Most Web Users Unable to Spot Spyware
Posted by
samzenpus
on Wed Apr 26, 2006 09:48 PM
from the masters-of-disguise dept.
from the masters-of-disguise dept.
Ben writes "According to a Spyware Quiz conducted by McAfee SiteAdvisor , a staggering 97% of Internet users are just one click away from infecting their PCs with spyware. One interesting conclusion from this study showed that even users with a high "Spyware IQ" have a nearly 100% chance of visiting a dangerous site during 30 days of typical online searching and browsing activity."
This discussion has been archived.
No new comments can be posted.
Most Web Users Unable to Spot Spyware
|
Log In/Create an Account
| Top
| 399 comments
(Spill at 50!) | Index Only
| Search Discussion
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
(1)
|
2
Wait... (Score:3, Insightful)
Re:Wait... (Score:5, Insightful)
(http://slashdot.org/)
Re:Wait... (Score:5, Informative)
Maintain an up to date hosts file - the best I've found is from here - http://www.mvps.org/winhelp2002/hosts.htm.
Blocking a site from loading prevents - well prevents if from loading. What more can you ask for? If you keep your file up to date (their most recent hosts file is 6 days old) you certainly are preventing a lot of the risk.
Re:Wait... (Score:5, Interesting)
You try to go to www.screensaver.com, for example - and you can't. What a wonderful sounding place to get a screensaver - but apparently it offers spyware or tracks you - don't believe and want to go anyhow? Turn off your hosts file or comment out the line. Simple.
You can read every entry. Nothing hidden. Simple. Preventative. Free. And nothing to install. What more can you ask for?
Re:Wait... (Score:5, Insightful)
Re:Wait... (Score:4, Insightful)
Next week "how water is wet".
Re:Wait... (Score:4, Insightful)
(Last Journal: Wednesday May 26 2004, @08:01AM)
That said, I'm starting to get concerned about closed source applications such as Diamond Crush [kde-apps.org] showing up on apps.kde.org. Some of these are much more appealing to geeks. Also, I have wondered what sort of peer review is done on packages at repositories such as www.slacky.it or www.linuxpackages.net. It's nice to be able to download precompiled binaries of open source products that don't come with your distro, but....when I download something from slackware.com or vectorlinux.com, I don't have the same sense of worry about unpleasant easter eggs.
Cheers.
Re:Wait... (Score:5, Insightful)
(http://intrinsicsecurity.com/ | Last Journal: Sunday August 28 2005, @11:11AM)
However, the notion of "trusted web sites" is bogus and dangerous (e.g. in web site security, "evil sites are not to be trusted" may be true, but the converse is not necessarily true -- web sites that are not known to be inherently evil are also not "trusted". Companies that build them and run them and put them on the internet for you to puruse don't even trust them. They put them on "sacrificial hosts" in a "DMZ". The *owners* of these web sites don't trust them. Why should anyone else?
The notion of the "trusted web site" is dead. Stone cold it's not pining for the fjords because if it hadn't been nailed there it would be pushing up the daisies, dead.
Completely impractical (Score:5, Insightful)
Most www users are not geeks and cannot tell the boundary between their computer and the internet, let alone know how to drive a hosts file etc. Any advice of this form is completely useless to most www users. If the computer says "click on this" they will. Don't expect them to tell the difference between something from MS or the OS and a phishing scheme or other attack.
It is also not reasonable to say that people should know this stuff to use the www. Nonsense! Do you need to know the difference between a knit and purl stich to wear a sweater? Do you need to know what advance and retard are to drive a car? Why the hell should you know what a hosts file is to use the www?
Re:Completely impractical (Score:5, Funny)
(Last Journal: Sunday December 28 2003, @04:58PM)
Because sweaters and cars work just fine without knowing much about their inner workings, and computers don't. Maybe it would be nice if the www didn't require competent users, but unfortunately it does.
Re:Wait... (Score:5, Insightful)
While it may be simple and effective, the hosts file is not the right place to block access to certain sites.
Blocking should be done by the browser itself or by a firewall, proxy, or some other software gatekeeper expressly designed for the purpose. Such an agent is theoretically able to perform a multitude of functions related to site blocking, such as temporary unblocking, content filtering (ie allow the HTML through but nothing else, or strip out javascript, or whatever), authentication for unblocking, management of blocked groups (eg separate black lists for porn, spyware, anti-chinese-government content).
Hosts files don't allow any of these functions, and are easy to bypass by using an ip address instead of a domain name. By skewing their function into a server filter, you are more likely to run into problems and frustrations, esp when you also want to use the hosts file for its intended purpose - to map names to ip addresses. It's going to be pretty annoying when someone makes a typo in the hosts list and you can no longer get to some site because the "connection was refused".
