| |
|
Custom Software Development |
|
|
|
Anti-Spyware Protection - Holes in the Shining Armor
Looking at all the ads which promise to get rid of all spy programs, one may wonder why there is still plenty of them everywhere and the situation is by no means getting better. So let me spoil the advertisers' mood and show some of the "holes" in the majority of software products we expect to protect our data. Speaking about drawbacks of anti-spyware, let's take the word "spyware" in the narrow sense for a change and call "spyware" only software products that really spy, i.e. steal valuable information you want to keep private. Let's leave aside adware -- this motley crew of advertising stuff; information that some of them "steal" isn't valuable enough. It is keylogging programs that we should associate with the term "spyware" first of all. This breed is exceptionally dangerous -- such threats as flourishing online bank fraud and the recent outbreak of keylogger-containing Trojans prove this. Generally speaking, most anti-spyware works like that? Don't stop reading, please. Don't skip over the paragraph. Do you think that if you are not a tech person, it is none of your business? You don't write this software, you just use it -- so what? You haven't made the car you are driving, either (well, there may be some exceptions?). But you do know (at least in general) what makes it move -- and you won't forget to fill up its tank or have it serviced from time to time. You know what will happen if you don't. For the same reason you'd better know a bit about anti-spy software installed on any PC you use. We all should know it to realize what exactly to expect from all these anti-spy products with cool names. Their creators and sellers promise you that these software products will "kill all spyware on your PC" (or something like that). First, is absolute protection possible? Second, what should we expect from a typical anti-spy program and what it is simply unable to do? To answer these questions, we should understand how it works. Generally speaking, most anti-spyware works like that: it scans the operating system in search for suspicious bits of code. Should the program find any, it compares these suspicious pieces with bits of code (they are called signatures), which belong to already detected and "caught" spy programs. Signatures are kept in so-called signature base -- the inseparable part of any anti-spy program. The more signatures it contains, the more spyware such program will detect, so your PC will be protected more effectively. As long as you update your anti-spy software regularly and the system doesn't come across some unknown spyware product, everything is going to be all right. As for me, this pattern looks pretty like police records and works like them, too. But?the problem is just like the one with police records - the fact that all included there are criminals doesn't at all mean that all the criminals are included into the records. Well, what about the criminals (spy programs) that are not included into the records (signature bases)? There are lots of such programs -- more than that -- some of them will never be in any signature base. Just like with criminals -- some of them haven't been caught yet, and some will never be caught - because of their "right of inviolability". Anti- spy products based on signature base analysis will never be able to protect against these spies. Don't expect them to. Let's take a quick look on these elusive spy programs. Group 1. Those which hasn't been caught yet, because they are: 1. brand-new ones. They are being constantly written, released, used (for a very short time), detected and, finally, included into signature bases. Anti-spyware developers are now in the vicious circle of endless "spy hunt", trying to include as many spyware signatures (pieces of code) into the bases as possible - and fast! Faster, to outrun the competitors; faster, for new spyware - which is being written and released all the time - not to spread like a wildfire. That's the way a signature base grows. 2. written to be used only once. These "tailor-made", or should we say, "custom-made", keyloggers are extremely unlikely to be ever detected. As soon as they have done their jobs (stealing data, of course -often from the particular computer) they simply disappear, never to be seen again. Here belong keyloggers made mostly for such tasks as espionage. The main problem: keylogging software is relatively simple and not too difficult to compile. Even an average computer programmer can write a simple keylogger in a couple of days. More sophisticated one will take longer to make, of course, but not too long. Hackers often compile source code of several keyloggers (it's easy to find them in the Web--for those who know where to look for) -- and get a brand-new one with an unknown signature even faster. If a keylogger can be installed remotely without the victim's knowledge, it gives the hacker great possibility to steal any information he pleases. If there is an opportunity, there always will be one to use it. The period of time when a new spy already exists, but the updates have