1. Is your computer being used against you while you sleep?
Spyware
Is your computer being used
against you while you sleep?
By Paul Box
CS526

2. Outline Why do we care? What is Spyware? What do we do about it?
The Spyware test.
12/26/2018
Paul Box / CS526

3. Why do we care? Spyware is becoming very prevalent
Spyware is a way to make cheap and easy money
Spyware users want to make this money from you
If you are not cautious, they may be making money from you now
Some of the ways to make money can really harm you.
12/26/2018
Paul Box / CS526

4. So what is spyware? There are many types of spyware: Adware Dialers
Joke Programs
Hack Tools
Remote Access programs
Spyware
12/26/2018
Paul Box / CS526

5. Adware
“Programs that facilitate delivery of advertising content to the user through their own window, or by utilizing another program's interface. In some cases, these programs may gather information from the user's computer, including information related to Internet browser usage or other computing habits, and relay this information back to a remote computer or other location in cyber-space.”
12/26/2018
Paul Box / CS526

6. Adware
These are pop up programs or gather information about computer usage
Used by people trying to make money from directed spam and advertisement money
Example is: Adware.WinFavorites
Checks your favorites and send pop ups that relate to it
12/26/2018
Paul Box / CS526

7. Dialer
“Programs that use a computer or modem to dial out to a toll number or internet site, typically to accrue charges. Dialers can be installed with or without a user’s explicit knowledge, and may perform their dialing activity without a user’s specific consent prior to dialing.”
12/26/2018
Paul Box / CS526

8. Dialer
Typical program that takes over a Modem and dials to locations without a user’s consent
Usually meant to increase the user’s phone bill
Less used as High Speed connections replace dial up
Example: XXXDial
Dials international location to deliver porn to a person’s computer
12/26/2018
Paul Box / CS526

9. Joke Programs
“Programs that alter or interrupt the normal behavior of your computer, creating a general distraction or nuisance. Joke programs generally do not themselves engage in the practice of gathering or distributing information from the user's computer.”
12/26/2018
Paul Box / CS526

10. Joke Programs Usually meant as a joke Usually not malicious or harmful
Made by people that just wants to show how they can get in a system if they wanted to
Example: Joke.Win32.DesktopPuzzle
Turns your desktop into a slider puzzle
12/26/2018
Paul Box / CS526

11. Hack Tools
“Tools that can be used by a hacker or unauthorized user to attack, gain unwelcome access to or perform identification or fingerprinting of your computer.”
12/26/2018
Paul Box / CS526

12. Hack Tools 2 Types Very Malicious
Keystroke Loggers
Distributed denial of service attacks
Very Malicious
Used to gleam personal information, bank accounts or passwords
Also can help to take over a computer to be used to attack another computer
12/26/2018
Paul Box / CS526

13. Hack Tools
Those that use them are trying to do identity theft or use a computers resources to attack other networks (this is a service many hackers pay for)
Example: Haxdoor.o
Opens port 1661 on the computer and allows full access to others later can use it
Example: KeySpy
Keystroke logger that records all keystrokes and s it to an
12/26/2018
Paul Box / CS526

14. Remote Access programs
“Programs that allow one computer to access another computer (or facilitate such access) without explicit authorization when an access attempt is made. Once access is gained, usually over the Internet or by direct dial access, the remote access program can attack or alter the other computer. It may also have the ability to gather personal information, or infect or delete files. They may also create the risk that third party programs can exploit its presence to obtain access.”
12/26/2018
Paul Box / CS526

15. Remote Access programs
Back Door programs
Makes it easier for access to be gained at future times when it is needed
Can be used to have other programs like hack tools installed
Example: MindControl
Opens port 23 to allow full control over a computer
12/26/2018
Paul Box / CS526

16. Spyware
“Programs that have the ability to scan systems or monitor activity and relay information to other computers or locations in cyber-space. Among the information that may be actively or passively gathered and disseminated by Spyware: passwords, log-in details, account numbers, personal information, individual files or other personal documents. Spyware may also gather and distribute information related to the user's computer, applications running on the computer, Internet browser usage or other computing habits.”
12/26/2018
Paul Box / CS526

17. Spyware Used to assist in identity theft
Usually a keystroke logger that transmits its information whenever a secure webpage is accessed
Example: Realtime-Spy
Keystroke logger that records personal passwords and transmits to a remote account
12/26/2018
Paul Box / CS526

18. The Bad Guys Spyware, Remote Access programs and Hack tools Usage:
Programs to log keystrokes or screen shots and then send that information to some type of account that will be used to gleam important account and password information.
Programs that will be used to allow easier access to the infected computer at a later date.
Programs used to take over an infected computer and use its resources for their own purposes
12/26/2018
Paul Box / CS526

19. What to do? Spyware removal software Edit the registry
Find and remove the program
Reformat the hard drive
Restore Back ups
Prevention
Never go online (ever)
Firewalls
Spyware detection programs
12/26/2018
Paul Box / CS526

20. The Spyware Test Spyware Warrior
Decided to test what spyware removal and prevention tools were the best
Ran 3 test runs to see what was the best
Infected a computer with spyware in a controlled environment
Ran spyware search and destroyers to see which was the best
Results are found here.
12/26/2018
Paul Box / CS526

21. The Spyware Test Results:
Determined that none were really any good (none can detect and remove everything)
The best were:
Adware
Microsoft Anti-spyware Beta
Pest patrol
Spybot Search and Destroy
Webroot Spyware Sweeper
12/26/2018
Paul Box / CS526

22. The Spyware Test Conclusions:
Spyware and adware can prove quite difficult to remove, even for dedicated anti-spyware scanners even to disabling the spyware so it can not run on reboot or detecting them.
No single anti-spyware scanner removes everything. Even the best-performing anti-spyware scanner in these tests missed fully one quarter of the "critical" files and Registry entries. This means that the programs were at best 75% effective.
It is better to use two or more anti-spyware scanners in combination, as one will often detect and remove things that others do not.
Prevention is always preferable to scanning and removal.
Moreover, users should learn to practice safe computing habits, which include avoiding web sites and programs of unknown or dubious provenance and carefully reading End User License Agreements and Privacy Policies.
12/26/2018
Paul Box / CS526

23. References Spyware Test Spyware Definitions Spyware Listings
12/26/2018
Paul Box / CS526

24. Questions???
12/26/2018
Paul Box / CS526