
If we're going to start using the term "grayware" to describe software that falls somewhere between a useful application and a piece of malware, then we need to start using the term "blackware" to refer to malware, and "whiteware" to refer to useful software. By the same token, some software could be "light gray ware," other could be "dark gray ware," et cetera. Whiteware that contains exploitable bugs should be termed "off-white ware" and security software which would otherwise be termed whiteware but could be used by a malcontent for evil purposes should be termed "whiteware with black polka dots." We could further extend this concept to include whiteware that could be dangerous if misused, such as software that controls a nuclear rocket; such software would be termed "redware." Software that helps the environment would be called "greenware." Now all we need is something for "blueware" and we can use the entire color space to describe a computer program.
McCain/Palin '08. Now THAT's hope and change!
If I'm hired to analyze security for a bank and use the knowledge I acquired during my analysis to rob the bank, I'm only guilty of a misdemeanor?
Why is this modded troll?
Not only are some of these apps extremely annoying, including advertisements next to games and etc, its now very common for them to use incentives (eg extra levels or whatever) to get people to invite all their friends to the application. facebook's devs addressed it in a blog post but it remains a problem. the whole system looked bad from the start, so i personally reject all applications that aren't facebook related. even so, its to the point now where i'm thinking of shutting down my account.
http://www.gizmo5.com/
Gizmo's linux client looked OK. But, their Windows client looked like Grayware to me.
Then again, thats their client for Windoze - serves right..!
this joint has really gone downhill over the last 2 years
Sorry dude, my bad. We're getting some killer hydro next week, here have a toke.
seriously, look at the front page. I don't see another ars story and haven't for quite a while. Are you trying to troll? If so you really do suck at it.
mcgrew's razor: Never attribute to stupidity that which can be explained by greedy self-interest
... computer malware copy the lifecycle of their organic counterparts; some viruses and parasites, in order to remain in the host, evolved to grant some advantage to the host in question. The analogy in the computer realm is this "greyware" - the advantage being some valid function (legitimate program), and the parasitic or viral aspect being the malicious part of the greyware in question.
Not all viruses evolve in this manner, however. Some just entangle themselves so deeply it's impossible to remove, or to remove it would cause great harm. Fortunately, there's not many computer examples of the latter, but see cryptovirology for ideas how they might in the future.
I'm waiting for the other shoe to drop. When we hear that the NSA and CIA had ordered Facebook to enable backdoor plugins to every profile, every app, and every browser type used to reach FB.
Aggregating the information of a few million users will be NICE input to Visual Analytics...
But, why IS IT that Facebook apps need to KNOW almost everything about the user's profile?
Why cannot FB use some sort of restrictions database (I imagine they do to a POINT, but not as well as could our OUGHT to be...) to control access at not just the friend/profile/info-area level, but specific pieces of information?
Just because someone TAGS a photo shouldn't give them rights to KNOW too much. It would nice if one had an ability to annotate why the tagged or bookmarked a file, but then it could be dangerous if that stuff got scooped up by the various intel agencies. Imagine annotating revulsion or grudge info to someone, then some ill visited upon them and then the agencies demand records of any and all bookmarks attachments to said deceased/harmed person. Might help solve SOME cases, but would open up even more about some people than their profiles might suggest.
Just my thandom roughts...
Previously: "Linux... Toward the Sunrise..." Now: "Linux... Toward the-- No, now, part of Every Sunrise"
OK, so it's a nice history of malicious code. But calling it greyware is, as other have stated, simply ridiculous. Everything mentioned in the story qualifies as malware.
Greyware, to me, indicates software that is usefull, but may be frequently used by the proverbial bad guys to do harm. A fine example of this would be PSExec. I have this, and all the other PSTools, on my PC for work. I use them regularly to help me get my job done. Suddenly, Trend (our anti-virus appliance) decided PSExec was bad, labeled it as greyware and took it away (I have many copies). Getting the Powers That Be to leave my tools alone was seriously a pain in the ass! When Trend was updated to see PSExec as greyware, our appliance went nuts because I have it on, quite literally, all of our almost 300 PCs.
The point is, this legitimate tool can be used for evil, so it gets labeled as greyware.
Of course, this definition really is no better than the others. Following this logic, a gun would be greyware: useful for hunting, self defense, etc, but could be used for causing great harm.
As such, it's either malware, or it's OK; there is no in-between.
4 post's up from you talked about gator first
why you stealing anonymous cowards ideas for mod points?
douche
*ding*ding*ding* You win the thread! I needed a good laugh today. Too bad I don't have mod points. :-)
...when you're writing a game...tweak the difficulty of "Easy" to something [your mother] can cope with. -- onion2k
do you have to link every ars technica article?
Wow, none on Linux! No wonder people are switching...
Is grayware written using Gray Code?
Grayware at it's finest. Stay well clear off.
Russian Business Network.
Yeah, malware is bad, but if somebody thinks those photos are going stay "within their core circle of friends" when they post them on Facebook, they need their head checked. You know, people in your "circle of friends" have other friends too, that are in other circles of friends. They will surely get passed between the two groups. Even if that doesn't happen, somebody in your "circle" will have an insecure computer.
