Riskware: What it is and how to protect yourself from it

What is riskware?

Because riskware can include seemingly trusted software, it’s often hard to spot and manage potential risks. However, understanding how riskware works can help you recognize these threats before suffering any speed or cybersecurity-related consequences.

How does riskware work?

In short, riskware exposes your system to potential cyberattacks. While software usually doesn’t have the intention to cause harm to the user, its vulnerabilities and misuse of user data can make it susceptible to malicious users, making the software a riskware.

Riskware can leave users and systems vulnerable due to program misuse, data breaches, blatant abuse of privacy, or illegal attempts to modify programs. Typically, riskware works in three steps.

1. Users download seemingly trustworthy riskware.
2. Cybercriminals infect the vulnerable software.
3. Devices become vulnerable to data leaks and malware.

Types of riskware

You can encounter numerous types of riskware (including adware and spyware) while using the internet. Depending on their vulnerabilities, they can cause identity theft, personal data loss, stolen financial records, and threats to internet privacy. Some experts classify five main riskware types: monitoring software, vulnerable software, terms of service (ToS) breaching software, law-violating software, and malware-accessible software.

Monitoring software

Monitoring software can refer to tools like screen recorders or employee monitoring software. When compromised, monitoring software can pose risks such as sensitive information leaks (for example, user’s location) or employee keystroke theft.

Vulnerable software

Vulnerable software allows cybercriminals to access users’ sensitive data. The scope of such riskware is vast and often includes free services such as fraudulent copies of licensed paid services (for example, an MS Office package) or free proxy servers. Since free services rarely employ constant and effective security updates, using them can pose a huge risk of falling into the hands of malicious users.

ToS breaching software

Using software that breaches other software’s terms of service is a riskware practice. In simpler terms, if you use tools, such as remote access programs or cracking software, you may falsely authorize the use of illegally obtained software. Such breaches can cause lawsuits and potential cyber threats, with the exception of the use of these services to obtain owned content (via remote access software) or in cases of ethical hacking (while using cracking software).

Law-violating software

Some software providers may break rules or tread a thin line when operating within laws and regulations. These include piracy software (illegal file downloaders) and surveillance tools that violate rules and regulations. Using such a service makes its users susceptible to criminal charges and puts their cybersecurity at risk.

ToS breaching software

Installing bundled software can be a direct path to malware-accessible software. While most service providers offer reliable program bundles, some may include potentially unwanted programs from third-party providers. Opting out of installing suspicious-looking bundle apps and carefully reading service privacy agreements can help you protect your computer from potential malware.

Riskware examples

• The Remote Desktop Protocol helps many companies and employees get remote technical support. However, users with malicious purposes can try to exploit an already existing remote access app and turn it into a gateway to your device. They can also try to use this legitimate app and install it on your device through other means. The antivirus won’t pick up on it, and the hackers can use it as effectively as malware.
• File downloaders are stealthy programs that don’t contain computer viruses, so they usually bypass antivirus software scans. Their primary purpose is to connect to the internet and download other programs.
• Operating system patches optimize our devices’ performance and stop hackers from finding and exploiting new vulnerabilities. However, some patches can lead to more problems than before. For example, Apple once fixed an iOS security bug that made people’s phones more vulnerable to jailbreaking and hacking. This doesn’t mean you shouldn’t download updates, but you should follow news about your devices to ensure you’re aware of any inadvertent risks.
• Other riskware includes internet relay chat (IRC) clients, dialer programs, password management utilities, computer activity monitoring software, auto-installers, and Internet server services – such as FTP, web, proxy, and telnet.

How to spot riskware

Spotting riskware may be challenging. However, you can start getting suspicious if you notice any of the signs below.

• Unknown software. If you find unknown running programs on your computer, it could be a sign that you’ve got some riskware.
• Limited permissions. Even if the software came pre-installed on your device, you should be able to control its permissions. Make sure none of the apps have unnecessary access to your device.
• Inability to remove software. If you try to remove software and it keeps coming back (or does not allow removal in general), it strongly indicates that your system might be compromised.
• Legacy software. If the developer no longer supports the software, any vulnerabilities it may have won’t be fixed, and continuing to use it will be dangerous.
• Authorization of illegal activities. If the software allows you to perform illegal activities, it’s a riskware.
• Breaching of ToS. If the software breaches its terms of service in any way, shape, or form (for example, it can access files and data not included in the software’s privacy agreement), you should treat it as a riskware.

How to remove riskware

You must act quickly and cautiously if you notice suspicious or risky software on your computer. Follow these steps to remove the riskware as soon as possible.

1. Uninstall risky software. This is the most obvious and crucial step. Keeping riskware running can expose your computer to cybercrime, so, if possible, try to uninstall any suspicious software immediately.
2. Run an antivirus program. It will help you detect, remove, and prevent riskware, including various forms of malware, such as trojans and other viruses, and reduce cybersecurity threats.
3. Take additional precautions. If you’ve never heard the term “cyber hygiene” before, now’s the time to get into it – be sure to back up important data, change your passwords if compromised, use features such as NordVPN Threat Protection Pro, and otherwise improve your cybersecurity practices.

How to protect your devices from riskware

• Use reliable service providers. Only download programs from reputable sources and update them regularly. To minimize the risks, use Windows Defender real-time protection or an antivirus. These will notify you if and when someone is getting unauthorized access to your device.
• Perform regular system inspections. Few antiviruses can detect riskware because they are supposed to be used for legitimate purposes. However, you can try premium antiviruses or third-party malware-detecting software that may be able to detect riskware. Regularly check the files and programs installed on your device – If they are outdated, acting strange, or you don’t remember downloading them, consider deleting them.
• Keep an eye on the latest information. Follow news about the devices you use — sometimes, a new patch or update accidentally opens up a loophole for cybercriminals to exploit. If you know about it, you can take action to prevent it.
• Discuss riskware with your employer. Once you detect riskware, you need to decide whether the risks it presents can be controlled and mitigated or whether it needs to be removed. For example, you may not want to delete remote access software that your employer has installed on your work computer. If you become aware of any security vulnerabilities, you can discuss them with your employer and act accordingly.
• Always read the terms of service carefully. Software’s terms of service can help you understand the liberties, risks, and limitations of its use and make it easier to notice potential risks.
• Keep software permissions as low as possible. Fewer permissions mean less access to your data, so if they’re unnecessary, keep them to a minimum.
• Carefully read software prompts when installing them. As previously mentioned, some software can include additional third-party tools, which may prove to be riskware. Checking installation prompts and removing unnecessary tools will help you ensure you’ve installed only the necessary software.
• Create a secondary account for non-admin use. There is a saying: “Two heads are better than one.” In cybersecurity this can translate as “two separate accounts are safer than one” because it allows you to back up important data and provide better risk management.
• Avoid software that asks for a lot of permissions. Software that asks for too many permissions (especially those not mentioned in ToS or related to sensitive data) can be considered riskware. Avoiding such tools can help you feel safer about your cybersecurity.