DOCSLIB.ORG

Dealing with Adware and Spyware

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Dealing with Adware and Spyware SECURITY Dealing With Adware And Spyware Lisa Phifer You'll need a hybrid of host- ment just by reducing spyware remediation cost. Webroot estimates that help de.sk calls, resurrect- and network-based ing compromised workstations and the resulting approaches, as well as the down time run about $250 per user, per year (a security professional's calculation is shown in Figure 1). Potential return on investment does not end greatest asset: Constant there. Spyware not only slows desktops; it saps vigilance. worker productivity and hogs bandwidth. Accord- ing to SurfControl, ISPs find that peer-to-peer f early viruses like BubbleBoy and LoveBug spyware programs (e.g., Grokster, KaZaA, make you pine for simpler times, then you are Limewire) generate up to 70 percent of network probably waging war against this millenni- traffic. Spyware that exposes private data may um's far more tenacious foe: The stubborn result in embarrassing public disclosure, costly Icrop of spyware that now infests three out of four customer notificafion and compliance violations PCs. From pesky adware like BonziBuddy to that bring hefty fines. Spyware is also a popular malicious malware like Trojan-Down loader-Zlob, vector for executing electronic crimes like identi- spyware is literally choking corporate desktops ty theft and on-line fraud. In one well-publicized and networks. Responsible for one out of four case, 22 Israelis were anested for using spyware help desk calls and half of the PC crashes report- to commit corporate espionage. Wbite data theft ed to Microsoft, spyware is draining IT resources costs are notoriously difficult to quantify, the and business productivity. gravity of such incidents cannot be denied. Busi- Worse, spyware is now morphing from nui- ness consequences are already significant, and sance to nightmare. Those seeking financial gain will continue to escalate as spyware grows more through spyware have evolved from tracking virulent. cookies and intrusive pop-up ads to more selective Unfortunately, defeating spyware is harder and insidious methods. For example, drive-by- than evading conventional viruses. Spyware is any downloads are installing exploit code onto PCs potentially-unwanted program that makes unde- that merely visit websites, without user interac- sirable changes to your computer and/or collects tion. Phishing trojans are monitoring browser information about user activities, without consent, activity, waiting to capture identities and creden- usually for financial gain. That definition may be tials during on-line banking transactions. Keylog- fine in the abstract, but making concrete decisions Lisa Phifer is an gers are harvesting sensitive ^^^^^^^^^ owner and principal data from victims, violating ^ consultant at Core privacy laws and industry reg- FIGURE1 Cost Of Spyware (A Calculator) Competence, a ulations. network security Number of Workstations: 11000 technology consulting Stamping Out Spyware Average Hours to Re-image: firm based in Chester Associated business risks are Hourly Value of Employee Time; Springs, PA. A 25-year making it impossible for com- veteran ofthe panies to ignore spyware. The Re-image Rate: networking industry. Radicati Group projects that Average Cost per Help Desk Call; Lisa has been battling anfi-spyware spending will Monthiy % Chance of Spyware Call: the spyware scourge grow from $103 million in since 2001. She can be 2005 to more than reached at $1 billion by 2009. Many Totai Cost of Spyware: lisa @ corecom. com. companies can justify invest- Source: Webroot 44 BUSINESS COMMUNICATIONS REVTEW / AUG 2006 Use BCR's Acronym Dircclnrv ;il about which programs are really spyware can be These are but a few of thousands of pieces of difUcult. code congregating under the spyware umbrella. • Annoying Adware—Many programs monitor They illustrate that spyware is extremely diverse activity, but when does that become a breach of in delivery method, installed behavior and poten- Spyware has a privacy? Cookies retain personal information— tial impact. These characteristics make spyware usernanies, passwords, preferences—so that web- challenging to detect, and even more challenging penchant for sites can improve user experience. But some cook- to mitigate. In .short, spyware is a complex threat social ies share tracking data with third parties that deliv- that is most effectively