Anti-Spyware Protection ? Holes in the Shining Armor

Looking at all the ads which promise to get rid of all spy programs, one may wonder why there is still plenty of them everywhere and the situation is by no means getting better. So let me spoil the advertisers' mood and show some of the "holes" in the majority of software products we expect to protect our data.

Speaking about drawbacks of anti-spyware, let's take the word "spyware" in the narrow sense for a change and call "spyware" only software products that really spy, i.e. steal valuable information you want to keep private. Let's leave aside adware -- this motley crew of advertising stuff; information that some of them "steal" isn't valuable enough. It is keylogging programs that we should associate with the term "spyware" first of all. This breed is exceptionally dangerous -- such threats as flourishing online bank fraud and the recent outbreak of keylogger-containing Trojans prove this.

Generally speaking, most anti-spyware works like that? Don't stop reading, please. Don't skip over the paragraph. Do you think that if you are not a tech person, it is none of your business? You don't write this software, you just use it -- so what? You haven't made the car you are driving, either (well, there may be some exceptions?). But you do know (at least in general) what makes it move -- and you won't forget to fill up its tank or have it serviced from time to time. You know what will happen if you don't. For the same reason you'd better know a bit about anti-spy software installed on any PC you use.

We all should know it to realize what exactly to expect from all these anti-spy products with cool names. Their creators and sellers promise you that these software products will "kill all spyware on your PC" (or something like that). First, is absolute protection possible? Second, what should we expect from a typical anti-spy program and what it is simply unable to do? To answer these questions, we should understand how it works.

Generally speaking, most anti-spyware works like that: it scans the operating system in search for suspicious bits of code. Should the program find any, it compares these suspicious pieces with bits of code (they are called signatures), which belong to already detected and "caught" spy programs. Signatures are kept in so-called signature base -- the inseparable part of any anti-spy program. The more signatures it contains, the more spyware such program will detect, so your PC will be protected more effectively. As long as you update your anti-spy software regularly and the system doesn't come across some unknown spyware product, everything is going to be all right.

As for me, this pattern looks pretty like police records and works like them, too. But?the problem is just like the one with police records ? the fact that all included there are criminals doesn't at all mean that all the criminals are included into the records.

Well, what about the criminals (spy programs) that are not included into the records (signature bases)? There are lots of such programs -- more than that -- some of them will never be in any signature base. Just like with criminals -- some of them haven't been caught yet, and some will never be caught ? because of their "right of inviolability". Anti- spy products based on signature base analysis will never be able to protect against these spies. Don't expect them to.

Let's take a quick look on these elusive spy programs.

Group 1. Those which hasn't been caught yet, because they are:

1. brand-new ones. They are being constantly written, released, used (for a very short time), detected and, finally, included into signature bases. Anti-spyware developers are now in the vicious circle of endless "spy hunt", trying to include as many spyware signatures (pieces of code) into the bases as possible - and fast! Faster, to outrun the competitors; faster, for new spyware - which is being written and released all the time ? not to spread like a wildfire. That's the way a signature base grows.

2. written to be used only once.

These "tailor-made", or should we say, "custom-made", keyloggers are extremely unlikely to be ever detected. As soon as they have done their jobs (stealing data, of course ?often from the particular computer) they simply disappear, never to be seen again. Here belong keyloggers made mostly for such tasks as espionage.

The main problem: keylogging software is relatively simple and not too difficult to compile. Even an average computer programmer can write a simple keylogger in a couple of days. More sophisticated one will take longer to make, of course, but not too long. Hackers often compile source code of several keyloggers (it's easy to find them in the Web--for those who know where to look for) -- and get a brand-new one with an unknown signature even faster. If a keylogger can be installed remotely without the victim's knowledge, it gives the hacker great possibility to steal any information he pleases. If there is an opportunity, there always will be one to use it. The period of time when a new spy already exists, but the updates have not been released yet, is the very time when hackers make their biggest profits. Trying to catch them all is a hopeless idea; it looks too similar to catching fleas one by one.

Group 2. "Sacred cows".

