Month: June 2005

Dave Morgan makes an interesting post on Online Media Daily.

It’s pro the Grokster ruling (but he has an interesting viewpoint as to why). 

One example:

“File-sharing services have inflicted harm for money. While most of the attention file-sharing services have garnered focused on how they helped consumers bypass the out-dated business models of the recording industry, little attention has been paid to their involvement in the development and growth of the spyware and adware industries. For those that may not have been aware of this, a majority of the spyware and adware downloads that have occurred over the past several years were “bundled” with file-sharing software and with virtually no awareness on the part of the consumer. For this, the file-sharing services have received tens of millions of dollars. File-sharing services are not Don Quixotes, they have been making lots of money. As a result of their efforts, we have tens of millions of spyware applications infecting computers and dozens of bills in Congress and state houses trying to remedy the file-sharing caused spyware problem. Do you think that it’s a coincidence that the leading anti-spyware bill in Congress was sponsored by Sonny Bono’s widow? “

Alex Eckelberry

Rumor has it that Microsoft is in talks to buy Claria. (Also, Microsoft Watch tidbit here)

How many times in the dozens of acquisitions that Microsoft has made has there been any advance rumor? Answer? Never, at least to my knowledge.

I have been on the far outside periphery of two of their recent acquisitions, Sybari and Giant Company. The secrecy surrounding these acquisitions rivals the internal machinations of the NSA. So secretive, in fact, that they didn’t contact Giant’s closest partner (Sunbelt) prior to the acquisition of Giant Company (which we do understand).

One of our speculations is that the rumor is a trial balloon, done only to quell an internal debate at Microsoft. Maybe this one was leaked on purpose. There were internal battles in MS about the idea of buying Claria, and someone internally said “let’s leak this, and see what the audience reaction is”. In other words, are they just testing the waters?

Or, quite possibly, it’s pure fiction. I really can’t get my mind around why Microsoft would want to buy a company that makes software that generates pop-ups.

Alex Eckelberry

According to a recent survey by SurfControl, computer misuse by men causes a surge in spyware on office PCs. Read an article here and here.

The survey of 300 men and women showed that male workers consistently made more regular use of the online facilities and PC technologies that often act as the source of malicious threats.

SurfControl asked office workers how frequently they made use of programs most likely to be a threat.

While men are more than twice as likely to use USB ports and to run CD-Rom and DVD media daily, they are three times more likely to download free software everyday in the office.

Programs which could install spyware on office computers include:

–Personal instant messaging and web-based e-mail
–Downloading and swapping free video and music files
–Playing online games, recreational surfing
–Downloading free software
–Using removable media such as DVD, CD-Rom and USB flash drives

180 Solutions is sending out 20 million notifications to users.

180’s official PR here.

Here is what the notifications look like (apparently delivered in a popup):

Click to enlarge

Click to enlarge
(Thanks Ben Edelman for the pics).

The blogsphere gets busy.

Ben Edelman writes about it here.

Suzi at SpywareWarrior.com writes here.

PaperGhost writes about it here.

Alex

So the major news yesterday was that Grokster lost.

This puts the industry into a bit of a quandary.

The Justices said that Morpheous and Grokster crossed the line as they were (effectively) promoting their networks as ways to pirate software.

Good news is that the Justices didn’t negate the Betamax defense (referring to the 1984 decision in which the movie industry tried to stop sales of home video recorders as they were potential vehicles for copyright infringement).

However, while Betamax might still be a valid defense, this is still chilling for technology. Would a brilliant inventor such as Bram Cohen of Bittorrent have started his project in the first place? Would VCs put money into a company in the p2p space, because of the specter of litigation might tie up the company’s resources for the future?

Dow Jones Venture Wire this morning had this to say:

Timberline Venture Partners, which has invested a rather risky $10 million in Streamcast, believes it’s too early to tell the fate of companies like Streamcast. “We have to wait and see,” said William Killman, general partner with Timberline Venture Partners. “I wouldn’t jump to a conclusion. To me, it doesn’t seem to clarify much of anything. A new more confusing inducement test has been added.” Still, experts said the decision could affect product development at technology companies, and seriously affect how the companies market their technology.