addressed through multi- er pop-tips and banner ads; those installed without phase, multi-layered defenses. engineering user consent are called adware cookies. And then there are programs like WeatherBug and Surf- Phase One: Proactive Prevention SideKick thai display sponsor ads while they run. The old adage, "An ounce of prevention is worth a Such adware programs may or may not obtain pound of cure" certainly applies to spyware. Once consent to track and share personal data through spyware has been installed on a host, it can be end user license agreements^—which most users extremely difficult to return that host to a trust- simply accept without reading. worthy state. Efficient spyware defense starts with • Nebulous NonBizWare—Many workers proactive steps intended to circumvent popular insUill non-business software on corporate PCs, delivery methods. from IM and softphones to multi-user games and Spyware has a penchant for social engineer- peer-to-peer file sharing. Beyond reducing pro- ing—from tricking users into clicking on fake ductivity. NonBizWjire establishes communica- pop-ups to bundling trojans with enticing share- tion "'back channels" that could be exploited to ware. We cannot depend on users to "do the right penetrate or attack a corporate network. thing," but we can still benefit from spyware edu- NonBizWare may also expose employers to cation. Many on-line resources exist, including legal liability as.stKiated with distribution of copy- StopBadWare.org. StaySafeOnline.org. CERT righted music, pirated software and pornographic Cyber Security Tip ST{)4-016. and knowledge material. Therefore, even though NonBizWare bases published by reputable anti-spyware ven- may not "spy" on users, many anti-spyware solu- dors. But take care to avoid rogue anti-spyware— tions treat these potentially-unwanted programs as see www. spywarewarrior.com/rogue.anti-spy- ware, htm. another form of spy wjire. • Menacing Malware—A growing percentage Spyware often makes its way onto a desktop of spyware is malicious software intended to dam- through a Web browser. Secure browser configu- age a computer, steal data, or create an attack plat- ration can help to stop hijackers and drive-by fonn. For example, browser hijackers like Cool- downloads. ActiveX controls are a spyware WebSearch_xplugin change home pages, redirect favorite; disabling unsigned ActiveX is a simple Web searches, and misdirect URLs to phishing bul valuable step. Disabling Java applets can also pages and pay-to-play search engines. Keyloggers be helpful, but more likely to cripple legitimate websites. These and other browser configuration like SpyBuddy record document edits, email, tips can be found online, including bltp://cyber- instant messages, chat room conversations and coyote.org/security/browsers.shtml. Companies Web form responses by relaying user keystrokes should disable user prompting, enforcing active to remote attackers. Botnets use worms or trojans content and plug-in settings with a desktop man- to plant drones like SoberQ that listen for IRC agement tool like Active Directory Group Policy commands instructing them to relay spam or join Objects. DDoS attacks. Trojan downloaders like Zlob and Wstart hide in attachments and downloads, open- Many adware cookies and browser hijackers ing back doors through which other programs can can be neutralized by configuring browser Privacy be remotely installed. Rootkits like NTRootKit settings to disable third-party cookies and block pop-ups. Exceptions can be made for legitimate are trojans that operate as hidden system files, let- websites that require these features to operate cor- ting attackers gain unrestricted access to a "root- rectly, preferably by importing a company-defined ed" computer. And tbe list goes on. list of permitted sites. Pop-up blockers are freely Unlike adware and NonBizWare, there is little available from many sources, including tbe Win- room for interpretation here: Malware rarely dows XP SP2 upgrade for Intemet Explorer and belongs on any system. the Google Toolbar. • Rogue Anti-Spyware—Finally, spyware itself Use Intemet Explorer's Restricted Site Zone has created an opportunity for rogue anti-spy- (or equivalent features in otber browsers) to block ware—programs like SpyAxe, Winhound, and access to known adware and spyware silcs. But do Spy Trooper that use pop-up ads and scare tactics not attempt to populate tbis list manually. Instead, to convince users lo download phony anti-spyware