In short... Hosts file as a filter is an effective kludge for now, but a better solution is to use a
Wrong approach, bad advice (Score:4, Insightful)
The correct approach is to use better software, that blocks Spyware by design.
Re:Wait... (Score:5, Insightful)
(Last Journal: Saturday August 18 2001, @11:04AM)
A sibling to this post points out it only takes a split second of carelessness. This is literally true.
The combination of
- Internet Explorer and several silent install vulnerabilities (are you sure they're all gone? Is everybody's IE up to date?)
- The user, and thus IE, running as Administrator (OR any priv. escalation exploit), and
- bots that register typo-domains en masse
adds up to a situation where a single innocuous typo in your Location bar could trigger a rootkit install.For this reason, I consider IE mortally dangerous, and until we go for some period of years without seeing a silent install vulnerability, I won't lift this assessment. This has nothing to do with hating Microsoft, and shouldn't be dismissed as such; I think it's a perfectly rational assessment of the situation. I think the only thing stopping more people from seeing it this way is the fact that most people are dependent on Microsoft and simply don't want to see something that means they are going to have to do a lot of work to switch.
I don't think Firefox has had a "silent install" vulnerability yet. Corrections welcome. It's just too darned easy to get infected, and all the anti-virus software, software firewalls, and spyware detection software is just closing the barn door after the animals escaped, especially as the rootkits are passing the point where you can even pretend to remove them without a full re-load of the OS from the bottom. (And it's only a matter of time before the rootkits go back to the old trick of infecting all executables like the viruses of the olden days, so you have to completely rebuild the machine from scratch...)
(I remember there was some changes made to the extension download process to make it harder to mindlessly click through, but I'm not counting that. I would consider a silent extension install to be a silent install vulnerability, because extensions get full access to the machine. The same for an install process that isn't "silent", but isn't able to be stopped short of cutting power to the machine; ISTR an ActiveX vuln that had the behavior of installing even if you said "no" to the trust dialog.)
Take the test (Score:5, Insightful)
(Last Journal: Friday August 17, @05:34AM)
The reason is simple. The test is loaded.
You are asked to choose between various free sites and have to judge just buy a screenshot wich one is save. That of course is very hard to do. Worse is that you can't choose the answer "none of the above" wich I think is the only real answer.
Frankly I wouldn't trust any screensaver or smiley site. Period full stop end of story.
Oh and as for people using virus scanners. Well yeah. Because others have hit them over the head and tied them to a chair and then installed the virus scanner for them and then trained them with a cattle prod not to remove it. They still go out of their way to make live hard for the virus scanners and still basically just get it.
Virus scanner == safety belt. Wearing a safety belt doesn't make you a safe driver.
It only takes common sense to keep your machine clean. Right the same common sense that tells you to limit your speed in dangerous road conditions?
Common sense is a misnomer because whatever it is it sure as hell ain't common.
And let me guess (Score:5, Insightful)
Sorry (Score:5, Insightful)
Bad quiz (Score:5, Insightful)
(http://www.samtihen.com/)
Re:Bad quiz (Score:5, Insightful)
No kidding. (Score:5, Informative)
(Last Journal: Thursday April 27 2006, @03:06AM)
let's go through the quiz (if you want to see for yourself untainted, do so before reading this):
the first 4 questions have you determine which of two sites is safe, based on screen shots.
question 1: choose between two screen saver distrobution sites. like all the others, it's just a screenshot, and doesn't even show the whole front page, let alone users look at other pages. the only decernable difference is that the first one looks more professional, so heeding the remarks in the article that said most users seem to think that means it's safe, and "reading between the lines," I picked the other one, since there was no logical way to decide. I was wrong.
question 2: smilies. the one on the right looked more professional, and said "NO UNWANTED SOFTWARE" in a very easily spotted location, with big letters, and the other in regular sized font, in the bottom right, had a half cut off message that pretty clearly stated (even with incompete sentances) that it contained spyware, so I picked the one on the right, this time with some actual info to go on. I was right.
question 3: free games. the sites had no noticeable differences in professionalism, no warnings or advertising of spyware freeness either way, nothing to go on that really made any sense to actually use, so I decided that TotallyFunFreeStuff was trying to hard, and was probably hiding something, and picked the other. I was right.
question 4: Lyrics. important to note that this one used active X, so it's irrelevant to anyone who's not dumb enough to still regularly use IE anyways, which now that I mention it, I think I'll soon put a rant about McAffee and that that in my Journal (will be a first entry,) but it's to much of a tangent for this post. anyways, the one on the left looked more professional, and the one on the right had a "firefox blocked a popup" message on it, so I picked the left (entirely because of the message, I continue to mention the professionalism because the article made a stink about it.) I'd like to note that the thing I took as a tip off wouldn't be availible if I were seceptable to this at all, as it's a firefox message, which doesn't do active X. In any case, I was wrong.
the last 4 questions had you determine whether a file sharing program was safe based on the usual screenshot of the webpage.
