The State of Spyware report by Webroot Inc has noted a sharp increase in spyware websites.
The report has found that the number of corporate spyware incidents has dramatically increased, as has the sophistication with which spyware infiltrates a machine and eludes detection. Webroot has also seen the number of entries in its spyware definition database double so far this year to over 100,000.
I downloaded the report, which apart from the numbers and analysis, contains useful background information about spyware and how it differs from viruses and other forms employed by the ’scum of the internet’…
Spyware’s underlying principle: it is a business. The shadowy – and sometimes very up-front – purveyors of this insidious practice are distant cousins to their counterparts in the virus world. Although some protest that spyware is just another form of viruses, cursory inspection reveals one significant difference: money.
Virus writers are… like graffiti artists, unleashing cyber-havoc on the world for their own voyeuristic enjoyment and for the renown within their own twisted, hacker circles. Viruses were — to our thinking — simply vandalism.
Spyware is different. It is an enterprise, designed as a profit-making venture to inflict users, at best, with an onslaught of pop-up ads that translates in micro-charges and eventually amounts to real money; or at worse, just to steal from an unsuspecting user who wandered into the wrong place or clicked on the wrong OK button. Virus writing may gain some twisted fame, spyware brings fortune.
And this will be driving the trends until the root causes aren’t addressed. What are the root causes? As I point out elsewhere there is an unholy aliance between adware and the ‘respectable’ online advertising industry. The latter provides incentives for the former:
First, adware vendors continue to generate revenue using the proven infection methods of pop-up ads and click-throughs.
Webroot report sees legislative actions as the way to stem the tide of adware and spyware. I agree, up to a point – there must be a legal stance and a framework for dealing with them. However, I don’t believe that is what will eliminate both the annoyance and the serious threat to the users. As Webroot correctly emphasises, as long as there is money in it, they will look for ways to protect their business model:
…spyware is a business and, when one market starts to wane, a capable business does one of two things. Either, they defend their franchise and/or they find new markets to exploit.
Spyware routinely now has a hydra-like capability to morph into new forms when the original executable is detected and removed. Spyware programs are now using new and ingenious tactics to send information. Spyware writers understand that their business model is under siege and to survive they are employing every tactic they can.
The second tact[ic] a threatened business will take is to look for new products and new markets. The incidents of Trojans and system monitors are growing much faster than more tolerable ad-pushing software. Basically, spyware writers are creating new and more innovative products to flood the market.
Not a good prospect. Of course, this is all connected with spam and the recent pointing of fingers at splogs and search engine spam. I guess it may be a sign of maturity in the blogosphere when bloggers are using the network to call for war on blog spam and identifying the ‘root causes’. The number of times we come across blogs flooded with old trackback and/or comment spam is shocking, I wonder if their owners simply have given up or are not aware of their unwitting cooperation with the spammers by keeping their blogs polluted. We have decided to introduced a policy on Samizdata.net, not to link to those blogs that are afflicted by spam despite their linkable content and send a polite warning email to their owners, including links to information about blacklists and other anti-spam measures. Let’s hope that every little bit helps…
