How To Protect Yourself From Creepware

We all know the dangers that malware (malicious software) pose to our online lives. We've all heard the horror stories from friends or coworkers who have had their bank accounts plundered, their identities stolen or their email hacked into. Some of us have no doubt experienced these abuses ourselves. And while all of the above can leave us feeling vulnerable and personally attacked and distressed, there may just be another online threat that could leave us feeling even more like the victim of a targeted attack. Welcome to the not so wonderful world of creepware.

What is creepware and what does it do?

But what exactly is creepware and what can it do? In this article we are going to take an in-depth look at the causes, symptoms and the impact creepware can have on its victims. We'll also take a look at what the users (or should that be abusers?) of creepware are hoping to achieve through their usage of it. And of course, no post would be complete without taking a look at how creepware is spread – and what you can do to protect yourself from this very nasty strain of software.

A heat map showing potential creepware victims around the world.

Creepware is a term which is used to describe something called a Remote Access Trojan (RAT), although you may also come across the terms Remote Administration Trojan, Remote Administration Tool or Remote Access Tool. Put simply these are programs that have been installed on your computer without your knowledge, which enable an unscrupulous third party to gain access to, and control of, your PC remotely.

There is, however, a difference between remote access tools and remote access Trojans in that Trojans are always used for ill gotten reasons. Remote access tools can actually be used completely legitimately; for example by a trusted remote IT support technician. They also enable you to connect to a computer that's in your home or workplace when you're on the go. The bad news is though that these features that make remote access tools so useful can also then be applied to far more nefarious activities.

So why, the name creepware? Well for one, it's a lot less of a mouthful than Remote Access Trojan, and RAT could just be confusing. Also it's particularly apt when you realize just what a user of creepware can do once they've hijacked your machine. The presence of a Trojan means that your attacker is able to gain virtually complete control of any aspect of your computer – they'll be able to do pretty much everything that you can – just as if they were sitting at your desk at home or work too. Not only that but it's almost impossible to know if you have a Trojan on your device. It is this unsavory and, yes, downright creepy behavior that has led to the moniker creepware.

Once control has been established your attacker may do one or more of the following things:

• Spy on you via your computer's webcam and capture images of you – i.e. voyeurism
• Steal your personal data and/or files
• Monitor your online activity, log your keystrokes and steal your passwords so they can hijack your user accounts
• Listen to, and in some cases record, your conversations through your PC's microphone
• Copy or delete files such as pictures and videos
• Use stolen pictures or videos or webcam recordings to either blackmail you and extort money or persuade you to perform sexual acts on camera. If the photos or videos are of a graphic nature this is known as sextortion
• Trolling and cyber bullying
• Make your computer open x-rated adult or otherwise extreme websites, display abusive messages, or damage your system - all just for their own sick amusement

Who would use creepware?

Not surprisingly, the users of creepware tend to rank pretty lowly on the morality scale of things. Some use it to make money either by blackmail, extortion or fraud, whilst others may see their use of the malware as 'just a bit of fun'. Clearly if you're a victim of creepware you are unlikely to see the funny side, which pushes it firmly into 'trolling territory'. Whether being used as a 'joke' or a 'prank' or to extract money from a victim, using creepware involves accessing someone else’s computer without authorization – again this is morally wrong - but also a serious crime.

Users of creepware, of which there are a shockingly high amount, explain their reasons for using it in discussions on online web forums. Comments in threads range widely and make for some disturbing reading with users variously stating:

• I use it to target people I hate to upset them – I like it when it makes them cry
• I haven't used it for anything bad – but I do convince girls to undress for me
• I steal peoples' passwords and access their bank or social media accounts
• I think it's fine – the people I watch don't know I'm watching them

In fact there are a huge amount of creeps out there who claim on these forums that it's entirely the victims' own fault for downloading and installing programs from unverified or un-trusted sources in the first place!

From this it's probably fairly safe to conclude that the users of creepware users are either pretty blasé and do not care about the damage or distress that they can cause. Or maybe they just don't realize that what they see as harmless fun can leave their victims traumatized or even, in worse case scenarios, driven to self harm or suicide.

On top of this, a lot of victims don't report this sort of criminal activity and so the perpetrators are rarely caught or apprehended and as a consequence escape justice. There are a number of reasons why the victims don't report attacks; possibly they don't think they'll be believed or that they won't be taken seriously. In many cases it's because they are being blackmailed by the attacker who has threatened to post stolen or recorded videos or photos online and they are worried about their reputation being damaged or the personal fallout and the impact it could have on relationships or a career.

One creepware attack that did get reported – and hit the headlines – however was that of the case of Cassidy Wolf, a 19 year old high school student and a Miss Teen USA. Back in August 2013 a fellow student hacked into Cassidy's device and watched her getting undressed at home in the privacy of her bedroom. The attacker captured photos and then threatened to publish them online if Cassidy didn't comply with their demands to take explicit photos of herself. Bravely, rather than giving in to the attacker and becoming a victim in the true sense of the word, Cassidy went straight to the police who eventually managed to track down the culprit - who then subsequently pleaded guilty to having harassing at least two dozen more women. Watch An interview with Cassidy here.

