Software spy in the machine can cost businesses dearly

The deluge of viruses this year means that nearly everyone knows that emails with unsolicited offers of interesting pictures or system updates need to be treated with suspicion.

But what about that handy utility you want to run on your office PC or that file-sharing software you'd rather run from work because it's faster than downloading on your modem at home? There's a huge range of software, from useful to dubious, that you can download free, but some programs come with hidden extras.

Instead of asking users to pay if they like the program, some developers include extra software that tracks the websites you visit as a form of free market research. And some spyware tracks considerably more than that. And while spyware has been around for a couple of years, the past six months have seen it spreading.

If you find your system slowing down or your Web browser opening to the wrong search engine, you might have an unwanted visitor, but because these programs aren't viruses, standard anti-virus software usually does little to protect you. For one thing, there are legal issues with detecting and blocking ad-sponsored software that users have agreed to install (even if they didn't bother to read the licence agreement). For another, there are a lot of programs to track, and many people see it as a trivial problem for home-users rather than a serious issue for business.

But even if the spyware infesting business desktops is only ad-tracking code, that can be a huge burden on network resources. One insurance company that started using Websense to monitor its network found spyware was generating half a million outgoing messages from its desktop in three days. The company email addresses used to send those messages are likely to end up in spam databases as well, which means more traffic and time wasted. Having the home page in your Web browser changed can affect your productivity as well as being an inconvenience.Tracking down and removing spyware from every desktop is going to affect the productivity of your IT team as well.

And you can't just assume that spyware is benign, even if it is legitimate commercial software. Keystroke loggers are useful for parents wanting to keep track of what their children do online, but the same software running in your finance department is a major security issue. Gabe Newell, of Valve Software, believes that keystroke recording software helped hackers steal source code for the Half Life 2 game recently - a theft that has meant postponing the release of the game for at least six months. If customers' information is stolen from your computers, they are going to lose confidence in your business. To add insult to injury, you could find yourself liable under data protection rules, too.

Commercial espionage may not be common and many incidents can be traced to insiders, but Pete Simpson, manager of Clearswift's ThreatLab, thinks we're going to see more general attacks. "It's become clear the spammers have got together with the virus writers and the hackers. It is probably organised crime with some big money behind it and the motive is financial gain."

Clearswift recorded a major rise in spam email selling spyware following Microsoft's decision to close MSN's public chat rooms, which could suggest that the hackers had been distributing their code in chat and are looking for new victims to replace their lost audience.

Few companies are protecting themselves against spyware, and most of the tools for detecting and removing it are designed for home-users - and have to be run on every desktop individually. Anti-virus vendors are starting to take an interest and there may soon be adware and surveillance spyware available.

But rather than tackling spyware as a separate security problem, you should look at the implications for your security policy more generally, such as who is entitled to install which software on their PC.

While some spyware is downloaded through websites, more arrives in email, so blocking or quarantining incoming executable files will protect you. It is hard to block most spyware at the firewall because it sends messages back using email and HTTP, traffic you will want to allow through.

Websense offers a free trial of its monitoring software to see if spyware is clogging up your network. This checks the destination of all outgoing email, blocks messages to known monitoring sites based on a list updated daily and lets you choose which users are allowed to send email, and to what addresses. Whatever software you choose, to stop hackers spying on you, you may need to start monitoring your own systems much more closely.