CWE-512 间谍软件

Spyware

结构: Simple

Abstraction: Base

状态: Incomplete

被利用可能性: unkown

基本描述

The software collects personally identifiable information about a human user or the user's activities, but the software accesses this information using other resources besides itself, and it does not require that user's explicit approval or direct input into the software.

扩展描述

"Spyware" is a commonly used term with many definitions and interpretations. In general, it is meant to software that collects information or installs functionality that human users might not allow if they were fully aware of the actions being taken by the software. For example, a user might expect that tax software would collect a social security number and include it when filing a tax return, but that same user would not expect gaming software to obtain the social security number from that tax software's data.

相关缺陷

• cwe_Nature: ChildOf cwe_CWE_ID: 506 cwe_View_ID: 1000 cwe_Ordinal: Primary

• cwe_Nature: ChildOf cwe_CWE_ID: 506 cwe_View_ID: 699 cwe_Ordinal: Primary

常见的影响

可能的缓解方案

Operation

策略:

Use spyware detection and removal software.

Installation

策略:

Always verify the integrity of the software that is being installed.