And in further bad news, because creepware has been designed to be extremely user friendly and boasts a logical GUI - graphical user interface – it can be utilized not only by expert hackers but by newcomers to the game too. No longer is malware the domain of the hardcore hacker or hijacker, now pretty much anyone with a desire to act maliciously online can master these programs.

How does creepware work?

Creepware utilizes a client-server model. This is a software architecture made up of a system of clients and servers. In a regular client-server relationship your computer (the client) sends the server a request. The server then processes the requests and sends the relevant information back to the client. Creepware turns this on its head by turning your computer into the server whilst the PC belonging to the attacker assumes the role of client. This then enables the attacker to send nasty commands to your machine enabling them to take control of your operating system and retrieve files or perform other unwanted (by you) actions.

What can creepware do?

So let's take a look what exactly creepware does. In actual fact there are a huge amount of creepware programs out there, although most of them share the same features, methods and unscrupulous ambitions.

Just some of the names to look out for include:

• Blackshades (W32.Shadesrat)
• DarkComet (Backdoor.Krademok)
• Poison Ivy (Backdoor.Darkmoon)
• jRAT (Backdoor.Jeetrat)
• Pandora RAT (Trojan.Pandorat)

The Blackshades user forum.

We'll take a closer look at one of these programs; Pandora RAT. If your computer is unfortunate enough to be infected by the Pandora RAT creepware, your attacker will be able to access all of the following items on your PC:

• Your files
• Your services
• Your processes
• Your clipboard
• Your registry
• Your connected printers
• Any network connections that are currently active

And so that means that the user of Pandora cRAT will also be able to:

• Cause your system to fail thus displaying the dreaded 'blue screen of death'
• Display messages on your screen
• Play you audio messages by using the text-to-speech function
• Take remote control of your computer's desktop
• Take screenshots
• Hide your taskbar and desktop icons
• Restart your computer at their own will
• Open websites and pages
• Record footage via your webcam
• Record any VoIP conversations you are having or other audio
• Log your keystrokes to steal your login information and passwords
• Download your personal files

Your computer may also be used to initiate Distributed Denial of Service (DDoS) attacks and even used to mine bit coins. And basically any action which benefits the attacker – you name it, somebody somewhere can probably do it with creepware. And if they can't now, they probably will be able to in the not too distant future! Put quite simply, your resources could be being used to an extremely dubious third party's advantage.

How does creepware get installed on my computer?

Creepware is installed on your device in the same way that all malware programs are; all you need to do is click on a link in a dodgy email, chat room, or on a social media platform. Creepware can also be installed by drive-by downloads associated with the latest must have program, game or popular TV series, or through peer-to-peer file-sharing and torrents.

Creepware is big business!

So not only are criminally minded creepware users using the software to extort, or sextort, money from their victims but the sale of Random Access Trojan software itself can, and does, bring in the big bucks. It is possible to by the software either directly from the website of a developer or from individuals who place adverts on forums devoted to hacking and other shady online practices.

Further income is generated by self-styled and so-called creepware experts who charge people who want to set up creepware but who don't want to be bothered with any of the work. Naturally the price they will pay depends on the service provided and whilst certain creepware can be obtained for free, other, more advanced programs can cost from anything up to $250. Added extras – let's say your FUD crypter (more of that in a moment!) and the additional cost of setting that up may cost anywhere from $20 to $50. And make no mistake; there are plenty of 'helpful' trolls in the aforementioned forums who are plenty eager to pass on insider tips, tricks, advice and instructions to the new kids on the creepware block.

So, more about that FUD encryter. Yes, everything from this to a JDB generator and even a slave can easily be found and purchased through these websites. Don't know your FUD from your JDB and certainly have no intention of purchasing a slave? We can't say we blame you – here's a brief rundown of what these actually are:

• FUD means something is Fully UnDetectable by a security software seller
• A crypter is a tool which is employed to scramble the bytes in a file thereby making it a lot harder to detect
• JDB stands for Java Drive By. This is something which, when someone browsing the web visits a website that has a certain Java applet embedded onto it, they will see a pop-up which will display a message asking for the user to give their permission for something. The visitor to the site gives their go ahead – and creepware is promptly downloaded onto their machine
• A slave is the name given to a computer that has been infected with creepware

Okay, enough already! How do I protect myself from creepware?

To protect yourself against creepware there are a number of recommended things that you really should seriously think about:

• Make sure your antivirus is up to date and you run it on a regular basis - manually too
• Also ensure your operating system and any software you have installed on your computer is also the latest version. You can use Automatic Updates in Windows s this will auto download and install Microsoft security updates
• Don't download files or programs from dubious or third party websites
• Be careful and don't get sucked in to opening tempting looking links on social media networks, in emails or in instant messenger chat windows
• We shouldn't have to say it, but please don't open emails if you don't know the sender and whatever you do, don't click on link in emails that you don't trust
• Change your passwords every 30-90 days. How to create a strong password.

