Experts in combating “spyware” and “adware” are now warning that the widely publicized security holes that plague Internet Explorer and other Web browsers may not be the most common ways unwanted software gets into computer users’ PCs.
Eric Howes, a frequent contributor to SpywareWarrior.com and a consultant to antispyware companies, says the media focus on security holes is overshadowing a larger issue.
It’s true that hackers can take advantage of weaknesses in browsers to secretly install spyware programs on users’ PCs, Howes agrees.
But equally important is the fact that spyware programs are often installed because users are fooled into clicking “Yes” by dialog boxes that look like official Windows notices, he says.
Interestingly, Howes asserts that the latest version of Windows XP, which includes an upgrade called Service Pack 2 (SP2), makes Microsoft’s Internet Explorer (IE) browser handle such threats better than Firefox, the fast-growing open-source software distributed by the Mozilla Foundation. Let’s examine this claim.
How Spyware Tricks Users Into Installing It
The Firefox browser offers at least four ways to install new forms of software, Howes says.
He feels two of these ways are fairly safe, while the other two are open to abuse by spyware authors.
These are the most traditional kind of software install. Using a browser, an executable file is downloaded, saved to disk, and then run once to install an application.
While any program poses potential risks, Howes says, traditional setup programs at least make themselves visible to the user, who much choose to run them.
Plug-ins are programs, such as Macromedia Flash, that enable a browser to display special content, such as multimedia files.
These are also fairly safe in Firefox, Howes says, because users are presented with information about the plug-in before installing it, and can read any end-user license agreement (EULA) associated with it.
Firefox extensions, small programs that may, for example, add a menu item to the browser, present a more serious problem, Howes maintains.
Once a user clicks a yellow “information bar” at the top of the browser window that offers to install an extension, they see a dialog box that prompts them to allow the software to install.
This dialog, Howes says, provides no information about the source of the software, nor does it provide any link to a EULA.
The greatest risk, Howes warns, comes from the ability of Java applets to display dialog boxes that look exactly like ordinary Windows notices.
Many users are accustomed to clicking “Yes” when they see a dialog box informing them that, for example, an updated media player or “codec” is required to play some requested content.
Since Firefox currently displays nothing but the name of a possibly obscure software company, all too often users click “Yes” without even reading the information.
To install as many software programs as possible, some adware companies even make up company names such as “Click Here To Continue.”
This name shows up prominently in Windows dialog boxes, making many users believe they have no choice but to click “Yes” to complete their task, according to an article by Ben Edelman, a spyware researcher who is currently studying at Harvard Law School.
How Internet Explorer In XP SP2 Works Differently
With the release of Service Pack 2 for Windows XP in September 2004, Microsoft made a positive change in the behavior of IE, which is bundled with Windows.
“It took them a number of years to get it,” Howes says, “but they eventually did get it.”
Instead of popping up a dialog box when a Web site tries to install, for example, an ActiveX program, IE with SP2 now displays a much less intrusive alert about the situation.
“They put it in the Information Bar to take the dialog boxes out of people’s faces,” Howes notes, “so they don’t feel pressured into making potentially bad decisions.”
It’s still possible for a user to click IE’s Information Bar, find more information about software that a Web site wants to install, and click “OK” to install it. But it’s much less likely.
This, hopefully, will prevent many copies of spyware and adware from being installed. (Users of Windows XP who haven’t installed SP2, as well as users of Windows 2000 and earlier versions, don’t enjoy even this much protection against trickery, unfortunately.)
Adware Publishers Begin Using Java Applets
Adware makers are already distributing files on the Internet that launch Java applets on Firefox and other Mozilla-based browsers.
According to Howes, these programs include 180search Assistant, istbar, PowerScan, Sidefind, PeopleonPage, and the YourSiteBar.
Other programs, including iSearch/iDownload, present dialog boxes to Firefox users through browser extension methods, according to a PDF statement (page 2, paragraph 3) by Sunbelt Software, an antispyware maker that has consulted with Howes.
It’s certainly true that computer owners should be able to install just about any software they want.
The problem arises when official-looking dialog boxes are presented to users, who often see no difference between them and other Windows dialog boxes that they must click on every day.
Officials of the Mozilla Foundation, which makes the Firefox browser, did not respond to e-mails seeking comment by press time.
Defending Against Deceptive Dialog Boxes
“The Firefox ‘yellow bar’ gives little notice of what is actually trying to install itself, and so, in that respect, IE does have some small advantage,” according to Christopher Boyd, a spyware researcher associated with VitalSecurity.org.
Boyd is a Microsoft “Most Valuable Player” for security, an honor the Redmond company bestows on individuals who aren’t employed by the firm but who play an important role in educating end users on Web forums and elsewhere.
At the same time, Boyd says, “until Microsoft untangles IE from the operating system, the number one target for spyware/malware will always be IE.
The problem we have now is that, realizing Windows and IE are becoming more hardened (coupled with the raft of security tools people now employ), attackers are simply resorting to cruder methods of attack — namely social engineering and cheap tricks.”
Company executives can’t expect computer end users to guess correctly when confronted with Windows dialog boxes urging them to click “Yes,” Boyd states.
“A security professional who neglects the human aspect of an attack is not a security professional,” he says.
“Here’s something that could get to your PC across almost all browsers, regardless of secure lockdowns.
All it took was a simple click of a ‘Yes’ prompt. And unfortunately, users click ‘Yes’ to things!”
It’s still important for companies to stay current with security patches that emerge from Microsoft and other software companies. But these patches can’t prevent spyware and adware from getting into your company’s computers.
It’s equally important for you to guard against dialog boxes, which may seem perfectly innocent, but can be deceptive. All too often, even the most careful person will guess wrong.
A big step forward would be for all browser developers to prevent dialog boxes from being thrust in the face of PC users by Web sites they may visit.
If a site really needs visitors to install a certain piece of software, it can explain that fact right in its text and provide a dedicated download page.
Until then, I’m afraid the market for spyware and adware removers will continue to grow.
An 11-page PDF report Howes prepared for Sunbelt Software on the problem, which was originally scheduled for publication in March but was never formally released, is available at a University of Illinois host, where Howes is based.