The e-spy who loves you could be a felon
Think again about opening that "thinking of you" e-card your lover just sent: New software lets anyone turn that greeting into what may be an illegal bugging device.
Computer security experts said the Lover Spy service and software appeared to violate U.S. law but also said the surveillance program pointed to an increasingly common way for hackers to seize control of computers.
Marketed as a way to "catch a cheating lover," the Lover Spy company offers to send an e-mail greeting card to lure the victim to a Web site that will download onto the victim's computer a Trojan program to be used for spying.
The Lover Spy software, sold for $89 for up to five computers, purports to record anything the victim does on the computer, including all keystrokes, passwords, e-mail, chats and screen shots and even turning on the victim's Web camera.
The spy program discreetly sends the information to the Lover Spy server, which then forwards it to the person who paid for the software, maintaining the purchaser's anonymity, according to the company's Web site, which did not list contact information.
"Lover Spy is being used today by private investigators worldwide, spouses and parents who want to protect their children," the site asserts.
Richard Smith, an independent privacy and security researcher in Boston, said that "you don't need physical access to the computer. It makes it so you can spy on anybody you want."
"That would be a felony," said Mark Rasch, former head of the Justice Department's computer crime unit and chief security counsel for security company Solutionary. "Loading a program onto someone else's computer without their authorization is patently illegal."
"Yikes! That is clearly a wiretapping violation," Chris Hoofnagle, associate director of the Electronic Privacy Information Center, said when told of Lover Spy.
"It sounds a lot like a commercial version of Magic Lantern, the controversial program the FBI proposed a few years ago to remotely install a keystroke logger on the computers of people under investigation, he said.
Other spyware exists, such as eBlaster from Florida-based SpectorSoft, but it is installed manually and marketed for customers to install on their own computer, Rasch said.
"Typically, you have a husband or wife who puts a keystroke logger on the home PC to monitor what Web pages the spouse is going to and what e-mails they're sending," he said.
However, even installing a spyware program on your own computer may be illegal if it is recording the data of someone else without their consent, depending on the state in which the spying occurs, Hoofnagle said.
Not only could the Lover Spy company be prosecuted for selling software that enables spying, but the person who pays for the service could face up to 10 years in prison and fines for actual damages under the federal Computer Fraud and Abuse Act, Hoofnagle said.
Web sites that surreptitiously send programs to a visitor's computer are an increasingly security menace, said Chris Wysopal, research director at security consultancy @Stake in Boston. "The risk has always been there. But when the tools are really easy to use, you are going to see more spying going on," he said.
The only defenses are antivirus software, which may be able to detect the spyware, and a personal computer firewall which can alert a person when the Trojan tries to connect to the Internet to send data out, according to Wysopal. People should be cautious about allowing Web sites to run unknown code on their PC, he added.
Story Copyright © 2003 Reuters Limited. All rights reserved.