Spyware Weekly Newsletter :· Sept 6, 2006
The Spyware Weekly Newsletter is distributed every week to 20,000 subscribers and read online by hundreds of thousands of visitors. Please read our Terms of Use for quoting guidelines. http://www.spywareinfoforum.info/newlsetter/sep6,2006.
Wherever the term "adware" is used, it is referring to a category of software, not to any particular company or product.
The contents of this newsletter is all commentary.
Table of Contents
- HP Chairwoman Accused of Fraud and Identity Theft
- Evidence Terminator
- Google Listens ... Literally
- Much Ado About Very Little
- Limewire Does Not Install A Rootkit
- UK Postman Disciplined For Explaining How To Opt Out
- My Inbox Overfloweth
HP Chairwoman Accused of Fraud and Identity Theft
Tom Perkins has resigned from the Hewlett-Packard Board of Directors in disgust, after learning that Chairwoman Patricia Dunn used a "consulting" company to obtain phone records of every other board member illegally. Dunn was furious over a press leak and decided to find out who was responsible, by any means necessary.
According to Perkins, Dunn paid a consulting company to break into the cell and land line telephone accounts of every board member. These consultants convinced the telephone companies to give them online access to the accounts, by pretending to be the board members they were targeting. They were armed with the appropriate social security and telephone numbers, which helped them to fake out the telcos.
If this is true, Patricia Dunn has violated numerous California and Federal laws. Perkins' attorney has referred the matter to the California Attorney-General's office.
The Deputy Attorney-General would not comment to Wired News on whether Hewlett-Packard is under investigation. However, he said that what was described to him is a violation of California's computer-crime laws against unlawful computer entry, as well as a violation of a California identity theft law.
Perkins also claims that Hewlett-Packard has violated SEC regulations. When a director resigns from the board of a publicly-traded company, they are required to inform the SEC. When the member resigns due to a disagreement over company policy, that also must be disclosed. Hewlett-Packard filed a disclosure about Perkins' resignation, but failed to disclose that he left because of company policies.
Newsweek has a four-page web article with all the details.
Let me make one final comment. Perkins' attorney is Viet Dinh, the former Justice Department lawyer who wrote the US PATRIOT ACT. When the guy who *wrote* the PATRIOT ACT says you've gone too far by spying on someone, you truly have accomplished something.
Evidence Terminator
 |
Price:
Purchase Evidence Terminator [Use coupon code EVTM-OQ67-INFO]
Program: Spycop Antispyware
Price:
Purchase Spycop [Use coupon code SPYC-4XL4-INFO]
Spycop + ET Bundle:
Purchase Spycop + ET Bundle [Discount is applied automatically until Sept 13, 2006]
Everything you do on your computer leaves a trail behind. When you surf to a web site, you leave behind internet cache, address bar history, web site visit history, and cookies. When you open a document, Windows saves the filename into the registry. When you run certain programs, they might save a file into a temporary folder and often fail delete it afterward.
Evidence Terminator optionally cleans all of the following:
- Recycle bins on every drive in your system.
- Internet history logs stored on your hard drive.
- Internet cookies. Temporary Internet Files (caches and other media files).
- Recent documents list, run list, find computers list and recently searched file list.
- Backup files, log files, CD burner software temp files and program temp files not in the system temp folder.
- All index.dat files.
- Overwrites files to help prevent recovery.
- Any other location that you tell Evidence Terminator to clean.
Evidence Terminator is made by the authors of Spycop anti-spyware software. Spycop is an excellent program for detecting and removing surveillance spyware such as Spectorsoft, iSpynow, TrueActive and others.
If you have any problems with the ordering page or with the coupon code (EVTM-OQ67-INFO), please email Catherine http://www.spywareinfoforum.info/email2.php. Be aware that the reduced price won't be reflected on the purchase site until you reach the checkout page.
Google Listens ... Literally
I found a story at Slashdot the other night that knocked me right out of my chair. Google wants to use your computer's microphone to listen to your TV, then deliver targeted advertisements at you based on what you are watching.
