Login | Register   
RSS Feed
Download our iPhone app
Browse DevX
Sign up for e-mail newsletters from DevX


Predators and Prey: Just Another Day on the Web : Page 2

Find out why thinking of yourself as nothing more than a mouse may be your best defense against malicious Web-borne attacks and unwanted marketing.

Prey Adaptations
In nature, when a prey population can't move, it must adapt to avoid over-predation. The strategies adopted in nature all have counterparts on the Web. For example many prey species adopt protective coloration or mimic other species. Web users use anonymity services, block cookies, and provide fake information to avoid leaving traces of their activities that advertisers can use for marketing purposes. Some prey species use armor. Web users create popup ad blockers and turn off JavaScript and images.

Some Web sites abandoned advertising revenue altogether, preferring instead to become symbionts themselves, trading content for income directly by charging for their content. In nature, many species become interdependent, forming alliances for mutual protection and/or food. For example, some ants, rather than foraging, "farm" aphids; they provide protection from aphid predators, and in return the aphids, when stroked, release "honeydew," which feeds the ants. On the Web, for-fee sites provide protection from Web predators in return for payment as "food."

If Web advertising is analogous to symbiosis, then malicious coders, thieves, and virus writers can be thought of as direct predators. In Web terms, the "kill" occurs when a predator manages to disrupt your computer or your life in some fashion. And while avoiding the Web altogether is a prey strategy that works well against symbionts and parasites, but is less successful against direct predation. Many people who don't browse the Web, do operate applications that access the Internet. For example, it's become increasingly difficult to function in the business world without email and instant messaging. Therefore, it's not surprising to find that predators have exploited these in addition to Web pages.

E-mail is by far the most popular venue for direct predation. Web predators use email to attack both computers and people. The most direct threats that occur via email against computers are viruses; however greater individual damage occurs by stealing personal information. In nature, many predators employ lures of various kinds. The alligator snapping turtle, for example, wiggles its tongue, which looks much like a worm, to attract fish. Web email predators also use lures, to get people to cough up personal information or cash. Some common examples are false notifications from well-known sites such as eBay or Hotmail. Others lures offer money, such as the familiar "I'm from Nigeria. My late father amassed a fortune of $X million, and as you are a person of much trust, I would like you to help me transfer the funds ..." or the ever popular "You have won a prize ..." In all these cases, the goal is to get the prey to divulge credit card numbers, bank account numbers, login information, etc., which the predator then uses to impersonate the prey.

Direct predators also use application downloads as ground cover for hunting. Shareware and freeware vendors increasingly monetize their products by including adware and spyware in their downloads—installing the application also installs these unwanted applications. Adware displays banner ads at specified intervals or upon specific actions. Spyware sends details of your computer interactions to third parties without permission. Some malware does both. While the applications themselves are usually parasitic to the computer (they steal CPU cycles, memory, and personal information, but don't usually crash the computer) the fact that they're installed without the user's direct permission or knowledge and that they perform actions intended to influence or damage the user puts them into the direct predation category.

Predators have also used Instant Messaging applications to deliver ads and lures to Internet users. In some cases, these are indirect lures, masking the real attack, which occurs only when users follow the lure. In nature, lions and other predators that hunt in packs often send one or two members out into plain sight, a strategy that captures the prey's attention or scares them into moving away from the predators. Then, while the prey focuses on the predator, the rest of the pack attacks from another direction. The Internet counterpart to this strategy is messages that lure users to browse to a URL, where the predators use plugin or script vulnerabilities to attack their machine or steal data.

Mimicry and Other Strategies
Just as many prey species adopt protective coloration and use mimicry to hide from predators, some predators use similar techniques to mislead their targets. For example, several praying mantis species have evolved marvelous shapes and coloration that make them nearly invisible. Walking stick insects, which mimic twigs, are another famous natural example. Some sites or email messages mimic login pages such as Hotmail's. The goal is to get users to enter their username and password, but when they do so, the information gets sent to the attacker's site.

Other predator tactics include drive-by downloads, an exploit where a single click on an otherwise innocuous popup acts as user assent so the site can install software to the local computer. Some sites even bypass the click, installing software invisibly when a user visits a page.

Web users, in turn, are evolving new capabilities for preventing attacks by finding and removing malware; blocking unwanted content; ferreting out mimicry sites in the form of pest and malware databases; increasing their reliance on firewalls, NAT routers, anti-viral software, spam filters, ad and popup blockers, URL-blocking and filtering applications; and keeping their OS, applications, and hardware devices religiously patched and upgraded.

The Never-Ending Battle
Nearly every natural strategy, both predatory and defensive, seems to have an Internet counterpart. It's both amusing and depressing to think about. The battles between Web predators and their prey will be just as endless as those in nature and will continue to change and escalate.

Despite the compressed evolutionary pattern, the Internet is still relatively new, whereas nature has had millions of years to fine-tune both attack and defensive strategies. By looking at nature to find strategies that don't yet have Web counterparts, Web users may be able to stay an extra half-step ahead of the predators.

A. Russll Jones is the Executive Editor for DevX. Reach him by e-mail .
Comment and Contribute






(Maximum characters: 1200). You have 1200 characters left.



Thanks for your registration, follow us on our social networks to keep up-to-date