No signature base will ever have their signatures. Here belong mostly monitoring programs, which can be used for spying as well. First, the ones created by (or for) government agencies ? such as the famous Magic Lantern (the brainchild of the Cyber Knight project). No product which uses a signature base will protect against it; an ordinary anti-spy will never detect such a program. The same situation with other monitoring software, which certain agencies utilize. These monitoring products simply "don't exist" for signature-base-using anti-spyware (though they can well exist on any PC--yours included)

If you think I'm painting it too black let's recall what happened when code of D.I.R.T. (a covert spying tool developed by Codex Data Systems) leaked out couple of years ago and was found in the Web (merely by accident, by the way). Once a top-secret project, it did become an open secret -- but the signature of this powerful monitoring software hasn't been included in any signature bases. That's what worries me the most; after this information leak nobody knows for sure WHO can be using it --and WHAT FOR. What if some other government monitoring program trickles into the Internet, too?

Monitoring programs for parental control or workplace surveillance are very common and easily available from the Web. However, they can be used not only for those absolutely legitimate purposes. Any monitoring program is actually a double-edged sword because it almost always contains a keylogging module. It is up to an end user to utilize them--perhaps for spying. Legitimate monitoring programs are sometimes not included into signature bases, so one can use an anti-spy program and be spied on anyway.

Now the last (but not the least) threat -- spy modules incorporated into viruses and Trojan horse programs. Unfortunately, all malware, including viruses, Trojan horses, worms and other fauna, "evolves" (due to their malicious creators). There already are so many hybrids between one another that it's hard to find, say, a "pure" virus like ones used only several years ago. Lots of this fauna can contain a keylogger -- like MyDoom (sure you remember this virus). They multiply and evolve, becoming more and more malicious.

So, what conclusions could we draw out of this entire story (sorry if it turned to be too pessimistic)?

Is absolute anti-spy protection possible? With existing anti-spy software which uses signature bases - no.

However, there is a relatively new trend in software development -- not to use signature base analysis at all. This approach is rather promising; it means that such software--it already exists--can counteract even brand-new and custom-made spies. You may read more about it if you follow the link in my signature.

What should we expect from an average anti-monitoring or anti-spy program? It does protect from spy software which it "knows". If it has the particular signature in its base, it protects your PC from this particular program. If anti-spyware uses a signature base, it will never "kill all spies on your PC--"whatever the salesperson promises you. Don't expect complete security-- there is no such thing anymore.

The only hope is for entirely new technologies. If developers can't succeed in fighting spyware, they should try something else.

Alexandra Gamanenko currently works at the Raytown Corporation, LLC -- an independent software developing company. Visit its website http://www.anti-keyloggers.com

Alexis limo rentals ..
In The News:

A Google DeepMind team has developed an artificial intelligence system that can play video games like a human and take native language commands from players.
Four of the largest school boards in Ontario, Canada have launched lawsuits against TikTok, Meta, and Snapchat, claiming that they have impacted students' thinking and behavior.
Finalists for the inaugural Women’s Prize for Nonfiction, aimed at addressing the gender imbalance in nonfiction publishing, were unveiled on Wednesday.
Tech guru Kurt "CyberGuy" Knutsson breaks down whether the government is watching citizens and what they can do to protect online privacy.
A benchmarking group for artificial intelligence has released new results evaluating the speed of hardware in running AI applications and responding to users.
Sierra Space’s Dream Chaser spaceplane provides a glimpse into the future of space travel. Traveling to space may become a part of everyday life.
The new European Hyperloop Center in the Netherlands aims bring in a new era of transportation. The center will use a steel tube as a proving ground for testing the new vehicle.
Stay up to date on the latest AI technology advancements and learn about the challenges and opportunities AI presents now and for the future.
While it may be incredibly tempting to have a “go with the flow" mindset like the rest of your vacation, your technology definitely should not be compromised while traveling.
Have you ever accidentally deleted an app from your iPhone that you’ve already paid for? Don't worry. We’ve got a trick that will help you get it back without having to buy it again.
Apple's new Journal app has raised privacy concerns among Apple's userbase. Tech expert Kim Komando examines social media rumors and explains what steps to take to protect yourself.
Although Facebook has denied that our phones listen to us, they do have other ways of finding out what we are talking about, listening to and searching for.
With the integration of OpenAI technology, Figure 01 has taken a significant leap forward, showcasing the potential of robots to understand and interact with us on a personal level.
Port Ellen, newly reopened whisky distillery in Scotland, is using SmokeDNAi technology to understand mouth-feel and flavors during the whisky maturation process.
Telly, a smart TV firm, is promising to give out their 4K 55-inch TV for free. What must you give in return? The innovative, yet potentially unsettling, answer might shock you.
The moment a spam invite hits your calendar, it’s like an uninvited guest at a party. So, what do you do? Show it the door.
Identity thieves are now targeting children and are making large sums of money by exploiting children's identities, possibly hurting their financial future.
There's a clever way to change the notification sounds on your Android without having to look at your screen. Kurt "CyberGuy" Knutsson explains.
If your bank accounted has been hacked, there are a number of steps you can take to prevent it from happening again. Kurt "CyberGuy" Knutsson explains.
Stay up to date on the latest AI technology advancements and learn about the challenges and opportunities AI presents now and for the future.
The Wave House, a data center in Heidelberg, Germany, is the the largest 3D-printed building in Europe. Its walls were built in about 140 hours.
Some government agencies around the world are struggling to meet their staffing goals when it comes to hiring artificial intelligence experts.
Google Maps' recent upgrades have introduced real-time ETA and turn-by-turn directions to your phone's lock screen while you are traveling.
Kat Cammack says AI could disrupt the 2024 election. A report says shared AI image tools generate election disinformation in 41% of cases and voting disinformation in 59% of cases.
Deepfakes have become commonplace, and the technology is only getting better, but there are certain elements that might give away the fact that an image is AI-generated.