use a tool like JavaCool SpywareBlaster to con- programs. When executed, many of these rogues figure this banned site list, and update that list reg- generate "false positive" warnings that hound ularly as new sites emerge. users into purchasing clean-up programs or paid Many spyware programs need administrative feature licenses. BUSINESS COMMUNICATIONS REVIEW / AUG 2006 46 rights to install themselves, overwrite OS files or or contain embedded URLs for spyware websites. disable security measures in an effort to evade This risk can be reduced by using non-IE viewers detection. Those threats can be crippled or neu- when displaying HTML content, using applica- It is necessary to tralized by browsing the
Load more

Recommended publications
  • Translators' Tool
    The Translator’s Tool Box A Computer Primer for Translators by Jost Zetzsche Version 9, December 2010 Copyright © 2010 International Writers’ Group, LLC. All rights reserved. This document, or any part thereof, may not be reproduced or transmitted electronically or by any other means without the prior written permission of International Writers’ Group, LLC. ABBYY FineReader and PDF Transformer are copyrighted by ABBYY Software House. Acrobat, Acrobat Reader, Dreamweaver, FrameMaker, HomeSite, InDesign, Illustrator, PageMaker, Photoshop, and RoboHelp are registered trademarks of Adobe Systems Inc. Acrocheck is copyrighted by acrolinx GmbH. Acronis True Image is a trademark of Acronis, Inc. Across is a trademark of Nero AG. AllChars is copyrighted by Jeroen Laarhoven. ApSIC Xbench and Comparator are copyrighted by ApSIC S.L. Araxis Merge is copyrighted by Araxis Ltd. ASAP Utilities is copyrighted by eGate Internet Solutions. Authoring Memory Tool is copyrighted by Sajan. Belarc Advisor is a trademark of Belarc, Inc. Catalyst and Publisher are trademarks of Alchemy Software Development Ltd. ClipMate is a trademark of Thornsoft Development. ColourProof, ColourTagger, and QA Solution are copyrighted by Yamagata Europe. Complete Word Count is copyrighted by Shauna Kelly. CopyFlow is a trademark of North Atlantic Publishing Systems, Inc. CrossCheck is copyrighted by Global Databases, Ltd. Déjà Vu is a trademark of ATRIL Language Engineering, S.L. Docucom PDF Driver is copyrighted by Zeon Corporation. dtSearch is a trademark of dtSearch Corp. EasyCleaner is a trademark of ToniArts. ExamDiff Pro is a trademark of Prestosoft. EmEditor is copyrighted by Emura Software inc. Error Spy is copyrighted by D.O.G. GmbH. FileHippo is copyrighted by FileHippo.com.
    [Show full text]
  • Complete Malware Protection for Your Business
    Complete Malware Protection for your Business ENDPOINT MALWARE PROTECTION WITH FLEXIBLE CLIENT MANAGEMENT Undetected malware on corporate computers can lead to theft of confidential data, network corruption, drained system resources, and considerable financial damage due to loss of valuable working time. With the nature of today’s cyber threats, busi- nesses need advanced workstation solutions in place to prevent the risks that insuf- ficient security brings. Lavasoft, the makers of industry-leading Ad-Aware Internet Security, are introducing an innovative new solution for today’s companies in need of effectively protecting their network computers, without sacrificing limited budgets or straining IT infrastructures. Ad-Aware Business Security combines the powerful protection and efficiency of our strong antimalware solutions with a central, easy-to-use management tool. Proactively defend corporate data with maximum security against viruses, spyware, rootkits and other malicious threats – allowing your IT professionals to centrally ad- minister, protect and control the security of workstations in your company’s network. COMPREHENSIVE MALWARE PROTECTION Secure business PCs with an advanced online defense against blended malware, spyware, viruses, worms, and other potential data thieves with Ad-Aware Business Security’s extensive threat database, along with continuous pulse updates to guard KEY FEATURES against new attacks. Business Client and Management Agent for Leading behavior-based heuristics anti-malware technology and continuous push WinCentrally managed Internet security (pulse) updates to guard your business’ PCs against immediate and unknown emerg- ing - threats. High performance, low resource impact Integrated real-time protection that immediately detects and blocks malware ap- Powerful antimalware engines plications to prevent further system damage.
