Campaign to combat computer spyware intensifies

The Goverment has launched an initiative to tackle invasive software that covertly gathers information about PC users, writes Richard Barry

Are advertisements appearing on your screen? Are pop-ups driving you mad? Computer slowing down? Welcome to the curse of spyware, the latest breed of malicious code that isn't designed to destroy your machine but which, if you're not protected against it, will do just that.

Spyware is software that hides on your computer, covertly gathering information about you and what you do on the internet.

Spyware is able to track both online and offline activity and is able to pass that information onto third parties without a user's consent.

It can also include system-monitoring tools and keyloggers that capture keystroke information such as usernames, passwords and other private data.

According to one software firm that specialises in dealing with spyware, things are going to get much worse.

Michael Greene, director of product management at security firm Webroot, said that while companies like his are ahead of the game today, the future may not be so bright.

"The spyware writers are becoming more sophisticated and it's going to get nasty," he said.

The latest technique is for spyware hackers to install a so-called "root kit" on a user's machine, which overwrites specific operating system files with the hacker's version.

Once in place, the root kit is installed onto the system and the hackers will kill the original processes to start their own.

Greene said that without adequate knowledge and protection against these techniques, computer users risk permanent damage to their systems.

"We are now seeing spyware that hijacks a system and, if you try to remove it, it brings your whole machine down. I don't think it's far-fetched to say that sometime in the future, we may not be able to get the spyware off the machine."

In other words, you might have to live with it or risk all of your data. It is a remarkable statement from a company whose sole purpose is to deal with malicious software, but with the volume of spyware finding its way onto the internet every year, it may be the most candid remark you'll get from the security sector.

Last week, Webroot released a report that suggests that around 55 per cent of consumers' Windows-based PCs are infected with adware, a type of spyware.

It suggests that the average machine has as many as 18 spies lurking on hard drives.

The UK has one of the highest rates of infection. Only Thailand and the US have more infected machines, according to the report. It also estimates that spyware is costing the UK as much as £445 million (€654 million) every year in lost productivity and repairs.

Graham Cluley, senior technology consultant at anti-virus firm Sophos, said that education is the key to dealing with spyware's evolution.

"I think rumours of the death of the internet are greatly exaggerated and I don't believe we'll get to the stage where vendors can't handle spyware. But the challenge is to educate people into recognising that having a PC connected to the internet is like having a classic car. Both need plenty of care. You have to know how to look after them."

Because spyware only started appearing two years ago and really only became a serious problem 12 months later, many users still don't know what it is or how to deal with it, and most PC manufacturers are not providing anti-spyware software on new machines, leaving them vulnerable to attack.

Cluely said: "It's disgraceful that people are able to buy machines that aren't protected against spyware and viruses, particularly as our research shows that, within 12 minutes of connecting an unprotected machine to the internet, there is a 50 per cent chance of getting a net worm on your machine."

The stakes are high, and last week the Minister for Communications, Marine and Natural Resources, Noel Dempsey, launched the "makeITsecure 2005" (www.makeitsecure.ie) security awareness campaign in Ireland.

This year's campaign is focusing on spyware, ID theft, "phishing" - where users are tricked into giving out confidential information - and child safety online.

All the big players are involved in the campaign, including Microsoft, Symantec, Eircom, Dell. It is a measure of how serious the problem is when the State rolls out a national advertising campaign to warn users of the dangers of such invasive software.

Dempsey said: "This is the largest IT security campaign ever seen in Ireland. It is important that people are informed of the potential risks out there and that they stay secure when online."

Greene warned that users connected to the internet need to take special care around Christmas as advertisers that use spyware will step up their efforts to ensure their products reach as many screens as possible.

"It's an obvious time for spyware writers to target users' machines, so if they don't have protection, now is the time to get it," he said.

Many PC users install free anti-spyware programs such as Microsoft's anti-spyware beta, Spybot and Addaware, to protect against spies and adware.