Huh? They want to do WHAT!?!
My first thought was that it had to be a hoax. Somebody had pranked a Slashdot editor, which is not entirely without precedent. That is way beyond the sort of thing any advertising spyware program has tried to do. Google has been edging closer to my "list" for a while now, but surely they wouldn't consider something like this...
After some digging, it seems to be true. As it turns out, it is not as bad as it sounds. Not *quite* as bad anyway. They are not planning to have an open mic that uploads a continuous stream of sound from your house (dorm/car/cardboard box).
Here is how this would work (PDF). The software would record the ambient sound in the room, filter out everything other than the television and encode it into a very small signature file. The file would be uploaded to a Google server and compared with signatures of television shows. If a match is found, you'll start seeing Google ads relevant to what you are watching on television. That is how I read it anyway.
Basically, they would not be eavesdropping. They would, however, keep track of what is playing on the television. If you have a TiVo, you lost that little piece of privacy already, as TiVo has been keeping track of everything you watch anyway. You didn't know that? How do you think they know how many people rewound to watch Janet Jackson's "warddrobe malfunction" a couple years ago?
This is a little too creepy for me. What is on my TV is nobody's business but my own. I don't want to be watching "Red Dawn" and start to see ads for fallout shelters and survivalist magazines.
I don't believe this is worth panicking about. This is Google, so I'm sure this would be strictly opt-in and disclosed very prominently. And if not, I'll personally tie Eric Schmidt to a stake and light the fire. I definitely will not be opting in. Still, I don't know about you, but I unplugged my microphone after reading about this. Just in case...
Much Ado About Very Little
A UK company has released a web browser, called Browzar, which the company claims will eliminate all traces of your web surfing activity. It is a "shell" that uses Internet Explorer's browser engine, with its own interface. The company has been flamed to a crisp on the web and the browser dubbed "adware".
First, it is not adware. For it to be adware, it would have to show ads. Browzar does not do that.
It does open to a hard-coded start page and that start page is a pay-per-click search engine. There is no way to change that start page to a different address or, for that matter, any other options. It also has a search bar that uses the same search engine. These may be good reasons not to use it but it does not qualify it as adware.
For a comparison, the default search bars in Firefox and Opera also use affiliate links. Use the search bar in either browser and those companies receive credit for the search engine traffic.
Another criticism is that Browzar does not eliminate all traces of web surfing. This criticism is justified. I tested the browser and was able to find a copy of the last page I visited in my browser cache. I also found some cached objects, saved by the Java plug-in. It did not save cookies or URL history, as far as I could tell.
Browzar will not protect you against a forensic search of your hard drive. It will, however, stop someone from casually snooping on you. If you are on a public or a borrowed machine, you can download it and use it in the place of Internet Explorer. It doesn't need to be installed. You just download it and run it.
The browser does not live up fully to the claims the company makes about it. On the other hand, it also doesn't deserve the level of animosity people have toward it. It is not adware and does not install adware. It is not part of a scam.
Because of the lively flamefest caused by this browser, I decided to look into how someone can use the internet without leaving any traces at all. I don't think it can be done, however I did come up with the next best thing. I will have that written up by the time next week's newsletter goes out.
Limewire Does Not Install A Rootkit
I have my computer up and running again, thank God. That laptop I was using, while this one was broken, was sooooooooooo slow. This one feels like a Cray supercomputer in comparison.
I have been able to restart my project to test all peer-to-peer programs for spyware bundles. I want to mention what happened with Limewire, because a surprisingly large amount of email came in about it.
Many of the emails mentioned a rootkit. I used two antispyware scanners, two rootkit scanners, HijackThis, an installation logger and a packet logger. There is no rootkit, no adware and no spyware in Limewire, at least in version 4.12.6 (the most current, as of August 29).
I believe the idea that Limewire was installing a rootkit is due to a glitch in Rootkit Revealer. In Rootkit Revealer, if you press the "Scan" button too quickly after loading the program, it will report a data mismatch in the Windows registry. This is just a glitch. If you scan a second time, that data mismatch will not be reported.