    [Show full text]
  • Your Member Benefit
    Your Member Benefit General tech support at no additional cost to you. Friendly Tech Helpline analysts can help you resolve problems with your computers, (866) 232-1831 tablets, printers, scanners, smartphones, and more. http://chat.TechHelpline.com The best part is that Tech Helpline is your member benefit included in your association dues. [email protected] Monday-Friday: 9AM to 8PM Saturday: 9AM to 5PM ET brought to you by SM Basic Coverage • Instruction for installing and configuring new hardware and software • Diagnosis and repair of computer hardware and software issues • Advice for purchasing hardware, software and services • Basic instruction for major software applications • Recommendations for upgrades and updates • Advice for performance optimization • Troubleshooting network issues Support Operating Systems: Software Applications: All PC compatible, Mac • Microsoft Windows 10® Email and clones such as: • Microsoft Windows 7® • MS Outlook • Acer • Microsoft Windows 8® • Webmail • Apple • Mac OS X ® (10.3 and higher) • Windows Mail • AST • ASUS Hardware: Real Estate Specific • Clones / Whitebox • Form Simplicity • Dell • Smartphones: iPhones, Android, • The Living Network • Epson Windows • Fujitsu • Tablets: iOS, Android, Windows Office/Financial • Gateway • Digital Cameras • Adaptec Toast • Hewlett Packard • CD/DVD Drives & Blu-ray • Adaptec EZCD Creator • IBM • Laptops • Adobe Acrobat • Lenovo • Monitors • Corel Offi ce Products: • Sony • Network Adaptors WordPerfect, Quattro Pro • Toshiba • PC add-on cards Presentations,
    [Show full text]
  • Usability and Security of Personal Firewalls
    Usability and Security of Personal Firewalls Almut Herzog^ and Nahid Shahmehri^ Dept. of Computer and Information Science, Linkopings universitet,Sweden {almhe, nahsh}@ida.liu.se Abstract. Effective security of a personal firewall depends on (1) the rule granularity and the implementation of the rule enforcement and (2) the correctness and granularity of user decisions at the time of an alert. A misconfigured or loosely configured firewall may be more dangerous than no firewall at all because of the user's false sense of security. This study assesses effective security of 13 personal firewalls by comparing possible granularity of rules as well as the usability of rule set-up and its influence on security. In order to evaluate usability, we have submitted each firewall to use cases that require user decisions and cause rule creation. In order to evaluate the firewalls' security, we analysed the created rules. In ad­ dition, we ran a port scan and replaced a legitimate, network-enabled application with another program to etssess the firewalls' behaviour in misuse cases. We have conducted a cognitive walkthrough paying special attention to user guidance and user decision support. We conclude that a stronger emphasis on user guidance, on conveying the design of the personal firewall application, on the principle of least privilege and on implications of default settings would greatly enhance both usability and security of personal firewalls. 1 Introduction In times where roaming users connect their laptops to a variety of public, pri­ vate and corporate wireless or wired networks and in times where more and more computers are always online, host-based firewalls implemented in soft­ ware, called personal firewalls, have become an important part of the security armour of a personal computer.
    [Show full text]
  • The Spyware Used in Intimate Partner Violence
    The Spyware Used in Intimate Partner Violence Rahul Chatterjee∗, Periwinkle Doerflery, Hadas Orgadz, Sam Havronx, Jackeline Palmer{, Diana Freed∗, Karen Levyx, Nicola Dell∗, Damon McCoyy, Thomas Ristenpart∗ ∗ Cornell Tech y New York University z Technion x Cornell University { Hunter College Abstract—Survivors of intimate partner violence increasingly are decidedly depressing. We therefore also discuss a variety report that abusers install spyware on devices to track their of directions for future work. location, monitor communications, and cause emotional and physical harm. To date there has been only cursory investigation Finding IPS spyware. We hypothesize that most abusers find into the spyware used in such intimate partner surveillance (IPS). spyware by searching the web or application stores (mainly, We provide the first in-depth study of the IPS spyware ecosystem. Google Play Store or Apple’s App Store). We therefore We design, implement, and evaluate a measurement pipeline that combines web and app store crawling with machine learning to started by performing a semi-manual crawl of Google search find and label apps that are potentially dangerous in IPS contexts. results. We searched for a small set of terms (e.g., “track my Ultimately we identify several hundred such IPS-relevant apps. girlfriend’s phone without them knowing”). In addition to the While we find dozens of overt spyware tools, the majority are results, we collected Google’s suggestions for similar searches “dual-use” apps — they have a legitimate purpose (e.g., child to seed further searches. The cumulative results (over 27,000+ safety or anti-theft), but are easily and effectively repurposed returned URLs) reveal a wide variety of resources aimed at for spying on a partner.