not been released yet, is the very time when hackers make their biggest profits. Trying to catch them all is a hopeless idea; it looks too similar to catching fleas one by one. Group 2. "Sacred cows". No signature base will ever have their signatures. Here belong mostly monitoring programs, which can be used for spying as well. First, the ones created by (or for) government agencies - such as the famous Magic Lantern (the brainchild of the Cyber Knight project). No product which uses a signature base will protect against it; an ordinary anti-spy will never detect such a program. The same situation with other monitoring software, which certain agencies utilize. These monitoring products simply "don't exist" for signature-base-using anti-spyware (though they can well exist on any PC--yours included) If you think I'm painting it too black let's recall what happened when code of D.I.R.T. (a covert spying tool developed by Codex Data Systems) leaked out couple of years ago and was found in the Web (merely by accident, by the way). Once a top-secret project, it did become an open secret -- but the signature of this powerful monitoring software hasn't been included in any signature bases. That's what worries me the most; after this information leak nobody knows for sure WHO can be using it --and WHAT FOR. What if some other government monitoring program trickles into the Internet, too? Monitoring programs for parental control or workplace surveillance are very common and easily available from the Web. However, they can be used not only for those absolutely legitimate purposes. Any monitoring program is actually a double-edged sword because it almost always contains a keylogging module. It is up to an end user to utilize them--perhaps for spying. Legitimate monitoring programs are sometimes not included into signature bases, so one can use an anti-spy program and be spied on anyway. Now the last (but not the least) threat -- spy modules incorporated into viruses and Trojan horse programs. Unfortunately, all malware, including viruses, Trojan horses, worms and other fauna, "evolves" (due to their malicious creators). There already are so many hybrids between one another that it's hard to find, say, a "pure" virus like ones used only several years ago. Lots of this fauna can contain a keylogger -- like MyDoom (sure you remember this virus). They multiply and evolve, becoming more and more malicious. So, what conclusions could we draw out of this entire story (sorry if it turned to be too pessimistic)? Is absolute anti-spy protection possible? With existing anti-spy software which uses signature bases - no. However, there is a relatively new trend in software development -- not to use signature base analysis at all. This approach is rather promising; it means that such software--it already exists--can counteract even brand-new and custom-made spies. You may read more about it if you follow the link in my signature. What should we expect from an average anti-monitoring or anti-spy program? It does protect from spy software which it "knows". If it has the particular signature in its base, it protects your PC from this particular program. If anti-spyware uses a signature base, it will never "kill all spies on your PC--"whatever the salesperson promises you. Don't expect complete security-- there is no such thing anymore. The only hope is for entirely new technologies. If developers can't succeed in fighting spyware, they should try something else. Alexandra Gamanenko currently works at the Raytown Corporation, LLC -- an independent software developing company. Visit its website http://www.anti-keyloggers.com
MORE RESOURCES:
Software - Google News |
|
|
|
RELATED ARTICLES
Alien Intruders! You probably didn't casually invite, or extend a formal attendance request to, these undesirables known as viruses.Regardless of your opinions, such cyber-nomads may call on you, complete and active, with their destructive payloads. How To Make Good Use of Spreadsheets Most computer users use spreadsheets software such as Microsoft Excel in their daily home and office. However very few are aware of the potential of spreadsheets in helping them in financial accounting and statistical analysis. Spyware Statistics -- Whats New in May 2005? Although statistics often is blamed for various deadly sins -- from being biased to being inaccurate -- there is nothing left to those who are anyhow connected with IT but to keep up with fresh data. Since spyware is literally ubiquitous, nobody who owns or uses a PC can say that it is none of his business. Microsoft Great Plains: Service Business Customization & Integration Example Microsoft Business Solutions Great Plains might be considered as ERP platform, ready for customization and integration. Microsoft Business Solutions partner typically does one of the two things: specializes in the industry (in this case it goes for the nation-wide clientele) or specializes in the local or regional market. Crystal Reports for Microsoft Great Plains - Overview for Developer Microsoft Great Plains is main accounting / ERP application from Microsoft Business Solutions, targeted to the US