Spyware-type software product and analysis of its resistance to detection by security tools - Ковальов, Олександр Олександрович; Чобаль, Олександр Ілліч; Різак, Василь Михайлович (Ukrainian Information Security Research Journal, 2020)
In the period of active development of information technologies, the problem of confidentiality is extremely urgent. Today, there are several thousand varieties of malware that work according to different algorithms. However, they are all united by the fact that they are created specifically for unauthorized modification, destruction, blocking and copying of information by the user, disrupting the operation of the computer and computer networks. Spyware is software that collects and transmits information about a user without their consent. This information may include his personal data, the configuration of his computer and operating system, and Internet statistics. The basic set of functions of the spyware can include functions for reading information from the user’s keyboard, taking screenshots of the monitor screen, logging sites visited by the user, unsanctioned analysis of the security system status, and much more. There is a type of malware that can cause significant damage to the user’s privacy and at the same time they will be unnoticed even for specialized programs. We are talking about spyware. To detect spyware in the system, user should use specialized software that is aimed at identifying this type of threat. However, even they cannot guarantee complete security. This article describes the main types of spyware and has developed a “system monitor” Spyware, the task of which is to collect information about users with the possibility of further processing and transmission. The efficiency of the developed program is demonstrated on the basis of the collected data and negative results of scanning the system by specialized software. The features of the work of software spies are examined and an analysis of their behavior is carried out, which results can be used at development of probabilistic methods for finding programs of the type under investigation.