    [Show full text]
  • NOTICE by Hotfile Corp., Anton Titov Defendants' Notice of Filing The
    Disney Enterprises, Inc. et al v. Hotfile Corp. et al Doc. 391 Att. 1 EXHIBIT A Dockets.Justia.com PUBLIC VERSION UNITED STATES DISTRICT COURT SOUTHERN DISTRICT OF FLORIDA CASE NO.: 11-CIV-20427-WILLIAMS/TURNOFF DISNEY ENTERPRISES, INC., TWENTIETH CENTURY FOX FILM CORPORATION, UNIVERSAL CITY STUDIOS PRODUCTIONS LLLP, COLUMBIA PICTURES INDUSTRIES, INC., and WARNER BROS. ENTERTAINMENT INC., Plaintiffs, v. HOTFILE CORP., ANTON TITOV, and DOES 1-10. Defendants. / HOTFILE CORP., Counterclaimant, v. WARNER BROS. ENTERTAINMENT INC., Counter-Defendant. / [REDACTED] DECLARATION OF PROFESSOR JAMES BOYLE IN SUPPORT OF DEFENDANTS’ OPPOSITION TO PLAINTIFFS’ MOTION FOR SUMMARY JUDGMENT AND EXHIBITS THERETO FILED UNDER SEAL CASE NO.: 11-CIV-20427-WILLIAMS/TURNOFF I, JAMES BOYLE, declare as follows: 1. I am currently the William Neal Reynolds Professor of Law at Duke University, and have been retained by Farella, Braun + Martel LLP on behalf of the Defendants in this action as an expert witness. 2. I received an LL.B. (Hons) from Glasgow University (1980), and an LL.M. (1981) and S.J.D. (1986) from Harvard Law School. I have been a law professor since 1982, teaching at American University, and at the Universities of Pennsylvania, Harvard and Yale as a Visiting Professor. In 2000 I joined the law faculty at Duke. 3. My academic research is mainly in the areas of intellectual property and communication policy, with a focus on the Internet. I have written and edited numerous articles and books on these subjects. In general, my research and scholarship has focused on: i) Copyright law, particularly in the digital arena. I have published extensively on copyright in law journals, monographs, and edited collections of essays; a full list is available in the attached curriculum vitae.
    [Show full text]
  • Automatic Classifying of Mac OS X Samples
    Automatic Classifying of Mac OS X Samples Spencer Hsieh, Pin Wu and Haoping Liu Trend Micro Inc., Taiwan TREND MICRO LEGAL DISCLAIMER The information provided herein is for general information Contents and educational purposes only. It is not intended and should not be construed to constitute legal advice. The information contained herein may not be applicable to all situations and may not reflect the most current situation. Nothing contained herein should be relied on or acted 4 upon without the benefit of legal advice based on the particular facts and circumstances presented and nothing Introduction herein should be construed otherwise. Trend Micro reserves the right to modify the contents of this document at any time without prior notice. Translations of any material into other languages are intended solely as a convenience. Translation accuracy 6 is not guaranteed nor implied. If any questions arise related to the accuracy of a translation, please refer to Mac OS X Samples Dataset the original language official version of the document. Any discrepancies or differences created in the translation are not binding and have no legal effect for compliance or enforcement purposes. 10 Although Trend Micro uses reasonable efforts to include accurate and up-to-date information herein, Trend Micro makes no warranties or representations of any kind as Classification of Mach-O Files to its accuracy, currency, or completeness. You agree that access to and use of and reliance on this document and the content thereof is at your own risk. Trend Micro disclaims all warranties of any kind, express or implied. 11 Neither Trend Micro nor any party involved in creating, producing, or delivering this document shall be liable for any consequence, loss, or damage, including direct, Malware Families indirect, special, consequential, loss of business profits, or special damages, whatsoever arising out of access to, use of, or inability to use, or in connection with the use of this document, or any errors or omissions in the content 15 thereof.