That last sentence pretty much sums up the issue.

I can’t blame the Justices. These p2p companies DID promote their networks as ways to pirate music, and that was definitely wrong. I wish the industry had just gone after that fact, rather than effectively indict the whole p2p space.

However, p2p is a very powerful technology, that has the reality of completely overhauling the dynamics of sharing data on the net. Remember that many of the great technologies we have today come from some shady past. Heck, the popular internet of today was practically built on porn, as was the VHS industry.

The idiocy is that back in ’84, the movie companies were suing Sony because a VCR could be used to record. Then they proceeded to go into a sales hyperdrive simply because of the VCR. Who actually used the VCRs to record? Plenty of people, but not enough to offset the huge boom in VCR sales.

They are, simply, idiots. I grew up in Hollywood. The entertainment industry is full of people who have spent too much time mingling with beautiful people and networking at Spago to actually realize the digital revolution that hit them.

(Ok, ok, I know there’s lots of smart, technology hip people in the entertainment business, but I’m trying to make a point here, people.)

Borland, where I worked in the 80s, started a revolution by blowing out copyright protection, and charging a fair deal for their software. Until Borland, there was copy protection and you couldn’t buy a copy of Pascal for less than $500. Borland changed all that. They opened up new markets — whole new publics that could never have afforded the technology before.

Look what’s happened to the DVD market. My wife and I just buy DVDs rather than rent them. Why bother renting anymore? For $20 you can get the DVD and it becomes part of your library. It’s a great value.

So the luddites in the entertainment industry, so intent on protecting their shrinking domain, have actually won something. Good for them. They can all go celebrate at Spago.

Alex Eckelberry

Major news. Unaminous ruling against Grokster.

Justice Souter’s opinion. Well worth reading. Justice Ginsburg and Justice Breyer concurred.

If you haven’t already, take the “test” at Paperghost’s blog and see “where you fit in the adware battle”.

Dave Bove
Spyware Research Manager

Some will wonder why I bothered to write this blog entry. Well, I guess it’s my sometimes obtuse sense of fairness.

Earthlink is swapping out WebRoot’s spyware protection with Aluria’s.

Earthlink says the Aluria technology is superior.

David Moll’s WebRoot disputes this, saying that Earthlink was “trying to buy a Porsche on a budget.”

Guess what? WebRoot’s right. WebRoot’s technology is some of the best in the business. Why give away quality in exchange for virtually nothing? These ISP deals are awful economically, but some would argue the good PR of partnering with an ISP. But WebRoot (and many other antispyware companies) are flourishing just fine without the PR.

The math is pretty grim on these deals. Most ISP deals are pennies per user per month, but you generaly only get paid for the users who actually sign up, which is about about 20% (of the total user base).

We’ve seen that time and time again. ISPs go for the cheapest possible solution. However, it gives them a great marketing pitch that they can blast out on mass media.

Alex Eckelberry

Eons ago I blogged on newer a style of scam from a company called “Grambest International”. You can see the blog here.

It was a quickie blog which I put together, and I moved on, promptly forgetting about the whole thing.

Today, out of curiosity, I checked what search terms were being used to get to the site. What was the one of the top ones? Grambest International. People are obviously getting the letter, and then searching for the company, and finding our earlier blog.

It is good to see people using Google to check on a potential business partner. It also highlights that these fraudsters are pushing up their efforts to lure innocents in to their scams.

Here’s what’s incredible to me. This thing is an old spam. But the email addresses in that spam are STILL ACTIVE. I can’t believe they have not been turned off. I sent an email under an assumed name and got this nice reply:

Dear ….:

Thank you very much for your response and your interest in this transaction. You should have nothing to worry about as there shall be no financial requirements from your side.

