CWE-512 is a product that collects personally identifiable information about a user or their activities, accesses it through resources other than itself, and does not require the user's explicit approval or direct input.
How it happens
MITRE notes that spyware has many definitions. In general it means software that collects information or installs functionality users might not allow if they knew. The example MITRE gives: a user expects tax software to collect a social security number, but would not expect game software to pull that number out of the tax software's data.
Code like this can be written on purpose, or arrive through a third-party library, SDK or plugin whose collection you never reviewed.
What an attacker gains
The consequence MITRE lists is a loss of confidentiality: application data is read by a party the user never approved.
How to find it
The record lists no detection methods. In practice, review what each dependency and SDK accesses, check outbound network traffic from a test build, and compare real behavior with your privacy notice.
How to fix it
- At install time, verify the integrity of the product being installed.
- In operation, use spyware detection and removal software.
- Before release, review third-party code for data access that your product does not need.
Quick check
What separates spyware from a normal data feature?
It takes data through other resources, without the user's explicit approval or input.