Need of Document Management System (DMS)

Document Management or Enterprise Information Management is perhaps one of... Read More

Snort for Network IDS

What is Snort?Snort is an open source network intrusion detection... Read More

Can You Calculate Complex Financial Calculations?

Are you a whiz at calculating financial information? Not the... Read More

Lotus Domino Implementation and Development: Infrastructure ? Present and Future

Domino server is a buffer between the operation system and... Read More

XML Parser and Their Types

XML parser is a software module to read documents and... Read More

Microsoft Great Plains Nationwide Remote Support

ERP Consulting industry is on the way to serve clients... Read More

Top Questions to Ask Before Buying a Help Desk & Asset Management Software

#5 All your hardware components like Printers, PCs etc come... Read More

New SQL Delta Version 3.1

COMMAND LINE FUNCTIONA powerful command line script processor has been... Read More

Marketing Your WinRunner Team

It won't matter how effective your WinRunner Team is if... Read More

MultiNational Corporation ERP Implementation ? Microsoft Business Solutions Great Plains

If you look back to the history, you will see... Read More

Microsoft Great Plains Jewelry ? Implementation & Customization Overview

Each Industry and market niche has business specific and unique... Read More

Builders Beware

Which Type of Shop Can Rely On A Home Built... Read More

Create A Flash Presentation For Free With Open Office

The intentions of this short tutorial are not to teach... Read More

Performance Tuning of a Daffodil DB / One$DB -JDBC Application

This article illustrates the best practices to improve the performance... Read More

Microsoft Great Plains Implementation ? Overview for IT Director/Controller

What is installation in the language of technology? Installation... Read More

Dashboard Widgets for Windows

For a windows user like me, just can watch with... Read More

How the Firefox: How to... Manual Helped Me

A few months back I really got sick of my... Read More

Microsoft Great Plains implementation: Restaurants Supply Chain Management Example

Microsoft Great Plains serves majority of US based horizontal and... Read More

Basic Steps To Optimize Your Internet Security

After seeing many people complain about their weak Internet security... Read More

Importance of Coding Standards

Programming Help for BeginnersWe write programs to instruct computers. When... Read More

Microsoft CRM Development

Microsoft CRM is CRM answer from Microsoft Business Solutions.The whole... Read More

Microsoft Navision Integration with Microsoft RMS - Overview for IT Specialist

Microsoft Business Solutions Navision serves both European and American megamarkets.... Read More

What To Do When Windows Wont Boot

When Windows fails to boot it is normally caused by... Read More

Huddle Up; Groupware on Three

It could just be me, but my experiences with document... Read More

Groupware as a Document Manager: Collaboration Series #3

This article is the third of a series of articles... Read More

car service from Midway Alsip ..