Malware Returns

Just when you think you've got spam beaten, something far worse starts to appear on customers' computers. For ISPs, this new nuisance means headaches and a serious drain on resources and revenues.

by Jim Thompson [May 27, 2005]

"People simply don't understand who is putting Spyware out there, so they just assume the ISP must have done it," comments Cindy Bajdarvanov at Portland, Ore.-based Budget Dialup, a small ISP with approximately 20,000 customers. "If they constantly get pop-up ads jumping up, they call us and ask why did we put it on their computer."

For the ISP, Spyware and its relative, Adware, is becoming a major burden. ISPs report that as much as 40 percent of their tech support time is monopolized by questions and complaints about Spy/Adware infecting their computers.

"At least 30 to 40 percent of our support is taken up with Spyware and viruses," notes Bajdarvanov. "That leaves us with a large burden for support. We also see people canceling their service with us because they think we did something to hurt them."

Spyware comes in many forms, but, generally, it is an application that installs itself by misleading techniques, gathers information about computing habits, and transmits that information to some unknown site for later analysis and use.

Adware also installs itself by misleading techniques and then throws up annoying pop-up advertising windows and banners on your computer. It's a pain, but not as potentially dangerous as Spyware. Between the two (Spyware and Adware) a computer can be slowed to a point where it is almost unusable.

Since these evil twins make no announcement that they are being installed or are running, many users simply assume that the slowness of their machine is due to problems on the ISP's end. The result is an endless stream of tech support calls and a drain on ISP resources.

"It is very clear that it's the ISPs who are bearing the brunt of the cost of support for Spyware and Adware," said Tori Case, director of eTrust management at Computer Associates.

John Beaston of Portland, Ore.-based Easystreet.com, an ISP serving small business customers, minces no words when he says, "[Spyware] is a pain in the butt [resulting in] significant support costs to explain things to customers and then fixing their systems."

New laws, plenty of flaws
The problem has become so acute that even the government is getting into the act. "Besides what can be done by the individual to root out and destroy Spyware, I advise people to get politically involved. Intelligent legislation can help in the fight," said Karl Bode, editor and writer for broadband subscriber community website Broadband Reports. Bode writes frequent editorials on the subject of spyware

Among the pending laws against Spyware are:

• SPY BLOCK Act (Federal Bill S.2145), Introduced in September, 2004 to the Senate Committee on Commerce, Science, and Transportation, it would "regulate computer software used to collect personal information, monitor the behavior of computer users, or produce pop-up advertisements on personal computers."
  
  It would prohibit installing such software on another person's computer without notice and consent from the owner or authorized user of that computer. The bill would require all downloadable software to be easy to uninstall and prohibit an unauthorized user of a computer to install software that would launch ads "in a manner or at a time such that a reasonable user would not understand that the software is responsible for delivering the advertisements."
  
  
• The SPY ACT, or the Securely Protect Yourself Against Cyber Trespass Act (H.R.2929), was passed by an overwhelming margin by the US House of Representatives last October. Among its aims are to "prohibit the use of computer software (known as Spyware) to collect personal information and to monitor the behavior of computer users without a user's consent." The Federal Trade Commission (FTC) is directed to enforce its provisions relating to Spyware, including assessing and collecting civil penalties for unfair or deceptive business practices.
  
  Among the practices prohibited by H.R. 2929 are phishing, keystroke logging, home page hijacking and ads that can't be closed except by shutting down a computer. Violators could face civil penalties of up to $3 million.
  
  The bill has received tentative endorsements from The Business Software Alliance, Dell, eBay, Microsoft, Time Warner, Yahoo, and Earthlink. It still has to be passed by the Senate and signed by President Bush before it goes into effect.
  
  
• In California, Governor Schwarzennegger hopes to terminate Spyware with the Consumer Protection Against Spyware Act (Bill 1436:843) which went into effect on January 1, 2005. The Act bans the installation of software that takes control of another computer and aims to protect California consumers from " the use of Spyware and malware that is deceptively or surreptitiously installed on their computers." It also requires companies and websites to disclose whether their systems will install Spyware. Consumers are able to seek up to $1,000 in damages if they think they have fallen victim to the intrusive software.

Speaking before the U.S. House of Representatives, Rep. John Dingell (D-MI), the ranking Democrat on the House Commerce Committee, stated that Spyware is similar to wiretapping and "the equivalent of having a wiretap on your phone that allows someone to listen to your conversations".

Go to page two: Let's not ask government to solve this problem