Ghosts in your machine

Spyware may already be monitoring your computer and internet use, reports FRANCIS TILL.

Cybercrooks want to steal your financial details, your internet identity, and put your computer to use as a slave; advertising companies want to build profiles of your surfing and purchasing habits; nosy parkers want to rummage around in your private life.

Computer espionage spying involves trying to get into your computer online - but other spies may just sit down in front of your keyboard and have a go at your files.

Poisonous cookies Perhaps the best-known threat to online privacy is the least worrisome: cookies. They are small pieces of code placed on your computer each time you visit a website.

But cookies are always under your control since they reside openly on your computer.

To look at your cookie jar, go to Start/Search to find a folder named "cookies". Is there anything there, particularly web addresses of sites you've visited, that you don't want anyone to see? Delete it.

Advertising spyware Software that secretly tells a remote computer what your computer is doing or has done is called "spyware".

Most spyware cannot be installed without your help. Since you would not do such a thing, spyware companies tend to bundle their snoops as a parasite attachment to other software you want.

When you install parasite-infested software - such as the enormously popular file-sharing program KaZaA - you also install the spy.

"When you're skulking around the hidden recesses of someone's system, placing hidden software that captures activity and sends it home to the mothership, you have the capability to do anything," one security consultant told Salon magazine.

"This includes capturing every keystroke, reading every file. It could even modify your email after you hit 'send', adding or deleting things without your knowledge.

"You name it, [these programs] can be designed to do it."

One of the parasite programs that come bundled with KaZaA is from Brilliant Digital Entertainment and it sets up a doorway through which your computer can be surreptitiously used as part of a "distributed computing" network - many computers linked together to work on a single problem.

AdAware, from Lavasoft, is the best-known of several tools that detect and eliminate this sort of spyware.

But spyware generators are fighting back, and some spyware now seeks out and removes AdAware from computer systems.

Firewalls Most internet threats - including activity from spyware already inside your computer - can be detected and headed off by personal firewalls. A firewall is just a bit of software that tracks activity on your internet connection and rejects or alerts you to suspicious activity. When spyware hidden on your computer tries to connect with home base, your firewall will tell you.

Likewise, when hackers try to access your computer, the firewall will alert you to the activity.

ZoneAlarm is the most popular personal firewall. It has a free version and you will probably get your first alarm bell within minutes.

The average computer is scanned for vulnerabilities several times an hour while online, says Infosys, and if you are new to privacy protection, there are probably dozens of spyware programs on your hard drive.

Surfing anonymously When you connect to the internet, your internet provider assigns you a unique identifying number, your internet protocol (IP) number.

Any website you visit can record this number, which can be traced back to you with the co-operation of your internet provider.

A hacker hiding behind a website can acquire your IP number and use it to masquerade as you. This is called "identity theft" and it is a growing problem.

One way to avoid this trap is to surf anonymously, through the use of anonymous "proxy servers" or third-party sites that cloak your identity.

Anonymiser is probably the best-known third-party tool for cloaking your IP number. Another vendor, IDZap, has a free anonymous surfing tool and a great deal of information about IP theft.

Threats from keyboard Some spyware, like Win Spy, is designed to make a hidden record of everything you do, on or off the internet, and then send it invisibly to a third party or hide it for later examination.

Employers use this type of software - activity loggers - to monitor employees, but parents have been known to use it to monitor their children and it has figured in more than a few divorces.

AdAware will detect some of this software, but for a thorough analysis, use Anti-keylogger, which will let you check your system for free but charges about $US60 ($132) for the tools to get rid of intruders.

There are also hardware versions of keystroke logging tools, such as KeyGhost from New Zealand firm Working Technologies.

More commonly, snoops will browse your computer directly, by sitting at the keyboard.

Serious defences against this intrusion start with encrypted system passwords and extend to encrypted files and email (PGP International has free tools to do this), but the best defence is common sense coupled with insight into how files are stored on your computer - and why you cannot really erase them (see sidebar).

Everyday protection For starters, delete the contents of your "recent documents" file; empty your caches; delete telltale cookies; clear your history folder; clean out your email program; and empty your wastebasket (as well as any "protected" files such as storage drive backups).

If you want to automate these tasks try some of the "scrubber" software packages widely available online.

The award-winning $US30 tool called Window Washer, for example, removes almost all traces of internet activity and allows you to "bleach" deleted files well enough to defeat most undelete software.

Anti Spy (US$17) does even more than Window Washer.

AdAware

ZoneAlarm

Anonymiser

IDZap
Anti-keylogger

PGP International

Window Washer

AntiSpy

KeyGhost

Win Spy

Salon magazine article: The parasite economy