    [Show full text]
  • Analyzing Android Adware
    San Jose State University SJSU ScholarWorks Master's Projects Master's Theses and Graduate Research Spring 2018 Analyzing Android Adware Supraja Suresh San Jose State University Follow this and additional works at: https://scholarworks.sjsu.edu/etd_projects Part of the Computer Sciences Commons Recommended Citation Suresh, Supraja, "Analyzing Android Adware" (2018). Master's Projects. 621. DOI: https://doi.org/10.31979/etd.7xqe-kdft https://scholarworks.sjsu.edu/etd_projects/621 This Master's Project is brought to you for free and open access by the Master's Theses and Graduate Research at SJSU ScholarWorks. It has been accepted for inclusion in Master's Projects by an authorized administrator of SJSU ScholarWorks. For more information, please contact [email protected]. Analyzing Android Adware A Project Presented to The Faculty of the Department of Computer Science San Jose State University In Partial Fulfillment of the Requirements for the Degree Master of Science by Supraja Suresh May 2018 ○c 2018 Supraja Suresh ALL RIGHTS RESERVED The Designated Project Committee Approves the Project Titled Analyzing Android Adware by Supraja Suresh APPROVED FOR THE DEPARTMENTS OF COMPUTER SCIENCE SAN JOSE STATE UNIVERSITY May 2018 Dr. Mark Stamp Department of Computer Science Dr. Katerina Potika Department of Computer Science Fabio Di Troia Department of Mathematics ABSTRACT Analyzing Android Adware by Supraja Suresh Most Android smartphone apps are free; in order to generate revenue, the app developers embed ad libraries so that advertisements are displayed when the app is being used. Billions of dollars are lost annually due to ad fraud. In this research, we propose a machine learning based scheme to detect Android adware based on static and dynamic features.
    [Show full text]
  • EBO IT Troubleshooting
    EBO IT Troubleshooting Because EarnBenefits Online (EBO) is an internet-based software, sometimes the program’s speed can be impacted by your internet connection or computer. The following are suggestions for maintenance and protective software that might be applied to your individual computer to potentially improve speed and performance. These solutions are not guaranteed. EBO Nexus and EBO do not produce or support any of the applications listed here and cannot be held liable for any negative impact that their installation or use may have on your machine. If you are not authorized by your organization, or are not comfortable with installing software, then contact your organization’s IT Support for assistance. If you are experiencing difficulty connecting to EBO, contact the Helpdesk. They can be reached at [email protected] or 855-EBO-NEXUS (855-326-6398). You can also confirm if EBO is having system-wide problems by visiting downforeveryoneorjustme.com. Things that you can do: If you are using Firefox to access EBO: Make sure that Firefox is up-to-date. Click on Help (in the browser Menu Bar) and ‘Check for Updates.’ (If Firefox is up-to-date, ‘Check for Updates’ will be grayed out.) When using EBO, avoid having multiple tabs open to access other web pages. Minimize the number of other web sites and program you have open. Clear the cache in Firefox. Click on Tools (in the browser Menu Bar) and ‘Clear Recent History…’ When prompted, select ‘Cache’ and ‘Cookies.’ Select ‘Everything’ as the Time Range to Clear. Click ‘Clear Now.’ Things to ask your IT staff: The following free programs can provide protection against malicious programs that may slow your computer.
    [Show full text]
  • Malware - the Silent Killer
    Malware - The Silent Killer by Cost Effective Computers Malware Introduction by Brian Flynn Malware is malicious software that is loaded on your computer. This help guide was designed to give you an overview of what Malware is, how you get it, and how to get rid of it. Though every effort has been made to ensure the accuracy of the information contained in this document, the information is in no way warranted, neither explicitly or implicitly. As with all computer related information, make a point to stay current with what is happening. That is the only way to protect your hardware and your data. Contents I Table of Contents Part I Introduction 2 Part II Liability 2 Part III Desktop Malware 3 1 Desktop Malware....... ............................................................................................................................ 3 2 File Sharing Apps....... ............................................................................................................................ 4 3 Utilities ................................................................................................................................... 4 4 Games ................................................................................................................................... 5 5 Miscellaneous.. ................................................................................................................................. 5 6 Task Bar Icons... ...............................................................................................................................
