A Free Educational Resource Created by Carnegie Mellon University to Empower You to Secure Your Part of Cyberspace

Spyware

Software that sends information from your computer to a third party without your consent

Spyware is any software that sends personal information (e.g., Web sites you visit, email addresses, passwords) from your computer to a third party without telling you and without your consent. Spyware differs from malware in that it takes information from your computer, while malware damages your computer.

Many people include adware (software that displays advertising banners in your browser) under the heading of "spyware" because adware often has spyware included in it. This adware can sometimes slow down your machine, make pop-up ads appear on your desktop, or change the settings on your computer. Many of these programs do not clearly state what the application will do or whether spyware is included, and they can be very difficult to uninstall.

A collection of anti-spyware software companies, academics, and consumer groups have formed the Anti-Spyware Coalition  to clarify what exactly can be considered spyware. Their current definition includes any software that makes it difficult for you to control:

  • How you use your computer, including your privacy and security settings
  • What your computer is used for and what is installed on it
  • How your personal information is collected and used

There are a few different ways you can get spyware on your computer. Spyware is sometimes installed on your machine when you download free software, such as file-sharing applications and games. However, you don't even need to download anything to get spyware: some spyware is installed on your machine just by visiting certain Web sites. This is called a "drive-by" installation. Spyware can also be loaded onto your computer without your knowledge when you open certain email attachments.

Most peer to peer (P2P) file sharing providers, including AOL, Yahoo and Microsoft, do not have proper encryption measures in place to protect the information you send on the network. Because of this, your information is viewable by anyone when you use P2P. Packet sniffers, a form of spyware, are often connected to P2P networks to exploit this. These packet sniffers are able to intercept and read information while it is being sent over the network.

Protective Measures

Practices

  • Be careful of what you send on the network: This is especially important if you have not yet installed spyware-removal software. Without encryption, the information that you send is extremely vulnerable, so do not send personal information across the network.
  • Only buy software or documents from trustworthy sources: If you want to buy a particular software application or digital file that you will download to your computer directly, do your homework and make sure the manufacturer and its source are reputable. There are special Web sites dedicated to reviewing software and guaranteeing a product is not harmful. One such site is Download.com . Software on this Web site is reviewed by the editor and other users. The site even gives you rankings on the quality of the software.

Tools

  • Spyware removal applications: Anti-virus applications generally do not rid your machine of spyware, but there are many commercial and free spyware removal tools available. Some examples are Spybot - Search & Destroy , Ad-Aware , Pest Patrol , and Microsoft Windows Defender . Make sure that you find a legitimate spyware-removal application, since some products touted as anti-spyware applications are ineffective or actually install spyware and adware on your machine. Spyware Warrior  can point you to some good applications and tell you which applications to avoid.

Connect Safely from Different Places

Office

Anti-spyware software: Business computer networks are just as vulnerable to spyware as home computers. Until now, there hasn't been much anti-spyware software made specifically for business users, but a few business-strength anti-spyware products are now available. Spy Sweeper Enterprise  is a version of the popular Spy Sweeper anti-spyware tool just for corporations. Another corporate product is Websense Enterprise . This software offers a solution to the spyware problem by limiting peer-to-peer (P2P) file sharing on corporate networks.

Mobile

Only download programs that you are sure do not contain spyware. On mobile phones, only download software from your Cellular Service Provider (CSP).

On the road

You should be especially careful when you use a laptop on a wireless connection, because many wireless networks are not secure, and you could become infected with spyware.

Ethical Issues

It is both unethical and illegal to include spyware in software without stating clearly in the license agreement that it is included. Therefore, you should read and understand all policies and end-user license agreements (EULAs) before doing any business at a Web site. Many policies and EULAs are purposefully ambiguous or misleading, and they can be difficult to interpret, so make sure that you read them carefully.

Some parents use spyware to eavesdrop on their children's online activities because they believe that this is a good way to protect their children from online predators and inappropriate content. Some people also use spyware to keep tabs on their spouses and other family members, but there are many who feel that using spyware on family members is not at all appropriate. They argue that such use is an invasion of people's privacy and therefore unethical.

Legal Issues

Some states, such as Utah , Washington , and California , are beginning to pass laws against spyware. Other states are expected to follow.

Privacy Issues

Spyware is a threat to your privacy because it attempts to capture your personal information. This can result in identity theft, especially if somebody gets a hold of your credit card number, social security number, or other personally identifiable information. As soon as you detect a spyware application on your machine, disconnect from the Internet and seek help in removing it.

My home page