The bottom line is that if you think you can keep your photos private when posting them online, you are deluding yourself. An idea might be to not take them in the first place if you don't want them seen by others.
... and then they built the supercollider.
The FBI will finally be able to round up the millions of teenage terrorists here in the US. Thank god I took my pictures of my homemade plutonium detonator off Facebook else I would have been in serious trouble.
“Common sense is not so common.” — Voltaire
Blueware for porn. The circle is complete.
cyanware: hippy porn!!
yelloware: the colour of an Exon shareholder's trowsers on the day the hippies get a superpower
Now I'm wondering what magentaware is. (>_) I'm going to stop now.
thx e
Reimer's an idiot that's never even written a program himself. Reading anything from him about programs of any kind, from someone who's never written one (show me a program written by Jeremy Reimer online) is like reading about riding a bike from someone who has never done so, or reading about sex from a virgin. Quality reviews from arstechnica: The home of the "never done it myself but I will write about it and act as if I were some authority". What a truckload of crap.
The number of people with the abilities to write the core functionality in malware, especially rootkits and polymorphic vira, must be rather limited, so a way to combat these pests would be to go after these people personally and directly. Offer massive rewards to whoever reveals their identity and even more to whoever brings them into the hands of law enforcement. Criminals are always greedy enough to sell each other out so use that and take out the brains behind the malware. Sure, new brains will emerge and take over but they can be hit the same way, and when the job gets that risky a lot of talent will think twice and most likely move on to something else.
There's a few you forgot.
-All versions of Winamp after 2.81
-Adobe Acrobat
-AOL
-java
-99% of all "security" software (not just limited to Norton and Mcaffee, but those are the worst/most common!
-I'm sure I'm forgetting some more huge ones!
Also:
If you really want a very clean system, I suggest using Portable Apps (google it). Tons of great FOSS programs that will not touch the registry or do anything but run and only run when they are opened:
Pidgin
GIMP
Firefox 3 (Beta 5)
Open Office
Audacity
Sudoku
Texas Hold'em (Online and Free!)
UltraVNC
Infrarecorder (nearly as good as Nero now!)
Clamwin
Filezilla
Bonkenc
Virtualdub
Other than those programs, there are a few proprietary softwares that I must have, and there is sadly no open source alternative:
Winamp 2.81
uTorrent 1.5 (later versions are spyware)
Virtualbox
Urban Terror (though it is ioquake3, so I ALMOST trust it all the way (wish it was portable!)!
Joost
Cool Edit Pro 2.1
Sibelius
Dream Aquarium
Skype
And then there are a couple FOSS apps that I can't get portable versions of:
Mupen++
Zsnes
Using that list of software I can pretty much do ANYTHING on this machine, and I haven't had any spyware, malware, virii, or slowdowns at all.
Feel free to add whatever I forgot!!!
I hold very few opinions. I hold information based on observation and fact. If you wish to disagree, please use facts.
Bush is so unpopular it is almost impossible for us Republicans to win. Why even try!?!
I hold very few opinions. I hold information based on observation and fact. If you wish to disagree, please use facts.
That stooge from arstechnica, in Jeremy "fake it till you make it" Reimer? Reimer's just a fake that's never even written a program himself and yet writes about them??
/. editors. Funniest part is, it's not even funny. Jeremy Reimer's no authority on computing by any means. (After all, Jeremy Reimer has no certifications or degrees in computers whatsover, nor does he have years to decades of programming them, much less even network administration or tech tasks even).
TO THE SLASHDOT EDITORIAL STAFF:
That's a funny joke on your parts, but April fools day is long past,
Does Jeremy Reimer have years to decades of actual programming experience???
(No. He's not even a network administrator or tech)
Does Jeremy Reimer have a degree or even a certification in this field????
(Again, no. Not even an A+, much less an MCSE)
SARCASM: Yea, that Jeremy Reimer is an expert on programs alright (not).
Reading anything from Jeremy Reimer about programs of any kind, from some damn fake it till you make it like Jeremy Reimer (he's never written a program (show me a program written by Jeremy Reimer online))????? It's like reading about riding a bike from someone who has never done so, or reading about sex from a virgin. Any moron can spit back the statistics of others as well, which is about all the fake Jeremy Reimer does. Big deal.
Quality reviews from arstechnica: The home of the "never done it myself but I will write about it and act as if I were some authority".
No thank you. Everyone knows arstechnica's falling apart, and using this site to boost their sagging views counts only hurts this site. After all: Arstechnica does have an outright fake like Reimer as one of their "authors", what a joke. Don't take slashdot along for the ride by citing a fake here guys. It only hurts this website's credibility.
WARNING PDF go http://bt.ins.com/WorkArea/linkit.aspx?LinkIdentifier=id&ItemID=2665 to view
I also did an interview @ DarkReading.com http://www.darkreading.com/document.asp?doc_id=151382&WT.svl=news1_1 about the survey.
DISCLAIMER: I work for BT, but the survey is pretty unbiased IMHO.
Always value the individual over the system. --Bruce Lee "I don't need a Sig - I have a custom 191" - me