    [Show full text]
  • Mcafee Potentially Unwanted Programs (PUP) Policy March, 2018
    POLICY McAfee Potentially Unwanted Programs (PUP) Policy March, 2018 McAfee recognizes that legitimate technologies such as commercial, shareware, freeware, or open source products may provide a value or benefit to a user. However, if these technologies also pose a risk to the user or their system, then users should consent to the behaviors exhibited by the software, understand the risks, and have adequate control over the technology. McAfee refers to technologies with these characteristics as “potentially unwanted program(s),” or “PUP(s).” The McAfee® PUP detection policy is based on the process includes assessing the risks to privacy, security, premise that users should understand what is being performance, and stability associated with the following: installed on their systems and be notified when a ■ Distribution: how users obtain the software including technology poses a risk to their system or privacy. advertisements, interstitials, landing-pages, linking, PUP detection and removal is intended to provide and bundling notification to our users when a software program or technology lacks sufficient notification or control over ■ Installation: whether the user can make an informed the software or fails to adequately gain user consent to decision about the software installation or add- the risks posed by the technology. McAfee Labs is the ons and can adequately back out of any undesired McAfee team responsible for researching and analyzing installations technologies for PUP characteristics. ■ Run-Time Behaviors: the behaviors exhibited by the technology including advertisements, deception, and McAfee Labs evaluates technologies to assess any impacts to privacy and security risks exhibited by the technology against the degree of user notification and control over the technology.
    [Show full text]
  • A Systematic Empirical Analysis of Unwanted Software Abuse, Prevalence, Distribution, and Economics
    UNIVERSIDAD POLITECNICA´ DE MADRID ESCUELA TECNICA´ SUPERIOR DE INGENIEROS INFORMATICOS´ A Systematic Empirical Analysis of Unwanted Software Abuse, Prevalence, Distribution, and Economics PH.D THESIS Platon Pantelis Kotzias Copyright c 2019 by Platon Pantelis Kotzias iv DEPARTAMENTAMENTO DE LENGUAJES Y SISTEMAS INFORMATICOS´ E INGENIERIA DE SOFTWARE ESCUELA TECNICA´ SUPERIOR DE INGENIEROS INFORMATICOS´ A Systematic Empirical Analysis of Unwanted Software Abuse, Prevalence, Distribution, and Economics SUBMITTED IN PARTIAL FULFILLMENT OF THE REQUIREMENTS FOR THE DEGREE OF: Doctor of Philosophy in Software, Systems and Computing Author: Platon Pantelis Kotzias Advisor: Dr. Juan Caballero April 2019 Chair/Presidente: Marc Dasier, Professor and Department Head, EURECOM, France Secretary/Secretario: Dario Fiore, Assistant Research Professor, IMDEA Software Institute, Spain Member/Vocal: Narseo Vallina-Rodriguez, Assistant Research Professor, IMDEA Networks Institute, Spain Member/Vocal: Juan Tapiador, Associate Professor, Universidad Carlos III, Spain Member/Vocal: Igor Santos, Associate Research Professor, Universidad de Deusto, Spain Abstract of the Dissertation Potentially unwanted programs (PUP) are a category of undesirable software that, while not outright malicious, can pose significant risks to users’ security and privacy. There exist indications that PUP prominence has quickly increased over the last years, but the prevalence of PUP on both consumer and enterprise hosts remains unknown. Moreover, many important aspects of PUP such as distribution vectors, code signing abuse, and economics also remain unknown. In this thesis, we empirically and sys- tematically analyze in both breadth and depth PUP abuse, prevalence, distribution, and economics. We make the following four contributions. First, we perform a systematic study on the abuse of Windows Authenticode code signing by PUP and malware.
    [Show full text]