Every 5th Call At Dell Is Spyware-Related

prostoalex writes "Financial Express quotes a Dell executive saying that spyware is installed on roughly 90% computers out there. Right now 20% of all Dell phone support calls are spyware-related. University of Washington research this March published a moderate estimate of 5.1% PCs running spyware."

Okay

I think it's probably somewhere in between 5% and 90%...

Re:Okay

I think it's probably somewhere in between 5% and 90%...
Actually, it could be 5% or 90%. I look after machines in the towns round here for home users and businesses. Over the last few months about 90% of the jobs I have done for home users have been removing spyware or viruses, but only 5% or 10% of jobs for businesses have been spyware related.

The Interpretation

Dell: I am sorry, every support call we get is spyware related.

M$: So?

Dell: It all came from IE, your browser. Now we have to bundle Firebox and disable IE for all shipped Dell products.

M$: No. IE is superior. Windows is superior. Suck my left nut.

Dell: What?

M$: Get back to work or we take away windows licensing.

Dell: Ok. Would you like some coffee sir?

Re:Okay

The guys who determined it was only 5% only looked for 4 specific pieces of spyware. That means 100% of their computers could be infected with the other 8 billion pieces of spyware out there, but only 5% were gator, ezula, and another two that I can't remember right now, even though I just R'd the FA....

Re:Okay

I do tech support at said company.. and spyware is horrible...

you almost pray someone will call you that has deleted random registry keys or doesn't know how to use a mouse.
:

Well 10%....

According to Dell, 90% of the computers out there have spyware installed on them... the other 10% are Macs and machines running *NIX. :-P

Re:Well 10%....

Are there no existing spyware programs for *N*X and Macs? The market is up for grabs! I better get cracking on developing some new spyware!

Re:Well 10%....

Well as for Mac's -- I don't know if it's part of the culture of the things or what, but there are TONS of mac appps out there that "phone home" to an extent that is generally not tolerated in PC software. A lot of apps even spew network traffic when they start/while they are running to enforce licensing between machines on the LAN. Rather than protest the vendors' applications, though, the community responds as it typically does -- with a ~$10 app named "Little Snitch" that catches this activity. I have never tested it either, but I kind of wonder whether or not "Little Snitch" phones home also...

Re:Well 10%....

I use my firewall as a snitch. Not only do plenty of apps phone home but so many of them that do still work perfectly well despite being blockaded from the internet. I do however get quite annoyed by applications that you configure to not use the internet that then still go ahead and try to access the internet.

Re:Well 10%....

Most, if not all, of the Win32 firewalls block based on the program name and location. If coolapp.exe tries to access the internet, it can't. It can try all the ports it wants; it won't get through.

Some of the better ones even recognise \myapp\iexplorer.exe as being different than \yourapp\iexplorer.exe. Even if someone tried to write an app named the same as one allowed to access the internet, they still couldn't get through.

I am worried, however, about an app using system calls to route itself through explorer.exe without actually launching it.

Re:Well 10%....

And 20% of them may be calling Dell for help, another 20% or 30% calls their ISP instead.

IMO, more than 20% if well maintained systems...

I run the computer networks for a number of small businesses. We run a variety of programs to keep spyware off the systems. These are less effective than antivirus software.... Approximately 33% of my customers are found to have spyware on a regular basis.

Spyware is the chronic disorder of Windows today

This just goes to show what security folks who have to deal with ordinary, average users have been saying for quite some time now: spyware is the #1 security problem for the ordinary Windows user today. Break-ins, worms, and viruses are all nasty problems indeed, but they do not cause the level of sheer aggravation and suffering that spyware does.

A worm outbreak today is an acute disorder -- the bulk of the damage is done in one day, even a handful of hours or minutes. Even though recovering a business or department from it can take longer, the outbreak itself burns through the vulnerable population pretty quickly, and starves itself. Spyware, because it's rooted in long-standing bad security practices both by Microsoft and by Windows users, is a chronic disorder -- it doesn't just shut you down for a day or so; it degrades your online life over a long, nasty time.

To extend the analogy perhaps too far: A flash worm is like Ebola: it kills its victims quickly and messily and leaves a disgusting corpse. Everyone knows when it's in town because of the gory sacks of flesh lying around the streets. Spyware is like cirrhosis of the liver. It comes from doing something bad over a long period of time. It doesn't spread to others materially, though long-term excessive drinking (which causes it) can "spread" memetically in a population, as do bad Windows security practices. And, eventually, it causes the affected organ to be overwhelmed and just shut down.