This is how it works, all our customers within your locality (USA, CANADA and UK as the case may be) will be directed to you for payment. Note that they pay in cheque and your work as our representative is to cash this cheque, deduct the 10% from it and the balance made payable into our designated account that will be sent to you later.

However, you are to provide us with your contact details stating your full names, postal/residential address and your phone number. This details will be given to our different customers for the necessary contact for payment. And you will also be required to send any form of identification, either a work ID or an international passport if any. We need this to enable us have complete congnizance of whom we are dealing with.

We hope to hear from you as soon as you receive this correspondence.

Thank you.

Sincerely,

Mr William Mark
President.
+447040112294

Friends in the UK? Don’t hesitate to report this criminal to the appropriate authorities…

Now here’s what’s crazy: A few weeks back, I got a fraud email. Inside the email, was an email address to contact for “further details”. I notified the ISP that was hosting the email account that this person was a fraudster. Note that the email itself was not from the ISPs network. But the email address within the email was on the ISPs network.

They just couldn’t figure it out. Wouldn’t go into their automated abuse systems. For all I know, that email address is still active. So the ISP has, by their robotic automated forms, allowed this scam to continue and, in my eyes, are culpable in the continuation of the scam.

Why aren’t the ISPs cracking down on this junk?

Alex Eckelberry

Our good friends at Cloudmark (we use their antispam engine in our enterprise product) have a great antiphishing tool (free beta). Click here and look for the Anti-Fraud toolbar.

In the future, we will probably put this toolbar into our Dell bundles as a freebie as well.

Alex Eckelberry

In keeping with the zeitgeist, the FTC just issued a big report on P2Ps.
It is a follow-on from their workshop in December.

Briefly:

• Consumers face risks when using commercial P2P file-sharing software programs, including risks related to data security, spyware and adware, viruses, copyright infringement, and unwanted pornography.

• There was little empirical evidence submitted in connection with the workshop, however, addressing whether these risks are greater with P2P file-sharing programs than with other Internet-related activities such as surfing websites, downloading software, and using e-mail or instant messaging.

• The report makes recommendations concerning what industry and government should do to decrease the risks associated with the use of P2P file-sharing programs.

• Industry should engage in technological innovation and development, industry self-regulation (including risk disclosures), and consumer education.

• Government should investigate and bring law enforcement actions when warranted, work with industry to encourage self-regulation, and educate consumers about the risks associated with using P2P file-sharing software.

Alex Eckelberry
(Thanks to BeSpacific

Earlier we blogged somewhat confusedly about a new “certification” available from an antispyware vendor. This is always scary, it’s memories of WhenU all over again.

More data is on the PC Tools site here.

Here is the text:

“PC Tools certification of software as “spyware free” is subject to the following limitations and disclaimers:

The Spyware free certification awarded by PC Tools is based upon PC Tools own internal testing, information provided by the relevant software publisher and PC Tools own definition of what constitutes spyware.

The certification of software as spyware free only applies to the version of the software submitted to PC Tools for testing and is based upon information provided by the relevant software publisher at that time. PC Tools is not responsible for software publishers adding extra functionality or spyware to their software following PC Tools testing. PC Tools does not continually monitor software publishers’ products to determine whether they are spyware free.”

What possible reason could there be to “certify” anyone adware or spyware safe, especially when this certification is only for a current version?

Let me say clearly that it is a policy of this blog not to practice petty sniping at competitors. PC Tools makes a good antispyware product and Simon Clauson and his crew are a really nice group of people.

However, spyware certification is a dangerous, slippery slope. I hope they change their mind on this policy, for the good of the antispyware industry as a whole.

Alex Eckelberry
(Thanks Eric)

“Critical MS vulnerabilities could pose spyware threat“

FTC goes after Trustsoft for marketing SpyKiller deceptively.

