Separate Anti-Keylogging Protection: Who Needs it
If there still are few unprotected computers left, I haven't seen any. Every emerging threat causes means of defense to appear. Anti-viruses and firewalls were the first. Now most computers have also an anti-spy program installed. More and more often experts say that some computers need autonomous anti-keylogging protection as well.
Or do they? Isn't a separate anti-keylogger on a PC a little too much? Can a user do without it--why so much attention to a particular type of what is usually called spyware? Well, the threat is extremely serious, that's why.
Information is not a liquid, but, unfortunately, it tends to leak quite the same way. First something trickles out, then…Whole businesses may be washed away in no time; and the damage which data leak cause to state and government institutions can be terrifying. Data leakage is in a way comparable with a break of a dam, with one clear-cut distinction that makes all the difference. There is also another factor- information value. A tiny drop of information, if lost, is likely to cause irretrievable damage.
Money losses due to online fraud are only the tip of an iceberg. There may be irremediable mischief that can never be repaid. It happens when confidential information people have to consign to authorities is stolen. Information having to do with people's health, work, education, families, can be pinched, not out of simple curiosity, of course. Addresses and phone numbers, school and university records, tests results, police records, health records, insurances, tax records, voters lists and so long and so forth--all these contain bits of information that if made public can probably do harm to people mentioned there.
How simple and cheap it is now to get hold of spy software! Scores of various spy programs are available online, and many of them are free. Just imagine that they are within a mouse click from anyone - and do thank God if it is only some suspicious spouse.
Of course, there are means of defense. Loads of programs are specially created to counteract spy software, and they are also available online. Why data stealing is flourishing then? The problem is that the "means of defense" are, as it often happens, half a step behind "means of offense". Signature bases which all the anti-spy software depend on, are made up using clips of spy programs' codes; if a base doesn't contain the "autograph" of some spy program or virus, users are helpless against it. And what if the spy software is brand-new? What if it is tailor-made for one particular computer or network (not yours, if you are lucky enough) to be used only once? What if a respectable program for monitoring is used for spy purposes?
So, even if your PC does have some anti-monitoring or anti-spy software with a signature base, your PC may be being scanned right now anyway.
One useful tip: When reading an article where some term (for example, "spyware") is used often, make sure the author and you mean the same. There is quite a mess in definitions when it comes to types of software. Not surprisingly for those who still remember English lessons at school, every noun ending with "ware" is a mixture of objects having something in common--usually used for similar purposes. So it tends to be when "ware" is short for "software". Sometimes it's pretty tricky to define exactly what software it includes.
If software collects information without users' knowledge and transmits it, such a program is usually automatically labeled "spyware" no matter how valuable this information is. Well, let's use common sense. If spyware is a mixture of different software products based on different principles, it's unlikely that there can be one solution that could work against all of them. Absolute protection is a pie in the sky.
What kind of spyware is the most dangerous? Not just annoying, like most adware, but really dangerous? There is particular kind of software specially created for stealing information. One of the most effective ways of stealing information from a PC is capturing keystrokes. It would not be out of place to know the enemy better. Well, here they are:
Keylogging Programs (keyloggers, key loggers, keystroke loggers, key recorders, key trappers, key capture programs, etc.) belong to the group of tools that monitor PC activity. A small, fairly simple program (a programmer can write a plain one in a couple of days) captures everything the user is doing – keystrokes, mouse clicks, files opened and closed, sites visited. A little more sophisticated programs of this kind also capture text from windows and make screenshots (record everything displayed on the screen) – so the information is captured even if the user doesn't type anything, just opens the views the file.
Software products of this type were initially designed solely for recording keystroke information including the system keys, to the special log file to be analyzed by the person who installed this program. Log files can be sent within the network to the shared place, to the ftp server in the Internet, by e-mail etc. These new software products have many additional functions - they intercept information from windows, capture mouse clicks, make snapshots of the screen and active windows, record all received and sent emails, monitor file activity, monitor system register, monitor the printer queue, intercept sound from the microphone and video pictures from the web-camera connected to the computer, etc.
Keyloggers can be included into freeware, shareware, and even into commercial programs. Trojan programs, viruses and Internet worms pretty often contain keyloggers, too. That is why it is so important to apply special anti-keylogging protection.
Who needs separate anti-keylogging protection? We can easily deduce the answer:
Everybody whose data are really valuable and who will suffer great losses if they are stolen.
Everybody who deals with other people's confidential information.
Everybody whose work requires keeping information in secrecy.
And anybody else, who simply doesn't like the idea of his or her information (even if it isn't a top secret) leaking anywhere.


Spyware, Adware, etc. -- Terms and Common Sense
When reading an article where some term is used often, it is useful to make sure the author of the article and you mean the same. Not surprisingly for those who still remember English lessons at school, every noun ending with "ware" is a mixture of objects having something in common--usually used for similar purposes. So it tends to be when "ware" is short for "software"; sometimes it's pretty tricky to define exactly what kind of software it includes and what these programs do.
