Spyware Solution

[Guarddawg1]

It seems to me that very little is expected of software manufactures in general to assist with the security problem on the Internet (spyware etc). They provide very little usable information about what their programs are going to do after we install them.

Now imagine if anytime you were considering installing a program on your computer you could review a contract associated with it that would tell you what that program was going to do. Not every single thing of course just the actions that might be suspicious.

There are a couple of things that tend to indicate Spyware. The changes it makes to various startup points on the computer and the Internet sites it connects to. Now if that type of information could be made available about a program before it was installed it could help in a number of ways.

It would work as a kind of contract that security systems on the computer itself could monitor and enforce. Most anti-spyware programs monitor startup points and could be modified to enforce the type of contract I am describing as could a HIPS. The same is true of firewalls for Internet connectivity.

It would provide a risk estimate before the software was even installed. Any program that modified a large number of startup points would be suspicious. Also many IP's addresses used by Spyware companies are known which would flag a piece of software as suspicious before it was even downloaded.

I understand this would be difficult to implement, but any comments on the idea would be appreciated

[cozofdeath]

Security suites usually do this plus more. The monitor things like file integrity, startup locations, malware signatures, intrusion attempts, polymorphic changes, heuristics for future threats, protocol filters, individual program control down to the components of the program, fishing/fraud attempts, parental control, etc. Thats just from the top of my head.

[andsome]

It would take a genius to cover absolutely every possible contingent, and then another misguided genius would devise a way round it. There is a constant battle being waged, and I think that on the whole, the anti Malware brigade do a pretty decent job. Best to install more than one program, and keep them updated, and run them regularly.

[cozofdeath]

It would take a genius to cover absolutely every possible contingent, and then another misguided genius would devise a way round it. There is a constant battle being waged, and I think that on the whole, the anti Malware brigade do a pretty decent job. Best to install more than one program, and keep them updated, and run them regularly.

Well said!

[nellie2]

There are programs that monitor changes to your O/S and settings, Spybots Teatimer is one, Winpatrol is another... Microsoft have just released a Change Analysis Diagnostic tool that you may find useful

The Change Analysis Diagnostic simplifies the identification of recent changes to computers running Windows XP. The diagnostic checks for recent changes to the following:

• Operating system components, such as patches, that are installed as hotfixes or downloads from Windows Update.

• Installed application entries listed in the Add or Remove Programs control panel.

• All kernel mode device and file system drivers.

• Browser helper objects loaded by Internet Explorer.

• ActiveX controls loaded by Internet Explorer.

• Programs loaded automatically during Windows XP startup.

• Programs and Dynamic Link Libraries (DLLs) loaded when an application starts.

[Guarddawg1]

I appreciate the responses folks. Andsome argues that it would take a genius to figure out every possible contingent, but isn't that what we do now when we attempt to secure systems? We have some geniuses that attempt to lock down the operating system while still providing enough functionality to get things done. While someone else tries to figure out a way to use the same functionality to exploit the system. I would argue the best way to provide functionality with security would be if we could give permissions on a program by program basis then monitor them individualy.

While it is true we could not monitor everything that a program does we might be able to monitor enough to deal with the Spyware problem. A virus is a vandal it exists to destroy so you cannot predict what it will do. Spyware on the other hand wants to control the system so that it can collect information, send advertisements etc. To do that it needs to make changes to a relatively small segment of the operating system. It would be difficult to predict all the ways it could do that but it should be possible. There are lists of start up points floating around the Internet as there are lists of malware IP's. Both of these lists are used to deal with Spyware. Why not have this kind of information availiable before you install a program?

[andsome]

There are programs that monitor changes to your O/S and settings, Spybots Teatimer is one, Winpatrol is another... Microsoft have just released a Change Analysis Diagnostic tool that you may find useful

The Change Analysis Diagnostic simplifies the identification of recent changes to computers running Windows XP. The diagnostic checks for recent changes to the following:

• Operating system components, such as patches, that are installed as hotfixes or downloads from Windows Update.

• Installed application entries listed in the Add or Remove Programs control panel.

• All kernel mode device and file system drivers.

• Browser helper objects loaded by Internet Explorer.

• ActiveX controls loaded by Internet Explorer.

• Programs loaded automatically during Windows XP startup.

• Programs and Dynamic Link Libraries (DLLs) loaded when an application starts.

I tried this program a few days ago when Pat Willener recommended it. I could not really understand the report from it, so decided not to bother, and tried to uninstall it. In order to finally get rid of it, I had to install my Acronis backup.

[cozofdeath]

I agree with the both of you on some points especially running multiple programs. It seems all problems are input based. Mostly buffer/parsing problems that create the holes. I think it was Scarcrow Man that just posted the MS .ANI hole. Most good AVs should already have it fixed but now there are already multiple variants of it out to the point it raised malware alerts to yellow. Thats do to a buffer problem also. I'm not a good programmer or anything but thats just what I've noticed. I really wish they would go after all the people supporting this stuff.

Speaking of malware Panda just officially released there AntiRootkit 1.06 tool. For a free download go HERE.

I've noticed a lot of the main malware researchers are coming up with more ways to get computer users and developers involved in catching malware. I hope this catches on!

[nellie2]

I would argue the best way to provide functionality with security would be if we could give permissions on a program by program basis then monitor them individualy.

Good point, I think you will find that Vista's User Account Control (UAC) has a fair stab at that.