market. It serves the whole of vertical and horizontal market: most of the industries and company sizes. What is Preventive Maintenance Software? Preventive Maintenance (PM) is defined as scheduled work done on a system to identify and fix any occurring issues before they become problems. The concept of preventive maintenance applies to many different industries. Microsoft Great Plains SOP: Sales Order Processing Microsoft Business Solutions Great Plains is marketed for mid-size companies as well as Navision (which has very good positions in Europe and emerging markets where it can be easily localized).Great Plains Sales Order Processing (SOP) module forms a third of the core Inventory and Order Processing part of Great Plains. ERP Remote Support: Microsoft Great Plains Analysis - Pluses & Minuses Former Great Plains Software Dynamics/eEnterprise and currently Microsoft Business Solutions Great Plains serves midsize and corporate clients as ERP system in the following countries and regions: USA, Canada, Mexico and Latin America, Brazil (where MBS actually promotes Navision and has GP for multinational corporations), Saudi Arabia, OAE, Egypt and the rest of Middle East, South Africa, Nigeria and the whole African continent, U.K. Crystal Reports For Microsoft Navision - Overview For Programmer/IT Specialist Let us give you - developer some hints in the report creation. C/SIDE database - use C/ODBC to create the connection for your Crystal Report. ERP Consulting: Microsoft Great Plains Partner Future Directions In the Clinton era the status quo was simple: you serve your local clients and if you want to expand your business - open offices in other business metros. Great Plains Software was granting generous margins on the software sales and stimulated local leading VARs/Partners/Resellers with so-called orphan leads - customers who lapsed in payment annual enhancement program or called Great Plains Software directly to comply about quality of service by their VAR. Groupware as a Document Manager: Collaboration Series #3 This article is the third of a series of articles exploring specific aspects of groupware. The brief informational articles in this series discuss some of the technologies associated with groupware, as well as some of the characteristics of groupware. Microsoft Great Plains Implementation & Customization: Computer Parts Retailer Example Microsoft Great Plains fits to majority of horizontals and retail business is good fit as well. We'll consider the system, consisting from Microsoft Great Plains as Accounting, Inventory Pricing and Microsoft Retail Management System (RMS) Headquarters and Store Operations Manager. The Bluebird Project The objective for Zandi Digital is to make available clever programs to end-users that want and need something more diverse. Bluebird is the current application being developed by Zandi Digital. Reduce TCO: The Java Database Way TCO (Total Cost Ownership) is the buzzword in today's business world. This metric helps enterprise managers assess direct and indirect costs and benefits derived from their investment on IT components and services. Microsoft Great Plains: Data Conversion & Migration Scenarios - Overview for Consultant Microsoft Business Solutions Great Plains serves multiple industries in the US, plus it has strong presence in Latin America, U.K. Microsoft Great Plains GL: General Ledger - Overview For Consultant Microsoft Business Solutions Great Plains is marketed for mid-size companies as well as Navision (which has very good positions in Europe and emerging markets where it can be easily localized). Great Plains Inventory control is pretty robust and here we would like to give you highlights on standard functionality as well as what could be added to its standard features. Screenshots Vista Windows Features Additionally, Vista will include many other new features.Aero Vista will include a completely re-designed user interface, code-named Aero. Constructionalist Parsing - Deciphering Natural Language The research in the field of Natural Language Processing usually assumes the existence of a syntactic "Generative Engine" that combines words and word-like elements into syntactic structures, and then sometimes displaces them by "syntactic movement". A Linguistic Parser must "undo" all the effects of syntactic movement, which results in a structure where the relations between the words are represented more directly. Reloading Windows XP If you have been running Windows XP for a couple of years or more you may find that it is not running quite as quickly and smoothly as it was when you did your first install. I am constantly 'evaluating' software and uninstalling and reinstalling beta software on my computer and have always gradually become more and more disappointed after nine months to a year with the performance of my PC. Databases - How We Love to Hate Them! You've finally created databases that you can actually use to store and manipulate all your critical data. That's great news and quite an accomplishment.
|
| Article Index | home | site map |
| Powered by Custom Software Development - © 1995 - 2008 Nexus Software Systems |