Bearshare: site looks professional, there's a link for a "FREE Sponsored version," sponsored sets off a red flag in my mind, I say no. I'm right.
eMule: worst site design of the four astheticly, says it's open source, I've heard of it, I say yes. I'm right.
blubster: pretty sleek front page design, though it feels like a splash screen, so there's almost no information. nothing to go on really except that it says it's 100% free, which given the fact that OSS/Free software tends to advertize itself as such, and they didn't, probably meant add supported, but for some incomprehensible reason I still picked yes. I'm wrong.
Kazaa: slick page, big "NO SPYWARE" label on the font page, there's a main section for the privacy thing, which I bet a lot of people would have looked at if it were a page, not a picture, but instead just trusted it because the label was all they had to go on. I was familiar with the software though, so
Re:No kidding. (Score:5, Insightful)
The only other thing I'd add to your comments is that the presence of a forum seems more likely to indicate safety. Most of the "safe" sites had a forum section, most of the "unsafe" sites don't. Obviously this isn't a hard and fast rule, but a forum where people can complain about the spyware they just downloaded would tend to scare prospective victims away.
Re:Bad quiz (Score:4, Insightful)
(http://www.jonnythan.com/)
You sometimes can't tell what software will have bundled spyware or adware, (especially in such an obviously biased quiz) which is why you're going to need to purchase McAfee's anti-spyware software.
Hello, McFly...
Re:Bad quiz (Score:5, Insightful)
If this applies to you, you've already flunked the real-world test. If they had a third option "I'll get software only when it's important, and then only from sources I've thoroughly researched and have objective reason to trust" - then this quiz would be a public service. As is, it just encourages the proliferation of Windows malware.
Sure (Score:5, Insightful)
(http://www.mindchild.net/ | Last Journal: Tuesday November 29 2005, @10:16AM)
Sure, we like to visit places like http://www.cracks.am [cracks.am], who actually write their own spyware. But I am not so sure that qualifies me as ever installing any of their garbage.
This looks like an interesting article (Score:5, Funny)
(http://therobert.org/)
Follow the money (Score:3, Insightful)
The real way to combat this is to hold website owners responsible if they are hosting such malware.
Free pr0n yes! (Score:3, Funny)
Stupid quiz as usual (Score:5, Insightful)
Re:My Score (Score:4, Funny)
This is an idiotic quiz. (Score:5, Insightful)
(http://slashdot.org/)
This is a completely invalid, unsound test, as there is no technical way to determine the presence of malicious software simply by looking at a page as it initially loads in the absence of any ability to interact with it or at the very freaking least scroll up or down or hover a mouse... sheesh...
It's like blindfolding someone and then blaming them for not being able to catch a baseball pitch, facing away from the thrower, with their bare hands. Of course they won't be able to, if you take away every single useful tool for them to accomplish the task.
Flawed quiz (Score:5, Insightful)
Re:Flawed quiz (Score:5, Insightful)
(http://users.rcn.com/smallpond1/ | Last Journal: Wednesday April 30 2003, @11:25PM)
1) How many people will stay interested enough to finish the quiz.
2) Free focus group when article is posted on
Requires javascript. (Score:5, Funny)
(http://del.icio.us/jvz | Last Journal: Sunday December 03 2006, @12:45PM)
Not sure I agree with their methods (Score:5, Insightful)
(http://www.thedreaming.org)
Re:Not sure I agree with their methods (Score:5, Funny)
(http://www.ucblockhead.org/journal/ | Last Journal: Thursday November 14 2002, @03:24PM)
Missing Poll Option (Score:5, Informative)
Seriously, is McAfee trying to imply that some executable code you download off the Internet from people/organizations of unknown repute is safe?
BTW, if 3% of people answered their questions correctly, that means that 5 of 8 questions effectively had 50% odds. For example, if 50% of people were able to get questions 5-8 correct, and everyone just flipped a coin to answer questions 1-4, you'd get a 3% all-correct rate.
Think of it as another way to advertise! (Score:3, Funny)
Yes, easy to see what the purpose of this test REALLY is... promotion promotion promotion! I'd even point to the fact that this is on
Then again, what do I know? I got a 5 out of 8 on the quiz. Boy, am I a dumb intarweb user! Better go install that SiteAdvisor after all...
ActiveX in Firefox? (Score:4, Funny)
(http://www.jonnythan.com/)
McAfee claims that one of the lyrics sites has "delivered adware through ActiveX" via Firefox.
FireFox (Score:5, Informative)
And that is just another reason I don't use McAfee.
Firefox when secured.... (Score:5, Interesting)
(Last Journal: Sunday April 29 2007, @07:42PM)