1. 1 Lab 12: Spyware A Window’s User’s Worst Nightmare

2. ECE 4112-Internetwork Security2 Agenda Definition The Basics Various Threats Countermeasures Prevention Techniques

3. ECE 4112-Internetwork Security3 Definitions “Any software which employs a user’s Internet connection in the background without their explicit permission.” “Consists of computer software that gathers and reports information about a computer user without the user's knowledge or consent”

4. ECE 4112-Internetwork Security4 Who uses Spyware? Marketing Companies  Retrieve Consumer Data Criminals  Identity Theft  Sell Credit Card Numbers  Steal Passwords

5. ECE 4112-Internetwork Security5 Who uses Spyware? Monitoring:  Parents monitoring their children  Businesses monitoring employees  Government monitoring citizens Freeware  Generate Revenue from Advertising

6. ECE 4112-Internetwork Security6 The Problem Over 85% over PC’s have Spyware Spyware Includes:  Adware  Key Loggers  Data Miners

7. ECE 4112-Internetwork Security7 Various Threats Hijacking Spyware: Takes Over Internet Explorer  Often in the form of a toolbar  Changes homepage  Redirect traffic to advertisers  Popup targeted ads

8. Severely Hijacked Browser

9. ECE 4112-Internetwork Security9 Known Offenders Kazaa  Currently biggest propagator of Spyware  Installs: New.net, Onflow, Cydoor, etc. Gator/GAIN  Tracks user’s internet activity and reports back  Delivers targetted popups

10. ECE 4112-Internetwork Security10 Known Offenders WeatherBug BargainBuddy Even Big Companies:  Microsoft’s Windows Media Player  RealNetworks’ RealPlayer – Both of these record and transmit info about the music the user is playing

11. ECE 4112-Internetwork Security11 Anti-Spyware Packages Ad-Aware SpyBot Search & Destroy Microsoft Antispyware Hijackthis

12. ECE 4112-Internetwork Security12 How Spyware is Detected Similar to Viruses/Worms Spyware Signature  Signature of Files  Hash of Running Processes  Signature of Registry Entries Must keep definition files up to date

13. ECE 4112-Internetwork Security13 How Spyware is Removed Automatic Removal with Anti-Spyware  Doesn’t always work Manual Removal  Often requires help from a Spyware database  Kill processes  Delete registry entries  Delete files

14. ECE 4112-Internetwork Security14 Security Settings Disable ActiveX Disable Java Disable Scripting Disable Popups Don’t use Internet Explorer  Use Firefox

15. ECE 4112-Internetwork Security15 Common Sense A lot of Spyware comes packaged with shareware  Read the EULA to see if any hidden programs are installed  Check an online Spyware database  Read user reviews

16. ECE 4112-Internetwork Security16 What you will do in the Lab Install and Use Anti-Spyware Utilities  Ad-Aware, SpyBot, Hijackthis Install Spyware  Bundled Spyware – Gator  WeatherBug  Analyze EULA of Spyware

17. ECE 4112-Internetwork Security17 What you will do in the Lab Analyze Spyware Footprints  Registry entries  File contents Analyze a Scripting Vulnerability  IE Default Security Settings Block Spyware Traffic  Edit Windows host file

18. ECE 4112-Internetwork Security18 Resources http://www.cexx.org/adware.htm http://www3.ca.com/securityadvisor/pest/ http://web.njit.edu/~bieber/CIS677F04/staffor d-spyware-cais2004.pdfhttp://web.njit.edu/~bieber/CIS677F04/staffor d-spyware-cais2004.pdf http://www.spywaredata.com