A Free Educational Resource Created by Carnegie Mellon University to Empower You to Secure Your Part of Cyberspace

Spyware

Software that sends information from your computer to a third party without your consent

Spyware is any software that sends personal information (e.g., Web sites you visit, email addresses, passwords) from your computer to a third party without telling you and without your consent. Spyware differs from malware in that it takes information from your computer, while malware damages your computer.

Many people include adware (software that displays advertising banners in your browser) under the heading of "spyware" because adware often has spyware included in it. This adware can sometimes slow down your machine, make pop-up ads appear on your desktop, or change the settings on your computer. Many of these programs do not clearly state what the application will do or whether spyware is included, and they can be very difficult to uninstall.

A collection of anti-spyware software companies, academics, and consumer groups have formed the Anti-Spyware Coalition  to clarify what exactly can be considered spyware. Their current definition includes any software that makes it difficult for you to control:

  • How you use your computer, including your privacy and security settings
  • What your computer is used for and what is installed on it
  • How your personal information is collected and used

There are a few different ways you can get spyware on your computer. Spyware is sometimes installed on your machine when you download free software, such as file-sharing applications and games. However, you don't even need to download anything to get spyware: some spyware is installed on your machine just by visiting certain Web sites. This is called a "drive-by" installation. Spyware can also be loaded onto your computer without your knowledge when you open certain email attachments.

One of the ways spyware gets information about you is by reading cookies. Cookies are small pieces of information left on your hard drive after you visit a Web site. Any personal information that you give to a Web site may be stored in a cookie, so a Web site's advertisers (or others) could construct a profile of your interests based on the sites you visit. Also, if you provide your credit card number in a Web form, a Web site could store it in a cookie, although this practice has become pretty rare.

Protective Measures

Practices

  • Conduct regular spyware removal scans: You can scan your computer manually, or you can set commercial anti-spyware software to scan your computer periodically for you. If your software has this ability, set it to scan at least once every two weeks. To scan for spyware manually (using Spybot as an example):

    1. Open the Spybot application and look for the navigation bar on the left side of the program.
    2. Click on Spybot-S&D to go to the main page. You will see an empty list and a toolbar at the bottom.
    3. Click the first button in this toolbar labeled Check for problems. After the scan is finished, the list will be populated with threats.
    4. Select all the threats and click the button labeled Fix selected problems.

  • Only download files from trusted sources: Avoid transferring files from unknown or untrusted sources to your hard drive, thumb drive or other storage media, since these files could contain spyware.

Settings

  • Delete cookies: Deleting cookies ensures that none of the information that you have given to various Web sites is stored on your computer. However, it also prevents Web sites from personalizing content on your next visit. For more sophisticated cookie management, see Web Browsing - Spyware. To delete cookies in Internet Explorer 6 and 7:

    1. Go to Tools > Internet Options.
    2. Click the Delete Cookies button.

    Deleting cookies in Internet Explorer 4 and 5 is more complicated because it requires going to the folders where the cookies are stored. The process is described clearly here .

  • Disable cookies: Disabling cookies ensures that none of the information that you have given to various Web sites is stored on your computer. However, it also prevents Web sites from personalizing content on your next visit. For more sophisticated cookie management, see the Web Browsing - Spyware. To disable cookies in Internet Explorer 6 and 7:

    1. Go to Tools > Internet Options.
    2. Select the Privacy tab and move the slider to the top setting: Block All Cookies.

  • Selectively manage cookies: With some browsers, such as Internet Explorer 6 and 7, you have far more precise control of cookies for Web sites in the Internet zone than in earlier versions. To manage cookies in Internet Explorer 6:

    1. Go to Tools > Internet Options and select the Privacy tab to see the cookie management interface.
    2. To set a predefined setting, move the slider bar to your desired security level. This is an easy way to make cookie settings, but it has one weakness. The "Block All Cookies" setting prevents many Web sites from working properly, while the "High" setting surprisingly allows cookies from most advertisers. There’s no good intermediate solution using the pre-defined settings, but custom setting solves this problem, which is accessed through the Advanced button. See the encyclopedia page on cookies for more information.
  • Set your browser's security level to protect against drive-by downloads: In Internet Explorer, your security setting for the Internet Zone should be at least Medium. Also, set your browser to not install any ActiveX controls you have not requested. See Web Browsing - Malware for more information on these settings.

Tools

Connect Safely from Different Places

Office

At work, your systems administrator or IT department may use an enterprise version of spyware removal software. You should be able to determine if this software is installed on your computer by moving your mouse arrow over the icons in the system tray in the bottom right-hand corner of your screen. If any of the names revealed include the word "spy", your machine is probably protected against spyware. In any event, check to make sure that the recommended measures below conform to company policy before using them.

Mobile

To date, there is no spyware for mobile devices; however it could become a threat in the near future. Right now you do run the risk of infecting your desktop or laptop PC whenever you synchronize your mobile device and there is a spyware application among the files you are synchronizing.

On the road

With the spread of Internet access in hotels, coffee houses, bookstores and airports, many travelers now use laptops away from home. However, the risks to your computer are high when you connect to the Internet in these public places.

Unfortunately, while a public network may have a router and firewall, you are sharing that network with many other people, and are thus vulnerable to spyware. You should take the same measures to protect yourself from spyware on the road as you do at home. If you are using a computer that is not your own, you may not be able to use all these measures, so you should be especially cautious with what you do on such computers.

Ethical Issues

It is both unethical and illegal to include spyware in software without stating clearly in the license agreement that it is included. Therefore, you should read and understand all policies and end-user license agreements (EULAs) before doing any business at a Web site. Many policies and EULAs are purposefully ambiguous or misleading, and they can be difficult to interpret, so make sure that you read them carefully.

Some parents use spyware to eavesdrop on their children's online activities because they believe that this is a good way to protect their children from online predators and inappropriate content. Some people also use spyware to keep tabs on their spouses and other family members, but there are many who feel that using spyware on family members is not at all appropriate. They argue that such use is an invasion of people's privacy and therefore unethical.

Legal Issues

Some states, such as Utah , Washington , and California , are beginning to pass laws against spyware. Other states are expected to follow.

Privacy Issues

Spyware is a threat to your privacy because it attempts to capture your personal information. This can result in identity theft, especially if somebody gets a hold of your credit card number, social security number, or other personally identifiable information. As soon as you detect a spyware application on your machine, disconnect from the Internet and seek help in removing it.

My home page