JEDDAH, 25 March 2007 — If you ask the president of a local computer hackers club, nearly all computers in the Kingdom are infected with some kind of spyware, software that installs itself on computers and monitors activity, surfing habits and, in the worst cases, tracks credit card numbers or other sensitive data that home users might enter into their machines.
“Many people go online daily unaware that they are manipulated by hidden experts who are making a lot of money,” said Yosuf Omar, president of the Mac Users Club, who is also a networking and desktop publishing consultant at the Jeddah-based Arabian Creative Company. “Computer users should be very careful in what they download, because usually spyware comes in free utilities that are downloaded.”
He gave an example of a famous website that used to sell mobile phone ringtones five years ago.
“During that time, one individual developer made a utility that downloads the ringtones for free and published it online,” he said.
The application turned out to be spyware and five million people gave up some privacy in order to have the free software. Most spyware isn’t the kind that steals personal data, but can be used to monitor computer-surfing habits in order to market products and services to users via the Internet. However, some spyware can monitor online transactions and harvest financial data. The best protection against spyware is to avoid downloading software from unknown sources or unfamiliar software providers.
Omar said that experienced hackers do not mess up computers they hack; those who do that are considered as amateurs. Professional hackers make sure that their spyware stays undetected, allowing the program to obediently send user-data back to the hacker. Spyware can be sent to users even from e-mail of friends and relatives. In that instance, a friend accidentally infects his computer with spyware, which then forwards itself to everyone in that user’s e-mail address book. Recipients then inadvertently install spyware on their machines by opening attachments they think are coming from people they know.
“If some one received an e-mail from a friend, it would be difficult to think it was a scam,” he said.
Spyware is often used simply to harvest e-mail addresses, which are then sold as lists to spammers who then fill your e-mail inbox with advertisements for sexual enhancers, low-interest mortgages, or other products and services. Some of these spam messages that come from e-mail lists provided by spyware can be “phishing” expeditions — where a recipient receives an e-mail that looks like it is from a legitimate business, such as a bank, often incorporating a company logo and official-sounding messages asking users to verify their log-in names and passwords; the user then visits a pirate web page and inadvertently provides sensitive information to a criminal enterprise, believing the sender is legitimate.
Spyware can also make a user’s computer a “zombie”, as it is called in hacker lingo. This spyware turns a computer into a soldier in a denial-of-service (DOS) attack on a website: When numerous computers inundates one site with automated information requests or other data, thus overloading the website’s server and shutting out legitimate visitors to that site. This tactic has been employed by hackers to attack the websites of Microsoft, the US Department of Defense, or anyone else seen as worthy of a DOS attack. Hackers have even been known to use this tactic to blackmail website owners for cash, threatening a continued DOS attack. DOS attacks rely heavily on computers of innocent people who are unaware that while their computer is running online some of their computer’s system resources are being secretly used by hackers to attack websites. As Omar says, a few million zombies under the control of one or a group of hackers is a powerful army.
“If the hacker had spyware in three million computers they would all send empty packets (of information to a website) without the knowledge of their users. Those millions of packets would immediately cause a system crash in the website,” he said.
The best ways for a computer user to protect from spyware, viruses or other security breaches are to: a.) Maintain an updated anti-virus program, b.) Maintain a level of firewall security setting that prevents uninvited violations, c.) Avoid opening e-mail attachments (confirm from the sender any attachments sent to you before opening them), d.) Use caution when an un-trusted website asks permission to install an application on your machine or to open a pop-up window, and e.) Avoid downloading data from public file-sharing networks, such as Azures or others using the popular Bittorrent software.
