I'm learning about different types of viruses, and one category of virus is "crimeware." I read the wikipedia page for crimeware, and to me it seems that crimeware is just a specific usage of spyware.

Is there anything different in the design of crimeware that makes it different than spyware? Is there anything a network administrator needs to know specifically to defend against crimeware that isn't included in plain-old spyware?

  • For certain data 'intent' won't matter (speaking from US jurisdiction). If you collect data protected by HIPPA, FERPA, Financial/Payment, etc. that you are not authorized to have, it would be considered a crime regardless of whether you 'intended' to collect it.
    – K.B.
    Feb 1, 2018 at 19:43

2 Answers 2


First things first, you are slightly misusing the term Virus and since you said you wanted to learn I mine as well teach a little extra.

If you imagine types of malicious software as a tree, the very top of the tree (root node) is malware. Basically its the words malicious software gelled into one word. A virus is a form of malware that is defined by the way it re-produces. Viruses are defined as a virus because they can transfer themselves from host to victim in almost anyway including over a USB stick, email, internet, program download etc. and is a very generic term.

I read the wikipedia page for crimeware, and to me it seems that crimeware is just a specific usage of spyware.

You are correct, what defines crimeware is exclusively the intention the attacker has for creating their malware. For example, a Trojan horse could be crimeware. The Trojan is the delivery mechanism (Hey look at this super cool flashlight app! Wow, so cool. Why does it need Internet permissions and file permissions? Ah don't worry about it.) but the real reason for creating this flashlight app you can only download off a third party website is because it is a Trojan horse delivery mechanism for some crimeware key logger. The flashlight app may contain a key logger that transmits back to a command server it's findings including all the passwords you type in.

This of course would be different than a Trojan horse flashlight app who's end goal it is to encrypt your entire phone's drive and demand ransom (Ransomware).

Crimeware is just a spin-off of Spyware and I imagine (although I have not first hand analyzed examples for comparison) that Spyware and Crimeware are near identical in how they are written, but may be delivered and behave slightly differently as they have different goals. For example, Spyware includes things such as watching people on their webcams whether that be for corporate espionage or for perverted reasons, you choose, both exist.

Is there anything a network administrator needs to know specifically to defend against Crimeware that isn't included in plain-old spyware?

I would say no, not really. Crimeware is just a more tailored, targeted type of Spyware and the same sort of precautions should protect you. Keep un-needed ports closed, do not download un-trusted files, be careful with phishing emails, avoid putting potentially infected USB's in company computers and keep personal devices off the network.

  • I just want to say that viruses can be non-malicious, and I don't agree with the wikipedia definition.
    – user169799
    Feb 1, 2018 at 21:54
  • @safebookverified I am not even kidding are you just going to every single one of my answers and complaining? Every answer I posted today has you disagreeing with me on it. In response: I did not use the Wikipedia definition anywhere and by definition anything that replicates across computers without a users knowledge or consent is malicious. See: arstechnica.com/information-technology/2014/06/… . Twitter worm was notoriously good at proving its ability to replicate without causing real damage. Still considered malware
    – dFrancisco
    Feb 1, 2018 at 21:58
  • 1
    @dFrancisco No but I only found out about this security stackexchange 2 hours ago so I'm going through all of the interesting ones, and you have a lot of top answers. This one I didn't even notice it was written by you until after I posted my comment.
    – user169799
    Feb 1, 2018 at 22:05
  • @Yez Side note, if you like the response and believe it properly and thoroughly answered your question feel free to "accept" the answer (checking the check mark below the vote counter because a.) Future people who stumble onto question know this answer was best answer and b.) I get 15 rep for it :) haha
    – dFrancisco
    Feb 1, 2018 at 22:06
  • @safebookverified Fair enough, was honestly curious since I rarely have so much interaction on my answers.
    – dFrancisco
    Feb 1, 2018 at 22:07

I'd say there's a lot of overlap there. Crimeware implies that a crime has been committed; the legality of spyware, and specifically what data that spyware is collecting, will vary by jurisdiction, and whether a user agreed to a UELA (knowingly or otherwise) when it was installed. If the spyware was installed without user consent, then it would almost certainly be crimeware (Computer Fraud and Abuse act in US)

If spyware is collecting bank logins, health records, or anything like that, I'd guess it'd be considered crimeware pretty much anywhere, regardless of what UELA the user agreed to. CFAA includes passwords as a protected data class.

However, if a user agreed to a UELA, and the spyware is collecting non-protected data (browsing history, application usage, etc.) then it might not technically be crimeware; obviously scummy, but possible not illegal. Additionally, corporate monitoring software might technically count as spyware (some employees would almost certainly argue as much) but since it is on the computer with the knowledge and permission of the owner, there's no crime be committed (as long as they're not collecting protected info on employees, again, varies by jurisdiction).

In short while most spyware probably falls within the scope of crimeware, it is not inherently so. From an admin's perspective there isn't much of a difference, you don't want unauthorized code running on your systems; defiantly not worth the time to find out "what data is this actually exfiltrating".

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .