How Spyware Works
In this paper, we'll briefly outline two systems that could be
classified as spyware to demonstrate different methods for collecting
information from users without their knowledge.2
In both cases, these systems perform some kind of surreptitious user
tracking and then format some part of that data for reporting back to
system's operator. It should be noted that there are significantly
more egregious cases of spyware in use; we choose these two systems
because they represent a Windows-based system that collects and
reports information and a Web-based system to do the same. Other
cases that we have analyzed include Spector
Professoinal [5],
TheCounter.com [2],
Coremetrics [7],
DoubleClick [8,9],
and Netscape [6].
PCFriendly
PCFriendly is an application that shipped on numerous DVD
titles between 1996 and 2000. In addition to its stated objective
(providing a software-based DVD player for Windows machine), the
system collected information about the user and the user's DVD
collection, occasionally reporting such things back to InterActual
Technologies, the maker of PCFriendly.
PCFriendly is a Windows-based application that starts when
a DVD is inserted into the system's DVD player. The first time that
the application starts, the user is asked for information like name,
address, email address, and age. A unique identifier is assigned to
the user, and the application appears to track changes over time, for
example, additional DVD titles put into the system.
As of Interhack's last look at the system (in May 2002),
PCFriendly was being replaced by a new system, known as
InterActual Player, written to address privacy concerns,
among other things.
Defenses that we identified at the time essentially meant breaking
PCFriendly functionality:
- Do not watch DVD titles on a computer. Backchannels are easy to
implement on systems with Internet connectivity.
- Upgrade to the latest InterActual Player. Privacy
problems with Web-based content provided by the DVD producers (as
opposed to InterActual Technologies) will not be addressed in this
case, making this solution incomplete.
- Block all access to pcfriendly.com and
interactual.com domains.
Note that in our second option--using the InterActual
Player--only meant using newer software designed to give the user
a greater number of options for protecting privacy--default behavior
was still invasive.
Detailed analysis and discussion is available in the Interhack
Research Technical Report, “PCFriendly Enables DVD
Backchannels”. [4]
Pharmatrak
Pharmatrak was a company that provided a Web site tracking and
reporting service to pharmaceutical companies. Its system works much
like the Coremetrics system Interhack analyzed in
2000 [7], with two critical differences.
Interhack provided forensic analysis to plaintiffs' counsel in the
Pharmatrak privacy litigation. Facts regarding the operation of
Pharmatrak's service are identified in court
documents. [10]
The first difference was that Pharmatrak did not have JavaScript code
that was designed to pull users' responses to form data out of the
form and to put them into a request for a Web bug. Pharmatrak's
entire collection mechanism was predicated on collecting HTTP
Referer [sic], though it did go to some significant lengths
to get the data--including the use of JavaScript (and even a Java
applet in the earliest instance of the software).
The Pharmatrak system was designed to collect information about users
of pharmaceutical companies Web sites. The users would be
pseudonymously tagged, and their activity observed and reported back
to the pharmaceutical company. In addition, very high-level
information (such as total traffic) would be reported to other
pharmaceutical companies that were Pharmatrak clients, allowing each
Pharmatrak client to see not only detailed information about its site
activity, but high-level information about its competitors' sites.
All of this happened with the knowledge and consent of the
pharmaceutical companies that hired Pharmatrak to perform the
reporting service and implanted the Pharmatrak-supplied code on their
sites.
This leads us to our second difference: Pharmatrak was not authorized
by its clients to collect personally-identifiable information, and by
all appearances, Pharmatrak did not have specific intent to collect
such information. (Forensic investigation and analysis showed that
they did have detailed personal information on several hundred users.)
Detailed information on the mechanisms for client and server
interaction on the Pharmatrak system can be found in court documents.
Interaction between Web browsers and clients and how these impact user
privacy is described in detail in Developing Trust: Online
Privacy and Security. [3]
Next
