Slashdot Mirror
When Does Software Start Becoming Malware?
New submitter Da w00t writes: Talos security researchers detected a malicious shockwave flash file that not only bypasses pop-up blockers, but also accurately fingerprints computers with the help of some JavaScript. The 'Infinity Popup Toolkit' is a prime example of software that falls into this gray area by bypassing browser pop-up blocking. In deciding to classify the toolkit as malware, the researchers pondered where the line lies between software that's harmful and software that's not. Quoting: "Without a clear standard defining what is and is not acceptable behavior, identifying malware is problematic. In many situations, users are confronted with software that exhibits undesirable behavior such as the Java installer including a default option to install the Ask.com toolbar. Even though many users objected to the inclusion of the Ask.com toolbar, Oracle only recently discontinued including it in Java downloads after Microsoft changed their definition of malware which then classified the Ask.com toolbar as malware."
Toolbars are just the tip of the iceberg. All major browsers are malware because they don't isolate cookie storage (or all storage, really) between origin domains, breaking the same-origin policy. Third-party cookies then become data trojans. Intent is important here. It isn't just a vulnerability, but a design flaw continued by the fact that all major browser development is funded by advertising companies.
See for yourself how Mozilla refuses to fix a security vulnerability that is enabling billions to be made from stolen user data: Bugzilla bug 565965
# make clean sig
When I didn't ask to install it.
I would go one step further, any software is malware when it does something other than the user intended.
So... software bugs are all malware?
...gis sdrawkcab (usually not responding to ACs; don't bother posting as AC)
Well you are right there is technically a flaw in the definition. But it is a good concept though. How about 'by design does something the user did not intend'
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
When it:
1. Installs without permission
2. makes any unnecessary network connections
3. tracks the user and uploads any data not relevant to functionality (with or without permission, mandatory or not)
4. injects code into the bootloader, filesystem, or anywhere else that's not strictly necessary
5. localfunction/desktop software that requires the user to 'log on' to a vendor portal and/or has 'dead man' switches that require subscriptions (adobe suite)
6. abuses system GUI conventions (skinned applications)
7. is bundled with irrelevant 3rd party plugins, addons, or extensions for marketing purposes (browser search toolbars, apple itunes/quicktime on windows etc)