If the terms "adware" and "spyware" are used in an article as synonyms (sometimes even experienced journalists make such a mistake), readers will just wonder why there are so many words for the same stuff. Since computer programmers and gurus don't read these articles at all, an average user feels bewildered when he finishes reading. Too many terms with too vague meanings…it's nothing more than my own impression, because I am not a programmer or a guru--just a linguist. I'm still trying to make a head and tail of it.
Spyware, adware, malware, what else? – trackware, trapware, crapware, junkware, snoopware… Readers have heard a lot about browser hijackers, dialers, keyloggers, cookies, BHOs, Trojan horse programs, viruses, worms…What a motley crew! Is it possible for the average non-tech person to memorize their numerous definitions and knotty relations with one another? What is a part of which? If one looks trough several definitions of "spyware" given in some articles, he is going to find muddle and confusion instead of clarity.
Well, let's use common sense. Fortunately, it is sometimes easy to guess from the type of a program what such programs actually do--so, let' try. A browser hijacker is software that hijacks browsers (and does some other nasty things). Correct. A keylogger is software that logs keystrokes (ditto). Exactly.
Adware is software used for targeted advertising. Well, yes. There must be as many types of programs as there exist methods of advertising. Pop-up flood is also method of advertising. Is hijacking a browser also an approach to advertising? If it is so, creators of those annoying browser hijackers have somehow perverted logic.
And what about tracking potential customers? It is exactly the point where "adware" and "spyware" meet. People also tend to call all unwanted software "spyware" because these programs are installed without users' consent. But…nobody has ever wanted any advertising in print or on TV. Will you watch an ads-only channel? Will you buy an ads-only magazine? Online advertising just follows the tendency (sometimes going too far) to get exposure, to make a user notice ads-- at all cost.
Is spyware software used for spying, as one may deduce from the name? Yes and no. If software collects information and transmits it, such a program is automatically called "spyware" no matter how valuable this information is. That is why keyloggers (programs specially created for capturing key strokes) and cookies are both called "spyware". Well, if cookies and BHOs are kinds of spyware-- then a unicycle and roller skates are vehicles. When calling some kind of programs "spyware" we should at least consider what they "steal" and how this information is used.
Other terms are also pretty indistinct, though sometimes amusing.
Terms like " crapware" and "junkware" aren't very good, they just show attitude to such software instead of meaning anything clear.
"Malware" is too broad and too general. If one hears that some software is called malicious, he has no idea about what kind of software it is. Dividing software into malicious and benign is like dividing all, say, plants just into eatable and uneatable.
As for viruses, worms and Trojan horse programs, this fauna (not paying a slightest attention to the laws of biology) has already made up such hybrids with one another that no genetic engineer could probably dream about. Programmers say that there are almost no such viruses, worms or Trojans as they used to be only several years ago. These terms might become obsolete pretty soon because of this "evolution".
"Trojan horse" is pretty elegant term, by the way -- there is a clear idea of something benign-looking with some potentially dangerous core inside. Makes people remember history, Ancient Greeks and Homer.
All these may seem amusing for a philologist and make a good material for a linguistic study, but for an average PC user who would like to know what exactly his anti-spy software protects against, it is still a confusing mess of terms.


Anti-Spyware Protection – Holes in the Shining Arm
Looking at all the ads which promise to get rid of all spy programs, one may wonder why there is still plenty of them everywhere and the situation is by no means getting better. So let me spoil the advertisers' mood and show some of the "holes" in the majority of software products we expect to protect our data.
Speaking about drawbacks of anti-spyware, let's take the word "spyware" in the narrow sense for a change and call "spyware" only software products that really spy, i.e. steal valuable information you want to keep private. Let's leave aside adware -- this motley crew of advertising stuff; information that some of them "steal" isn't valuable enough. It is keylogging programs that we should associate with the term "spyware" first of all. This breed is exceptionally dangerous -- such threats as flourishing online bank fraud and the recent outbreak of keylogger-containing Trojans prove this.
Generally speaking, most anti-spyware works like that… Don't stop reading, please. Don't skip over the paragraph. Do you think that if you are not a tech person, it is none of your business? You don't write this software, you just use it -- so what? You haven't made the car you are driving, either (well, there may be some exceptions…). But you do know (at least in general) what makes it move -- and you won't forget to fill up its tank or have it serviced from time to time. You know what will happen if you don't. For the same reason you'd better know a bit about anti-spy software installed on any PC you use.
We all should know it to realize what exactly to expect from all these anti-spy products with cool names. Their creators and sellers promise you that these software products will "kill all spyware on your PC" (or something like that). First, is absolute protection possible? Second, what should we expect from a typical anti-spy program and what it is simply unable to do? To answer these questions, we should understand how it works.
