Broadband Tech > Security > Security > Spyware Databases?

Spyware Databases?

reply to SpyWar
Isn't using someone else's database a little out of line? In fact a lot out of line. Isn't that like using someone else's property without paying for it or taking the time to do it yourself...stealing more or less. Maybe I am missing something here in the question. Please clarify what you are looking for unless I've hit upon what it is already.

reply to SpyWar
yes, this reminds of a post where a "rent a coder" was offering a false positive application in hopes of "buying". it was pulled form cnet downloads. thats all i remember about it though.

reply to SpyWar
Hi All:

If you were ever wondering where so many of the anti-spyware programs listed on the Rogue/Suspect Anti-Spyware page come from...

»www.spywarewarrior.com/rogue_ant···ware.htm

...the post leading off this thread is a good start at an answer. Right now the anti-spyware market is hot -- see:

»www.internetnews.com/security/ar···/3442551
»www.idc.com/getdoc.jsp?container···3_102854

Because the market looks so lucrative, we have a large number of people and companies jumping in with whatever they can get their hands on in the rush to get an anti-spyware application to market and start cashing in.

The problem for these people, of course, is where to get an anti-spyware application quickly and on the cheap? They usually have no experience in the anti-malware industry and they're not that interested in investing the effort to hire a quality research and development team to create an anti-spyware application themselves and do a proper job of it. That would simply take too much time and money.

Depressingly, there is a market out there for "rent-a-coder" anti-spyware applications and definitions databases, and many individuals and firms are perfectly happy to snap these up in order to speed the process of getting an application to market.

Anti-spyware applications are tough to do right, though. Not only are the spyware and adware pests we're seeing becoming ever more devious and difficult to remove, but the number of new pests and variants of existing pests is exploding. Consequently, anti-spyware applications are very "high maintenance," requiring laborious research and development every day of the year. Even the best in the business struggle to keep up.

Good anti-spyware vendors know that quality scan engines and definitions databases can't be purchased on the cheap and off the shelf. The best anti-spyware firms are hiring researchers like mad to update their definitions databases and plowing thousands of man hours into the development of their scan engines because they know that it is vital to be in control of every aspect of their anti-spyware application.

Unfortunately, the number of firms who are truly committed to producing quality anti-spyware programs is very small. The vast majority of anti-spyware applications available on the Net are rebranded cloneware apps produced by rent-a-coder operations who then sell their substandard wares to internet entrepeneurs -- often "mom and pop" type operations with no experience whatsoever in the anti-malware industry but who are looking to make a quick entry into a hot market.

I've actually communicated with a number of these small-time vendors who decided to buy an anti-spyware app on the cheap and jump in. What I've learned ranges from discouraging to downright scary. Some of the vendors aren't familiar with the concept of a "false positive." Still others have very little sense for the threat of spyware or how their own applications fail to detect and remove it.

One vendor I talked with the other day wasn't even familiar with the scan results of his own application. When I detailed the deficiencies in his application's reporting of detected spyware and adware, and he wasn't even aware of the kinds of information his program was neglecting to report. That kind of woeful ignorance is not uncommon among these vendors because they're simply buying rebranded applications and databases from some murky anti-spyware chop-shop.

In this kind of environment, we often see companies and individuals trolling the Net for definitions databases they can buy, instead of hiring quality researchers to do the job properly. Some of you may remember Ashley, the vendor behind Privacy Tools 2004:

»Anti-Spyware Vendor Threatens to Write Malware

After I reported that the beta of a new version of his application was producing ridiculous false positives, Ashley decided he could solve the problems with his application by simply going out and buying a new definitions database. The results were utterly predictable:

»spywarewarrior.com/viewtopic.php?t=4112

Still worse, we've even seen requests for databases that were little more than thinly veiled invitations for unscrupulous parties to rip-off and resell the databases from well-known anti-spyware applications like Ad-aware and Spybot Search & Destroy.

Another popular approach to building a spyware database involves merely harvesting file names and Registry keys from the growing number of anti-spyware research pages available online, such as those found at Pest Patrol's research site, SpywareGuide.com, Doxdesk.com, or Kephyr.com. The data stripped from these sites is then dumped into a file to be used by a relatively unsophisticated scan engine that does little more than perform dumb string scans on the hard drive and Registry, a surefire prescription for producing loads of false positives.

Not surprisingly, the anti-spyware applications that result from this blase attitude towards research are utter garbage. The definitions database is absolutely critical to an anti-spyware application, but the sub-standard anti-spyware vendors seem to regard it as an afterthought at best -- as icing on the cake of a flashy GUI and attractive set of web pages. It's the definitions database, however, that sets the few quality applications apart from the great mass of junk.

Sadly, all too many people out there just don't seem to care. Their only goal is to get an anti-spyware product quick and on the cheap. For a truly depressing read, take a look over the current "spyware" work projects being bid on at RentACoder.com:

»www.rentacoder.com/RentACoder/So···Work.asp

It's a sure bet that most if not all of the applications that emerge from that degraded development process will wind up on the Rogue/Suspect Anti-Spyware pages.

Best,

Eric L. Howes

Well Eric, once again it seems you have hit the nail squarely on the head. Its great to see someone such as yourself so dedicated to publishing facts to keep the everyday user up to snuff regarding the tactics some of these companies use.

We are all the better for all the hard work you do.

With your permission, I'd like to post this message in its entirety over on my site for the newbies who join to be a little more informed. I will of course provide a link to this thread as well.

Thanks again.....from all of us.

EDIT: I'd also like to pin it over at Spyware Warrior too, if you don't mind.
Remember............You can NEVER be OVERPROTECTED!!

TeMerc,

SpyWar made a similar request at SpywareWarrior here:

»spywarewarrior.com/viewtopic.php?t=8070
--
aka Suzi, Spyware Warrior

reply to SpyWar
Hmmm... sounds like another "Ashley" on the go....

reply to suzi
Yes, and I said there:

First of all, let me tell you a little bit about myself. My name is Pat, I've been making a living online since whenever FrontPage 98 first came out. I have quite a few websites relating to both the mainstream and adult online industries. My main site right now is Adult Traffic Generator where I sell website traffic to both mainstream and adult sites, but mostly adult. Trust me, you're not talking to a newbie, despite what the title under my name on the board here says.

The program which I was referring to, that I am going to have coded, is not going to revolutionize the industry. I just want to have a program that is not too unlike some of the better spyware removers that are out there now but with a couple ideas that I have for useful additional features as well. I was mainly asking about purchasing or perhaps leasing a database so I don't have to require a 24/7 team of forensic experts just to maintain/update viable definitions.

I understand what you are saying about all that is evolved in such an endeavor. I am just exploring the possibilities right now, but this is something that I do have my heart set on.

Thanks for the warm welcome
.

reply to eburger68
Eric wrote:

quote:

---

Sadly, all too many people out there just don't seem to care. Their only goal is to get an anti-spyware product quick and on the cheap. For a truly depressing read, take a look over the current "spyware" work projects being bid on at RentACoder.com:

---

quote:

---

This software shall detect at least the amount Spyware, Parasites, Scumware, Trojaners, Dialers, Malware, Browser Hijackers and Tracking components as Ad-Aware SE Professional and SpySweeper does.

---

reply to SpyWar

reply to SpyWar
Ahhhh, we all here just love pr0n redirectors who want to market lookalike cut and paste "antispyware" applications that are;