Anti-Spyware Protection – Holes in the Shining Armor

Looking at all the ads which promise to get rid of all spy
programs, one may wonder why there is still plenty of them
everywhere and the situation is by no means getting better.
So let me spoil the advertisers' mood and show some of the
"holes" in the majority of software products we expect to
protect our data.

Speaking about drawbacks of anti-spyware, let's take the
word "spyware" in the narrow sense for a change and call
"spyware" only software products that really spy, i.e. steal
valuable information you want to keep private. Let's leave
aside adware -- this motley crew of advertising stuff;
information that some of them "steal" isn't valuable enough.
It is keylogging programs that we should associate with the
term "spyware" first of all. This breed is exceptionally
dangerous -- such threats as flourishing online bank fraud
and the recent outbreak of keylogger-containing Trojans
prove this.

Generally speaking, most anti-spyware works like that… Don't
stop reading, please. Don't skip over the paragraph. Do you
think that if you are not a tech person, it is none of your
business? You don't write this software, you just use it --
so what? You haven't made the car you are driving, either
(well, there may be some exceptions…). But you do know (at
least in general) what makes it move -- and you won't forget
to fill up its tank or have it serviced from time to time.
You know what will happen if you don't. For the same reason
you'd better know a bit about anti-spy software installed on
any PC you use.

We all should know it to realize what exactly to expect from
all these anti-spy products with cool names. Their creators
and sellers promise you that these software products will
"kill all spyware on your PC" (or something like that).
First, is absolute protection possible? Second, what should
we expect from a typical anti-spy program and what it is
simply unable to do? To answer these questions, we should
understand how it works.

Generally speaking, most anti-spyware works like that: it
scans the operating system in search for suspicious bits of
code. Should the program find any, it compares these
suspicious pieces with bits of code (they are called
signatures), which belong to already detected and "caught"
spy programs. Signatures are kept in so-called signature
base -- the inseparable part of any anti-spy program. The
more signatures it contains, the more spyware such program
will detect, so your PC will be protected more effectively.
As long as you update your anti-spy software regularly and
the system doesn't come across some unknown spyware product,
everything is going to be all right.

As for me, this pattern looks pretty like police records and
works like them, too. But…the problem is just like the one
with police records – the fact that all included there are
criminals doesn't at all mean that all the criminals are
included into the records.

Well, what about the criminals (spy programs) that are not
included into the records (signature bases)? There are lots
of such programs -- more than that -- some of them will
never be in any signature base. Just like with criminals --
some of them haven't been caught yet, and some will never be
caught – because of their "right of inviolability". Anti-
spy products based on signature base analysis will never be
able to protect against these spies. Don't expect them to.

Let's take a quick look on these elusive spy programs.

Group 1. Those which hasn't been caught yet, because they
are:

1. brand-new ones. They are being constantly written,
released, used (for a very short time), detected and,
finally, included into signature bases. Anti-spyware
developers are now in the vicious circle of endless "spy
hunt", trying to include as many spyware signatures (pieces
of code) into the bases as possible - and fast! Faster, to
outrun the competitors; faster, for new spyware - which is
being written and released all the time – not to spread like
a wildfire. That's the way a signature base grows.

2. written to be used only once.

These "tailor-made", or should we say, "custom-made",
keyloggers are extremely unlikely to be ever detected. As
soon as they have done their jobs (stealing data, of course
–often from the particular computer) they simply disappear,
never to be seen again. Here belong keyloggers made mostly
for such tasks as espionage.

The main problem: keylogging software is relatively simple
and not too difficult to compile. Even an average computer
programmer can write a simple keylogger in a couple of days.
More sophisticated one will take longer to make, of course,
but not too long. Hackers often compile source code of
several keyloggers (it's easy to find them in the Web--for
those who know where to look for) -- and get a brand-new one
with an unknown signature even faster. If a keylogger can be
installed remotely without the victim's knowledge, it gives
the hacker great possibility to steal any information he
pleases. If there is an opportunity, there always will be
one to use it. The period of time when a new spy already
exists, but the updates have not been released yet, is the
very time when hackers make their biggest profits. Trying to
catch them all is a hopeless idea; it looks too similar to
catching fleas one by one.

Group 2. "Sacred cows".

No signature base will ever have their signatures. Here
belong mostly monitoring programs, which can be used for
spying as well. First, the ones created by (or for)
government agencies – such as the famous Magic Lantern (the
brainchild of the Cyber Knight project). No product which
uses a signature base will protect against it; an ordinary
anti-spy will never detect such a program. The same
situation with other monitoring software, which certain
agencies utilize. These monitoring products simply "don't
exist" for signature-base-using anti-spyware (though they
can well exist on any PC--yours included)

If you think I'm painting it too black let's recall what
happened when code of D.I.R.T. (a covert spying tool
developed by Codex Data Systems) leaked out couple of years
ago and was found in the Web (merely by accident, by the
way). Once a top-secret project, it did become an open
secret -- but the signature of this powerful monitoring
software hasn't been included in any signature bases. That's
what worries me the most; after this information leak nobody
knows for sure WHO can be using it --and WHAT FOR. What if
some other government monitoring program trickles into the
Internet, too?

Monitoring programs for parental control or workplace
surveillance are very common and easily available from the
Web. However, they can be used not only for those absolutely
legitimate purposes. Any monitoring program is actually a
double-edged sword because it almost always contains a
keylogging module. It is up to an end user to utilize
them--perhaps for spying. Legitimate monitoring programs are
sometimes not included into signature bases, so one can use
an anti-spy program and be spied on anyway.

Now the last (but not the least) threat -- spy modules
incorporated into viruses and Trojan horse programs.
Unfortunately, all malware, including viruses, Trojan
horses, worms and other fauna, "evolves" (due to their
malicious creators). There already are so many hybrids
between one another that it's hard to find, say, a "pure"
virus like ones used only several years ago. Lots of this
fauna can contain a keylogger -- like MyDoom (sure you
remember this virus). They multiply and evolve, becoming
more and more malicious.

So, what conclusions could we draw out of this entire story
(sorry if it turned to be too pessimistic)?

Is absolute anti-spy protection possible? With existing
anti-spy software which uses signature bases - no.

However, there is a relatively new trend in software
development -- not to use signature base analysis at all.
This approach is rather promising; it means that such
software--it already exists--can counteract even brand-new
and custom-made spies. You may read more about it if you
follow the link in my signature.

What should we expect from an average anti-monitoring or
anti-spy program? It does protect from spy software which it
"knows". If it has the particular signature in its base, it
protects your PC from this particular program. If
anti-spyware uses a signature base, it will never "kill all
spies on your PC--"whatever the salesperson promises you.
Don't expect complete security-- there is no such thing
anymore.

The only hope is for entirely new technologies. If
developers can't succeed in fighting spyware, they should
try something else.

Alexandra Gamanenko currently works at the Raytown Corporation, LLC -- an independent software developing company.
Visit its website
http://www.anti-keyloggers.com

Spam emails More free articles

Related articles