Crapware Moves From Annoying To Threatening - InformationWeek

InformationWeek is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

IoT
IoT
Mobile // Mobile Applications
Commentary
2/19/2008
08:27 PM
Dave Methvin
Dave Methvin
Commentary
50%
50%

Crapware Moves From Annoying To Threatening

As I read the news of a security exploit for Microsoft Works, it struck me that the companies delivering our computer hardware and software often work at cross purposes. One of the core principles of computer security is to reduce attack surfaces by removing or disabling software so that it won't run by default. Yet the pre-installed crapware on most OEM systems does just the opposite.

As I read the news of a security exploit for Microsoft Works, it struck me that the companies delivering our computer hardware and software often work at cross purposes. One of the core principles of computer security is to reduce attack surfaces by removing or disabling software so that it won't run by default. Yet the pre-installed crapware on most OEM systems does just the opposite.A clean Windows install has only the most basic file associations. There aren't a lot of built-in file viewers, so files are generally associated with basic well-vetted utilities like Notepad or WordPad, if they are set up at all. Users then get to choose which programs they want to install to view and process those files. (Don't get me started about recent versions of Windows Media Player.) Crapware changes the equation, since it grabs dozens of file associations; the code will launch whenever those file extensions are encountered, and also may be launched when those file types are found in a Web page. That provides the trigger mechanism.

Crapware is especially worrisome because it falls into a gray area as far as security updates are concerned. Microsoft seems to deliver patches and updates for its trial software such as Works and Money through Microsoft Update, but each vendor takes a different approach. If the application only checks for updates when the user launches it, the user may have an exploit-filled older version that an attacker can still activate. If the application had a trial period that has expired, only some of the functionality may have been disabled and it may still be possible to exploit the code.

Even the security software that shipped with the system may contribute to the problem. You may recall that Symantec's antivirus software had a serious security problem a few years back. If Symantec's software was ever installed on a system, it often leaves behind running parts even after it's been uninstalled. I've pointed dozens of people to the Norton Removal tool over the past few years; could those zombie Symantec components provide an attack surface?

Removing crapware makes a system faster, improves system stability, and frees up space on the drive. To all those good reasons, you can add one more: improved security.

We welcome your comments on this topic on our social media channels, or [contact us directly] with questions about the site.
Comment  | 
Print  | 
More Insights
InformationWeek Is Getting an Upgrade!

Find out more about our plans to improve the look, functionality, and performance of the InformationWeek site in the coming months.

Slideshows
11 Things IT Professionals Wish They Knew Earlier in Their Careers
Lisa Morgan, Freelance Writer,  4/6/2021
News
Time to Shift Your Job Search Out of Neutral
Jessica Davis, Senior Editor, Enterprise Apps,  3/31/2021
Commentary
Does Identity Hinder Hybrid-Cloud and Multi-Cloud Adoption?
Joao-Pierre S. Ruth, Senior Writer,  4/1/2021
White Papers
Register for InformationWeek Newsletters
Video
Current Issue
Successful Strategies for Digital Transformation
Download this report to learn about the latest technologies and best practices or ensuring a successful transition from outdated business transformation tactics.
Slideshows
Flash Poll