Generally speaking, most anti-spyware works like that: it scans the operating system in search for suspicious bits of code. Should the program find any, it compares these suspicious pieces with bits of code (they are called signatures), which belong to already detected and "caught" spy programs. Signatures are kept in so-called signature base -- the inseparable part of any anti-spy program. The more signatures it contains, the more spyware such program will detect, so your PC will be protected more effectively. As long as you update your anti-spy software regularly and the system doesn't come across some unknown spyware product, everything is going to be all right.
As for me, this pattern looks pretty like police records and works like them, too. But…the problem is just like the one with police records – the fact that all included there are criminals doesn't at all mean that all the criminals are included into the records.
Well, what about the criminals (spy programs) that are not included into the records (signature bases)? There are lots of such programs -- more than that -- some of them will never be in any signature base. Just like with criminals -- some of them haven't been caught yet, and some will never be caught – because of their "right of inviolability". Anti- spy products based on signature base analysis will never be able to protect against these spies. Don't expect them to.
Let's take a quick look on these elusive spy programs.
Group 1. Those which hasn't been caught yet, because they are:
1. brand-new ones. They are being constantly written, released, used (for a very short time), detected and, finally, included into signature bases. Anti-spyware developers are now in the vicious circle of endless "spy hunt", trying to include as many spyware signatures (pieces of code) into the bases as possible - and fast! Faster, to outrun the competitors; faster, for new spyware - which is being written and released all the time – not to spread like a wildfire. That's the way a signature base grows.
2. written to be used only once.
These "tailor-made", or should we say, "custom-made", keyloggers are extremely unlikely to be ever detected. As soon as they have done their jobs (stealing data, of course –often from the particular computer) they simply disappear, never to be seen again. Here belong keyloggers made mostly for such tasks as espionage.
The main problem: keylogging software is relatively simple and not too difficult to compile. Even an average computer programmer can write a simple keylogger in a couple of days. More sophisticated one will take longer to make, of course, but not too long. Hackers often compile source code of several keyloggers (it's easy to find them in the Web--for those who know where to look for) -- and get a brand-new one with an unknown signature even faster. If a keylogger can be installed remotely without the victim's knowledge, it gives the hacker great possibility to steal any information he pleases. If there is an opportunity, there always will be one to use it. The period of time when a new spy already exists, but the updates have not been released yet, is the very time when hackers make their biggest profits. Trying to catch them all is a hopeless idea; it looks too similar to catching fleas one by one.
Group 2. "Sacred cows".
No signature base will ever have their signatures. Here belong mostly monitoring programs, which can be used for spying as well. First, the ones created by (or for) government agencies – such as the famous Magic Lantern (the brainchild of the Cyber Knight project). No product which uses a signature base will protect against it; an ordinary anti-spy will never detect such a program. The same situation with other monitoring software, which certain agencies utilize. These monitoring products simply "don't exist" for signature-base-using anti-spyware (though they can well exist on any PC--yours included)
If you think I'm painting it too black let's recall what happened when code of D.I.R.T. (a covert spying tool developed by Codex Data Systems) leaked out couple of years ago and was found in the Web (merely by accident, by the way). Once a top-secret project, it did become an open secret -- but the signature of this powerful monitoring software hasn't been included in any signature bases. That's what worries me the most; after this information leak nobody knows for sure WHO can be using it --and WHAT FOR. What if some other government monitoring program trickles into the Internet, too?
Monitoring programs for parental control or workplace surveillance are very common and easily available from the Web. However, they can be used not only for those absolutely legitimate purposes. Any monitoring program is actually a double-edged sword because it almost always contains a keylogging module. It is up to an end user to utilize them--perhaps for spying. Legitimate monitoring programs are sometimes not included into signature bases, so one can use an anti-spy program and be spied on anyway.
Now the last (but not the least) threat -- spy modules incorporated into viruses and Trojan horse programs. Unfortunately, all malware, including viruses, Trojan horses, worms and other fauna, "evolves" (due to their malicious creators). There already are so many hybrids between one another that it's hard to find, say, a "pure" virus like ones used only several years ago. Lots of this fauna can contain a keylogger -- like MyDoom (sure you remember this virus). They multiply and evolve, becoming more and more malicious.
So, what conclusions could we draw out of this entire story (sorry if it turned to be too pessimistic)?
Is absolute anti-spy protection possible? With existing anti-spy software which uses signature bases - no.
However, there is a relatively new trend in software development -- not to use signature base analysis at all. This approach is rather promising; it means that such software--it already exists--can counteract even brand-new and custom-made spies. You may read more about it if you follow the link in my signature.
What should we expect from an average anti-monitoring or anti-spy program? It does protect from spy software which it "knows". If it has the particular signature in its base, it protects your PC from this particular program. If anti-spyware uses a signature base, it will never "kill all spies on your PC--"whatever the salesperson promises you. Don't expect complete security-- there is no such thing anymore.
The only hope is for entirely new technologies. If developers can't succeed in fighting spyware, they should try something else.