SpyWare! Chuck Short CS522 – Fall 2006 Semester Project Presentation Professor: Dr. C. Edward Chow
Agenda Define SpyWare Define SpyWare Discuss methods used for spying Discuss methods used for spying Focus on passive tracking methods Focus on passive tracking methods Demonstrate one passive method Demonstrate one passive method Discuss prevention Discuss prevention Conclusions Conclusions
SpyWare Definition SpyWare is a general term used to describe software that performs certain behaviors such as advertising, collecting personal information, or changing the configuration of your computer, generally without appropriately obtaining your consent first. SpyWare is a general term used to describe software that performs certain behaviors such as advertising, collecting personal information, or changing the configuration of your computer, generally without appropriately obtaining your consent first. spx
SpyWare Categories Advertising (Passive) Advertising (Passive) –Capture browsing history –Capture buying habits Surveillance (Active) Surveillance (Active) –Key loggers –System Monitors
SpyWare Statistics 90% of all internet connected machines are infected 90% of all internet connected machines are infected ~28 SpyWare traces on each machine ~28 SpyWare traces on each machine 1/3 infected with surveillance SpyWare 1/3 infected with surveillance SpyWare 80% of infections were cookies 80% of infections were cookies
Passive Tracking Methods Web Beacons Web Beacons Cookies deposits Cookies deposits
Web Beacons Also know as Also know as –Web Bugs –Clear GIFs Allows destination to log page hits Allows destination to log page hits Can be used in conjunction with cookies Can be used in conjunction with cookies
Cookie Fields ParameterDescription Name The name of the cookie. Value The value of the cookie. Expire The time the cookie expires. This is a Unix timestamp so is in number of seconds since the epoch. In other words, you'll most likely set this with the time() function plus the number of seconds before you want it to expire. Path The path on the server in which the cookie will be available. Domain The domain in which the cookie is available Secure When set to TRUE, the cookie will only be set if a secure connection exists. The default is FALSE. httponly When TRUE the cookie will be made accessible only through the HTTP protocol. Not supported on all browsers
Web Beacon w/Cookie Example: spywareWebBeaconCookieDeposit.html <html><head> Web Beacon Cookie Deposit Example Web Beacon Cookie Deposit Example </head><body> Web Beacon Cookie Deposit Example: Web Beacon Cookie Deposit Example: </body></html>
Server Code serverWebBeacon.php <?php if (!(isset($_COOKIE["SpyCookie"]))){ setcookie("SpyCookie", "ISpyOnYou", time()+3600); setcookie("SpyCookie", "ISpyOnYou", time()+3600);}?><html> PHP Test PHP Test <?php $filename = 'cookieCapture.txt'; $today = date("D M j G:i:s T Y"); $Content = "SpyCookie". " : ". "$_COOKIE[SpyCookie]". " : ". "$today\r\n"; if($handle = fopen($filename, 'a')){ fwrite($handle, $Content); fwrite($handle, $Content); fclose($handle); fclose($handle);}?> </html>
Cookie Capture File public_html]$ cat cookieCapture.txt SpyCookie : ISpyOnYou : Fri Dec 1 18:30:17 MST 2006 SpyCookie : ISpyOnYou : Fri Dec 1 18:30:38 MST 2006 public_html]$
Packet Capture
Conclusions Browser settings can prevent cookie deposit Browser settings can prevent cookie deposit Be careful what you download Be careful what you download –Don’t open the door willingly The use of cookies is fundamental The use of cookies is fundamental –The information provided is minimal
Questions?
References Tzu-Yen Wang, Shi-Jinn Horng, Ming-Yang Su, Chin-Hsiung Wu,Peng-Chu Wang and Wei-Zen Su. A Surveillance Spyware Detection System Based on Data Mining Methods IEEE Congress on Evolutionary Computation. Tzu-Yen Wang, Shi-Jinn Horng, Ming-Yang Su, Chin-Hsiung Wu,Peng-Chu Wang and Wei-Zen Su. A Surveillance Spyware Detection System Based on Data Mining Methods IEEE Congress on Evolutionary Computation. Wes Ames, Understanding Spyware: Risk and Response, 2004 IEEE IT Pro Wes Ames, Understanding Spyware: Risk and Response, 2004 IEEE IT Pro spx spx