Spyware's threat to PCs is growing

MomSeattle · DadSeattle · SPI · MySeattlePix · My account

Local

US/World

Sports

Business

A&E

Life

Comics

Photos

Opinion

Blogs

Buy Ads

NWsource

Friday, November 5, 2004

Spyware's threat to PCs is growing
Stealthy programs keep unwelcome eye on computer users

By DAN RICHMAN
SEATTLE POST-INTELLIGENCER REPORTER

Pop-up ads that multiply uncontrollably, system slowdowns or freezes, mysterious redirection to Web sites you've never heard of.

If your computer displays any of these symptoms, you can blame an increasingly widespread type of malicious program called spyware.

Spyware succeeds spam -- junk commercial e-mail, which now makes up about 60 percent of all e-mail -- as the latest scourge to afflict the PC.

Spyware doesn't destroy anything. It just makes you want to destroy your computer.

Computer users -- especially those using Microsoft Corp.'s Windows operating system -- are already under pressure to install and maintain a layer of protection called a firewall, to regularly update their operating system and to religiously use antivirus software.

Now comes spyware, presenting another challenge and expense that computer users ignore at their peril.

Just ask Rob Bogart, 40, of Mill Creek.

"One night, I left my computer online all night, and when I came in the next morning, I had probably 400 pop-up windows," he said.

Now protected by a firewall and anti-spyware software, his computer has been clean for a month. But "every once in a while, I do get a pop-up, and I'm scared to death of it," he said.

The term "spyware" describes any program that, without the user's knowledge, tracks activities on the computer and then saves or transmits a record of them. Spyware infects some 80 percent of PCs, according to a study by the National Cyber Security Alliance and America Online Inc.

Several kinds of computer programs -- all annoying, though not necessarily dangerous -- are lumped under "spyware," according to anti-spyware makers. These include:

Adware: The most common kind of spyware, adware generates several types of ads, possibly keyed to the sites you visit on the Internet. May download programs onto your PC without your knowledge.
Adware cookies: Installed without your knowledge, these tiny pieces of code store information about your surfing habits. Can let marketing companies create and sell a profile of you.
Browser hijacker: Changes the settings in Microsoft's Internet Explorer browser, changes your chosen home page, redirects your searches. May render browser useless.
Dialer: Disconnects you from your Internet service provider and reconnects you to the Internet using an expensive line.
Keylogger: Records all the keystrokes you type. May let outsiders access your logins, passwords and credit card numbers.
System monitor: Records keystrokes plus e-mail, chat room conversations and instant messages. May be accessible to outsiders.
Trojans: Programs that let outsiders make changes to your computer. Might create or delete files, or install other programs without your knowledge.

It's easy to infect your computer with spyware. Most computer users do so by knowingly or unknowingly downloading file-sharing software, screensavers and free software such as songs, games or pornography.

Legally, software can't load itself onto your computer without your permission. But some programs ignore the law, while others offer instructions so long or confusing that users are misled into accepting the software.

Bellevue's 180solutions is making steady profits from developing and marketing software some call spyware. The company tracks the Web sites you visit, then puts pop-up ads on your screen based on those visits. Computer users say it's difficult or impossible to remove.

"180solutions is one of the worst spyware offenders," said consultant and Harvard law student Ben Edelman.

The company acknowledges making software that displays pop-up ads but has told the Seattle Post-Intelligencer that it is neither an adware nor a spyware company, describing its software as performing "contextual search marketing."

In July, it sued some of its own distributors in King County Superior Court for allegedly installing its software on PCs without users' permission. Spokesman Howard Barokas said the company is still awaiting the defendants' response to the suit.

Regardless of who promulgates the spyware, getting rid of it is much harder than acquiring it.

Some free anti-spyware programs have gotten good reviews. One is Spybot Search & Destroy. But sometimes offers of free help are scams, so use great caution in responding to them, experts advise.

Other fixes are available either on CD or an online subscription. These include Computer Associates' eTrust PestPatrol, LavaSoft's Ad-Aware, Tenebril Inc.'s SpyCatcher and Webroot Software's SpySweeper.

But none of them works completely, according to some reviewers -- even when several are used in succession.

The tenacity of spyware has led some to suggest abandoning PCs completely in favor of Macintosh computers, which use an operating system based on the venerable Unix.

"No computer is hack-proof, but Macs are not vulnerable in the way Windows are," said Bill Palmer, a Florida entrepreneur who makes a living writing about Macintoshes and Apple's iPod music player.

"This kind of crap just doesn't happen to well-built, well-designed operating systems," he recently wrote in his online log.

Microsoft disputes that assertion, arguing that spyware is enabled at least as much by "social engineering" -- deceiving people into doing things that harm them and their computers -- as by deficient technology.

Still, Service Pack 2 for Windows XP, released in August, has hardened the operating system against spyware by blocking pop-ups and unwanted software downloads, said spokesman Mario Juarez. And Microsoft's heavily financed research arm is devoting undisclosed resources to the problem, he said.

Taking a position in the middle, Jupiter Research analyst Joe Wilcox said Windows is less safe than the Mac's OS X operating system but is safer now than it was two years ago.

The fight against spyware is being waged on the legal front as well.

The SPY Act, House Resolution 2929, which passed in the House on Oct. 5, would direct the Federal Trade Commission to fine violators as much as $3 million for actions such as changing a Web browser's start page without the user's permission or collecting data on user's keystrokes. The bill is now before the Senate.

Similarly, the I-Spy Prevention Act of 2004, House Resolution 4661, would impose criminal penalties on purveyors of spyware. It, too, passed in the House and is on the Senate floor.

In the Senate, the Spyblock Bill, sponsored by Sen. Conrad Burns, R-Mont., is awaiting a vote.

The courts are beginning to clamp down on spyware. Last month, the Federal Trade Commission asked the U.S. District Court in New Hampshire to shut down a company allegedly pushing spyware on the Internet, according to The Washington Post.

Meanwhile, it's up to individuals to battle spyware.

"You get a firewall and you think you have protection, and they figure out a way around it," said Bogart, the Mill Creek computer user. "You have to keep going through the expense of buying and trying software to protect yourself."

HIJACKED

"Spyware" is any program that, without the user's knowledge, tracks computer activities, then saves or transmits a record of them. It can be used to generate ads keyed to Internet sites visited, reconnect a computer to expensive phone lines, even record keystrokes so credit card numbers can be stolen.

On the Web:
www.mcafee.com

www.microsoft.com/spyware

www.spybot.info

www.webroot.com

P-I reporter Dan Richman
can be reached at 206-448-8032

or danrichman@seattlepi.com

Add P-I Business headlines to