That doesn't mean Limewire won't start bundling spyware again, at some point. They have done that in the past. If it worries you, there is an exact, open source clone of Limewire called Frostwire. Except for the name and the color scheme, it is exactly the same program. There is absolutely nothing bundled into Frostwire and I doubt there ever will be.
Now that I have my computer back and my virtual testing environment is all set up again, I just might be able to finish that project. Then, I'll probably have to do it again. Last time I went and tested all those programs, half of them switched sides a week later.
UK Postman Disciplined For Explaining How To Opt Out
UK resident Roger Annies has been hauled out on the carpet to explain himself to his employer, the Royal Mail. Annies went before a disciplinary hearing last Friday and will learn what fate Royal Mail has in mind for him, sometime later this week. What horrible thing did Annies do? He is a Royal Mail postman who printed up leaflets to explain to residents how to opt out of receiving unaddressed junk mail. His employer was not amused.
This has caused a sensation in Wales, with the public rallying behind Annies. Many people were under the mistaken impression that a sign reading "no junk mail" (or similar) attached to their mail box obliged the postman to skip leaving them junk mail. Many consider what Annies did to be a valuable public service.
I am not sure what instructions were on the Annies flyers. I have been told that UK residents can opt out of receiving most junk mail by registering their address with the Mailing Preference Service. Americans can accomplish the same thing by following the instructions at JunkBusters.
My Inbox Overfloweth
Since the last newsletter, over 8,000 emails have landed in my inbox. If one of them came from you, chances are good that I haven't read it yet. I have read the first few hundred.
McAfee, you guys REALLY need to do something about the installer in your software. Hundreds of emails came in from people griping about the fact that McAfee's installer/updater told them to remove their antispyware program. These were not nice emails, most of them. I have a feeling that more people are removing McAfee than their antispyware, judging by all these emails.
People wrote about the asset forfeiture story I wrote. Lots and lots of people wrote. Some people were horrified. Some people thought I made it all up. Some people were convinced that the guy in the story was a drug dealer. Now seriously, think about it. If you were a drug dealer and the cops seized your money but did not charge you, would you voluntarily go to court to challenge the seizure? I don't know any drug dealers, but I think most would just be thankful they weren't seized right along with the money.
There was one email in particular that I wanted to mention. I had it written up already, but this person has emailed again and asked me not to publish the story. He believes that the police department may invent some new drug charge and come steal more property, if he makes noise about what happened to him.
The short version is, he was carrying a couple thousand dollars in cash to go buy a computer, when a policeman pulled him over. The policeman noticed the wad of cash sitting in an envelope. The police seized the cash and his car. He fought the seizure in court and, not only did he lose the case, he was ordered to reimburse the police department for their legal costs. He was never charged with any crime.
I will try to go through the rest of these emails in the next few days. There may more stories like that one.
Privacy In The News
Check out FlyingHamster.com for the latest news headlines relevant to spyware, privacy and safely using the computer.
There is a saying that "all politics are local". It seems that this also applies to the internet. It is a close community in that problems can spread from anywhere. If you see a local story that you think deserves attention, please let us know. Use this mail form, tell us some details and we will follow the story.
FlyingHamster is updated every day - and several times during the day and night. It is updated continually, even on the weekends. We hope it will keep you informed on a daily basis - and keep your internet time a bit safer. As soon as I can get around to it, I will add FlyingHamster's RSS feed to SpywareInfo.
FlyingHamster belongs to my partner, Catherine. It is a free service, supported in the same way as SpywareInfo, by offering high-quality software at a discount. This week, FlyingHamster has a discount on Firetrust Mailwasher. Go check it out.
Support SpywareInfo
Running SpywareInfo has become an expensive thing to do. We are using three separate servers to display the site and to protect it from denial of service attacks. This is not a cheap web site to host.
If you would like to help with the costs, there are two options. There is PayPal for those who have a Paypal account or don't mind signing up for one (it is free).
Thank you very much for your contributions.
You can also purchase t-shirts, hats, bumper stickers and other items from our CafePress storefront.