The spyware situation today is one created by a nexus of influences:

• Bad security design in Microsoft Windows,
• Absent security education for the ordinary user,
• The unethical business practice of contract date-rape, and
• Negligent refusal on the part of law enforcement to respond to electronic trespass offenses in other media, such as e-mail spam.

The first two are well-known and I will not address them further. The latter are not.

What I call contract date-rape is the evil represented by so-called "end-user license agreements" and other documents which purport to represent agreements between software publishers and computer owners. The unethical business practice of software publishers is as follows: The computer owner buys a piece of software and installs it, only to find that it is designed so that it cannot be run without "accepting" an "agreement" which waives the owner's rights -- such as resale rights, rights to a refund for defective merchandise, or even free-speech rights. Then, when the software does something harmful and the owner seeks recourse, he is told that he "consented" to whatever harm was done, simply by the act of using what he purchased.

It is contract date-rape which puts the lie to that old FUD about open-source software: "But whom do you sue when it breaks and doesn't get fixed?" The owner of a computer using proprietary software under a Microsoft-style EULA does not have any enforceable rights against the publisher. Windows does break in many ways that Microsoft doesn't fix, but nobody is suing Microsoft for it. Why? Whether the EULA is in fact legally binding or not, both Microsoft and computer owners regard it as leaving Microsoft with no obligations.

(Of course, software was not always sold on "as-is" terms that were intended in law for used and defective products. Nor was it sold on terms that used copyright law as a cudgel with which to deprive users of rights such as fair comment and resale. Contract date-rape is not an endemic problem of proprietary software; it is one that proprietary software publishers have chosen for themselves.)

And it is the methodical use of contract date-rape which leads to the situation we have with spyware today. Spyware gets into a computer owner's property unannounced, alongside some piece of (presumably) desired software. It is a Trojan horse in the original sense -- sooner or later, it bursts open and out pour the soldiers of the enemy, who go about merrily burning w

In defense of M$FT - have to disagree on one item

The spyware situation today is one created by a nexus of influences:

1) Bad security design in Microsoft Windows,
2) Absent security education for the ordinary user,
3) The unethical business practice of contract date-rape, and
4) Negligent refusal on the part of law enforcement to respond to electronic trespass offenses in other media, such as e-mail spam.

I can't argue with 3) or 4). But as for 1) [and it touches a little on 2)], we've been running Windows NT & Windows 2000 for more than five years now, and we've NEVER had a SINGLE piece of spyware installed on any of our systems. [Never had a virus or a worm either, although I hope I didn't just jinx myself by saying that.]

You know why? BECAUSE NONE OF OUR END-USERS LOG ON AS ADMINISTRATORS!!! That's it - it's that simple. They don't have Administrative rights, and they can't install spyware [or viruses, or worms]. [Of course, yours truly installs the latest security patches as soon as they appear, and has always had all of his users behind a fire wall, but that's not the important point here.]

If you surf the web as an Administrator [Root] on OSX, or if you surf the web as an Administrator [Root] on Linux, you're every bit as prone to this stuff as any Microsoft user surfing the web as an Administrator [or you would be, if those operating systems had large enough market share for the spyware people to be bothered with writing spyware for them].

I tried

I tried to set my friends up that way. It isn't hard, XP comes with that ability, even in the home version. Setting up is easy enough. Making it work is another matter though. Nearly half of the programs my friends want to run do not work correctly without administrator rights. This includes software for XP from Microsoft!

In the end I gave up, ideally they wouldn't use the administrator account except when needed, but practically their computer didn't work without it. Switching users takes time and is a pain. Not hard, and it doesn't take long, but annoying enough that I can't call it a solution.

Remember this is a home environment, not a work environment. They don't have someone checking out software from various competitors to see if it meets requirements. If Best Buy sells it they buy it, and expect it to work. (note that you can almost never return software after finding out that it doesn't work without administrator rights)

Re:Spyware is the chronic disorder of Windows toda

"This just goes to show what security folks who have to deal with ordinary, average users have been saying for quite some time now: spyware is the #1 security problem for the ordinary Windows user today. Break-ins, worms, and viruses are all nasty problems indeed, but they do not cause the level of sheer aggravation and suffering that spyware does."