Another crucial thing to look out for is if your webcam suddenly activates itself. If you're not using it, we recommend covering it with a small piece of tape, or keeping the shutter closed, if it has one.

In conclusion

We all need our computers and devices, which play an important part in both our social and working lives. What we don't need is the threat and the distress that creepware – or Random Access Trojans – can cause us. Play safe and exercise caution when you're online for whilst it is certainly true that creepware is capable of inflicting potentially huge, life-changing amounts of damage, by taking certain protective steps – some as easy as sticking a piece of tape over your webcam – you can stay safe when you're online. Most of all keep your security software up to date and prevent yourself from falling victim to online blackmailers, hackers, creeps and trolls.

Written by Michael Kaur, http://deletemalware.blogspot.com

Does Incognito Mode Hide Your IP Address?

This and similar questions come up very often. For this reason, I decided to write this post. In short, NO. Incognito mode in Google Chrome doesn't hide your IP address or location. If you want to hide that you need to change your IP Address, and that means using either a proxy server or a VPN service.

Google Chrome Incognito Browsing Mode

You may or may not have heard of Google Chrome's 'Incognito Mode' – if you have, it's not really that surprising because Google have promoted this heavily. And if you haven't, not to worry as we’re going to take a close look at what it is. The Google Chrome Incognito Mode allows you to browse the internet – just as it sounds – anonymously. Google has been trumpeting this new development as they claim it's really easy to open a window that is incognito – yet still use the regular method of browsing in the other windows you have open. But is this completely true? And just how incognito, or secret, is the mode? For example, is it as secure as using a VPN to ensure that your browsing stays private?

Let's take a look, but first, how do you use Google Chrome Incognito Mode?

Google claim that when in Incognito Mode all of the websites you visit as well as any files that you download will not be saved either in your browsing history, or your download history, respectively. In addition to this all of the cookies from that browsing session are deleted once you have closed the incognito browser window. However the changes that are applied to your bookmarks and general settings ARE saved.

So how do you open an incognito browser? It's pretty simply: you simply go to the Google Chrome menu and choose 'incognito window'. An icon will then appear to show that the browser window is in Incognito Mode; i.e. cookies will be deleted and history or downloads will not be saved.

Keyboard shortcuts to open a Google Chrome Incognito Mode window

• If you're using Windows XP/7, Linux and Chrome OS: Ctrl+Shift+N
• If you're using Windows 8: use the Easy Window Switcher
• If you're using Mac: ⌘-Shift-N

So just how safe is the Google Incognito Mode?

Okay so Google have told us that it will stop your browser history from being saved and that is correct. However any website you visit – even when in Incognito Mode - can still track and store your data. On top of that, any cookies received from these websites, and files that are stored on your PC or Mac from those visits will not be removed. Plus – and here is another slightly devious thing to be aware of - if you're signed into your Google account, the searches WILL be saved in your web browsing history.

The not-so-secret secret search

It doesn't seem quite so secret now does it? You can, however, pause Google's web history tracking by adjusting the settings (although this is under a different setting) and this should get around the problem. But is this something you are going to remember every single time you want to open just one 'private' window? And again, there is another piece of not-so-good news in that the functionality of Incognito Mode is limited in Chrome OS.

This is because 'normal' browsers and incognito browsers both use the identical HTML5 local storage that the sites you visit utilize to store files on your computer. And therefore your data will be accessible to these websites whether you are in Incognito Mode or not.

Privacy? It basically comes down to whether how much Google wish to add to their users' profiles: Google needs to save data about our browsing habits so they can keep developing their search algorithms – and of course so they can target advertising to us.

If you want total anonymity for whatever reason, just changing a browser setting is not a foolproof way of ensuring that. Sure, Google can't stop 3rd party websites from tracking or storing your data (and they have not guaranteed that they can’t do the same if they wish) but lauding this as a total incognito solution may be taking it a little too far.

Other issues

Internet Service Providers (ISPs) also have the ability to store data and can still track your online habits whether you’re in Incognito Mode or not. And how about when you're streaming online? If you're using Internet Explorer's Windows Media functions, it will save a copy of the streamed files in its history. Regardless of whether or not it's the browser that you're using to stream.

Summary

As you've probably ascertained by now, whilst it may have its uses Google Chrome's Incognito Mode is not quite the undercover, stealth browsing experience it initially appears to be. The fact that ISPs or websites can still save your data is proof enough. Incognito Mode only really comes in handy if you don't want someone who also uses your computer to know which websites you've been visiting.

If you really want to browse the Internet in anonymity you need a VPN as this will go one step further than Incognito Mode and hide your IP address - from everyone. It also encrypts data and traffic meaning that if you really don't want anyone to know which sites you visit, it's your only option.