I absolutely agree with you that spyware is without doubt the most grevious problem afflicting home Windows user today. However, it is not only the shear numbers of spyware and lack of unified solution to these problems that makes spyware the critical problem it is, but the threat and damage that can be caused by spyware, in my opinion far exceeds what I would consider aggrevation.
Although I am a fulltime workstation administrator for a tech company and often times pick up home user workstation support on the side and they are almost always problems related to spyware. I recently agreed to work on a women's computer that was no longer able to connect to the internet as well as set up a home wireless network for her. She told me that it was "her daughters toy and as long as she can get connected to the internet and chat at night it keeps her daughter out of her hair" they both remain happy. The daughter is 13 years old and has taken to chatting with her friends at night, passing around links to salacious little horoscope programs, gossip programs, ad nauseum . . . After two hours of working on the computer I had removed over 500 instances of spyware (files, reg keys, programs, etc NOT INCLUDING COOKIES!). My obvious diagnosis was that Windows XP home needed to be reloaded but for now she could get back on the internet. When I returned a week later after recovery disks had been obtained there was even more spyware than before & a mysterious bridged internet connection that I assumed was being used to turn the machine into a slave for God knows what. Additionally, I found approx. 5000 illegal song downloads (automatic prison time there), limewire and kazaa and an AIM add-on that was keeping documented records of all IM conversations. I quickly learned that this could not possibly have been the daughters choice as the one converstation I opened while investigating revealed explicit discussion of sexual activities. To me, the potential for abuse in this case goes far beyond the loss of data, or even identity theft. A hacker with access to this machine would be able to know all of this girls personal information, name, address, appearance, school schedule and what place her volleyball team achieved at districts. Needless to say, I did my very best to try to educate this women about the dangers of these surfing habits even referencing the recent /. article claiming 1 out 5 children were solicitated in various forms on the internet last year, but I'm pretty sure I wasn't able to get throught to her about the dangers of the predatory social engineering that can take place through the internet these days. Spyware has the potential to pose a much bigger risk than most people believe because it opens the door to rootkits, social engineering, etc. when it is allowed to run amok in this manner.

Hello

This is Dell(hi). We are not able to being helping you with Spyware this time. Your Dell service is not including that. Do not be cursing at me, sir! Your attitude is having me upset! You must be finding a local person to be helping you.

Re:Hello

"Thank you, come again."

-Apu

Re:Hello

OW come on, have a little sense of humor. I am an indian , and even I found it funny. I know it's stereostying, but what the hell.

And besides, there is some truth to it. The problem is we in India, though are tought english from the first grade, rarely use it in everyday converstaion , so our conversation skills are limited.

We can't create simple short meaningful sentences. We use words like "basically", "actually", "technically" etc. ad nauseam and all at wrong places.

If we really want to keep these "outsourced" jobs we need to buckle up and improve our skills , rather than accuse Americans of being racist.

From my prespective we should rather do RnD stuff, for our own benefits rather than pacify some pissed of customer 7 seas across, who can barely figure out what we are speaking.

In that case...

In that case, Dell should make available for download a "patch" that will scan for known spyware and remove it...

Re:In that case...

read the prompt with incredulity and then apply their best judgment

BWAHAHAHAHAHAHAHAH!!!!!

I wouldn't trust the average user to make toast without burning down the house.

Re:In that case...

Most schools don't trust their educated college students with electric cooking elements. Think about it...

Re:In that case...

Funny thing, I read that article and a popup for spyware comes up, defying even Firefox's popup blocker. Ironically, the popup said that the computer has spyware installed.

Eh.

Re:In that case...

Linux doesn't have ActiveX, but Firefox has extensions. An extension is a zipped up XPI package containing JavaScript (with the power of God), some XML and any native executables the XPI wants to install too. For all the complaints about ActiveX, extensions are potentially even worse.

Once installed an extension can do anything the user can do. Normally that might be to stick a button onto the browser, but there's nothing to stop the extension searching your drive and uploading data, acting as spyware or installing a root kit etc.

Just like ActiveX, XPI files are meant to be signed so you can establish trust. But no one digitally signs their Firefox extensions! Therefore users are 'trained' to install untrusted XPI extensions. Untrusted means you have no idea who wrote it, or if it's been tampered with.

Firefox 1.0pr1 has introduced a small band-aid. Now have to indicate you 'trust' a site before you can install an XPI from it. It's better than nothing but it still won't authenticate or repudiate the XPI as being from that site - someone could have replaced the genuine XPI with a malicious one, or intercepted the entire site entirely.

The XPI model either needs to enforce certs and give contributors a way to get them conveniently and cheaply. Or it should move over to PGP signatures and a web of trust model. In some ways the latter is more beneficial since people don't have to fork out ludicrous sums to Verisign to authenticate that they wrote the extension.

In any case, I'm just indicating that a naive user could install something on Linux that they would later regret.

Re:In that case...

Suppose you are driving home from work one night and you happen to drive through an ion storm.

You pull up in your drive way and everything seems normal. But then you walk in the house and see a hot girl sitting on your couch. She walks over and gives you a passionate kiss and tells you dinner is ready. You know something is seriously wrong the universe.

In this parallel world, *your* favorite Linux distribution is King. As is your favorite Window Manager, toolkit, and so on. 90% of the world runs it.

Now my question is - what would prevent spyware authors from writing and sucessfully deploying spyware on your Operating System?

Lets make the assumption that people in this parallel universe are just as careless as they are in the real universe.

Re:Perhaps Dell should pre-install less spyware.

You can get a Dell with no OS, and with FreeDOS in the box. Or you can get a Dell Precision with RH pre-installed.

Re:Perhaps Dell should pre-install less spyware.

The problem is that Dell hides these little morsels of information so that unless you are already determined to buy a Dell with Red Hat on it you would never know you even had the option.

The very fact that you have been modded informative serves to demonstrate that Dell + RedHat is not an obvious option and most people remain blissfully unaware that it exists.

Dell only offer Linux as an option to appease the Linux crowd. They certainly don't want to be hit by a backlash from the rabid Linux fanboys. But at the same time they are keeping on BillG's good side by sticking "Dell recommends Microsoft® Windows® XP" graphics all over their webstore and ensuring that the Linux option is kept pretty much hidden from the general publics view.

Try going to the Dell website and browsing to a PC with Linux. Don't do a site search for Linux, as that defeats the purpose. Joe Average won't be doing that after all. I just tried looking around for a few minutes. You would think that if you were to check out the "Learn more about operating systems" links on most of their store pages you might see a mention of the Linux option?. No, there is no mention of Linux in there, just descriptions of XP Home vs XP Professional. Yay! It's as if Linux doesn't even exist.

Dell might technically sell you Linux if you ask for it, but they sure go out of their way to make sure you don't ask about it.

Dell saves $$$ pre-installing firefox

Or they would if this were really a problem for them. Makes one wonder.

20% is only the call volume from Dell

... and that would be limited only to Dell customers under warranty or some sort of service package who actually bother to call for support. I would consider it safe to suspect that the actual percentile of spyware infested PC's to be more on the order of 60-70%.

Remember, people only call when they are aware of a problem.
And even then, most people will "get by" until the problem is so pronounced they are forced to do something about it.

85% of all support calls I get are from spyware

Alright, I'm just some guy who fixes computers for friends occasionally, but I like statistics too. When my friends call me a geek for using Linux, I always retort "Guess when the last time I had a problem with spyware?"

I think Dell is going to do some small case studies of selling the average user a machine loaded with linux and see if it becomes cheaper to support them.

It's not cheaper

because you can't pawn your tough cases onto Microsoft. A typical OEM support call follows 3 stages: 1) clean boot 2) run Adaware 3) sorry, run your restore CDs or call Microsoft. Plus, there are _tons_ of tricks to getting free tech support from Microsoft, and many OEM techs are happy to let you know what to say/do.

Oh, and if your customers buy new hardware and it doesn't work, you can't pawn them off on the manufacturer (no Linux support, you see). Yeah, hardware Dell didn't sell you isn't supported. Try telling that to the average jerk who just bought a $30 dollar digital Camera. He's not gonna care if you support it or not, and he's just gonna get pissed and buy a Windows PC next time.

You're underestimating the value that $50 bucks buys an OEM.

Re:85% of all support calls I get are from spyware

When my friends call me a geek for using Linux, I always retort "Guess when the last time I had a problem with spyware?"

I have been using DOS then Windows since 1984 and have never had spyware or a virus either. In fact I don't even run checkers constantly, just every few weeks to double check. (And for the record I have been doing Linux since late 1991 and not had anything there either).

If you are prepared to put the time and effort into it, it is all pretty easy. You don't blindly run or view stuff from other sources, you don't steal software (if you don't have the originals then you have no idea what you are actually getting), you pay attention to the dialog boxes that various programs display etc. Heck I even read the contents of those dialog boxes with legal agreements in them before clicking Ok or Cancel. Most people just don't do that, and as a result their computers end up with more "helpful" software than they otherwise anticipated.

To say that Linux by design is invulnerable is nonsense. It doesn't take too much to infect an individual user (remember they aren't reading those dialog boxes either). And notice how on many Linuxen, when you try to run an admin tool on your ordinary user desktop, prompt for your (sudo) or the root password and which then leaves a key icon in your panel. That is one thing that can be abused to go from ordinary user to root. In many cases a piece of malware could probably just prompt and the average user would type in the necessary password.

Quite frankly I don't know the answer. Signing stuff doesn't work. User education is futile - why should someone have to know about the internals of their computer, operating system, access and authorisation models? It probably comes down the programmers and user interface. Every time the software has to ask a question, it is being stupid. We need to continually work on the software meeting the user's goals without needing to be babysat, and especially without them having to make these decisions all the time.