Spykiller is listed on the SpywareWarrior Rogue/Suspect list

A visit to their website reveals this message:

Click to enlarge

The FTC alleges that Trustsoft:

• Aggressively and deceptively marketed SpyKiller, using the Web sites of affiliates, banner and pop-up ads, and spam.

• Sent pop-up and e-mail messages informing consumers that their computers had been remotely “scanned” and that spyware had been “detected” even though they had not performed any such scans.

• Used marketing materials that urged consumers to access the SpyKiller Web site to get a “free scan” for spyware. While the SpyKiller “scan” was running, the program displayed a status report entitled “Spyware Found on your PC:” that included a category called “Live Spyware Processes.” In fact, this category deceptively identified anti-virus programs, word processing programs, or any of the processes running on the system as spyware. Then, even thought the “scan” itself was free, consumers had to pay roughly $39.95 to enable SpyKiller’s “removal” capabilities.

• Used marketing materials that promised that SpyKiller would find and remove “all” spyware, including “all traces” of particular spyware on consumers’ computers. However, the FTC alleges the software failed to remove significant amounts of spyware, including specified spyware defendants claimed on their Web site to remove.

• Used spam messages promoting the SpyKiller software that contained similar deceptive claims, failed to identify themselves as advertising, used false “from” lines, gave no valid postal addresses, and failed to provide consumers with notice of and the ability to “opt-out,” in violation of the CAN-SPAM Act.

Alex Eckelberry

Press release here.

eMarketer always does nice high-level overviews of various issues. This latest report from them highlights the spyware issue. Read it here.

All materials copyright eMarketer, Inc.

From this article:

“In the recent survey, respondents rated critical security threats. The results include viruses and worms, a 7.6 rating (“1” indicated “no concern at all,” while a “10” meant “extremely concerned”); outside hacking or cracking, 7.1; identity theft and phishing, 7.0; spyware, 6.8; denial of services, 6.6; spam, 6.3; wireless and mobile device viruses, 6.2; insider threats, 6.2; zero day threats, 5.9; social engineering, 5.9; and cyber-terrorism, 5.6.”

Incredible writeup by Dave Methvin of PC Pitstop

PaperGhost writes on it.

By the way, no one here is saying that Bittorent is distributing adware. Bittorent isn’t doing anything. It’s doing what it’s supposed to: Allowing the distribution of files. What the big hullabaloo is over is that network that was fairly pristine has been compromised by unscrupulous types for the distribution of adware.

Alex Eckelberry
(Thanks PaperGhost)

(See earlier blog if you don’t know about the Bittorent thing.)

This is a rather hackneyed argument. It goes like this: “It’s not us, it’s a rogue distributor“. Really? So who pays the “rogue distributor”? It’s not like MetrixMarketing was alone. They work directly with software developers, after all (from their website: “We work with software, freeware and game developers to market and distribute products to highly targeted end users”).

Besides, blaming the intermediary in the adware game is a lame argument. See, we live in an age of technology. The software (since it is adware, after all) actually has to go back to a server at the adware company to get its instructions. Since an adware company might have problems with a “rogue distributor”, why can’t they put something in place programmatically, to make sure people really want their stuff?

The answer, at least to me, is obvious. Maybe they just don’t want that to happen.

You know, I would actually be much happier (really, I mean this, totally honestly) if the adware vendor said “we know people don’t really want our stuff on their system, so we’ll publish a code of conduct but turn a blind eye to this kind of behavior, and when others find out about it, we act enraged and pull the plug, blaming the distributor for violating the code of conduct“.

Adware vendors become disliked when they patronize reasonably intelligent people with whitewashing.

So we hear: “The minute we heard about it, we (valiantly) stopped this distribution“. Why does it take people like PaperGhost to police the adware business? Heck, if these guys all care so much about it, just hire a couple of full-time guys to troll downloads from the distributors and side-check the distributions.

Adware vendor’s counterargument: “There is no way we can police so many distributors.” Ok, then at the least, police the high risk channels like P2P. A couple of researchers can spot-check a few hundred distributors every day. We’re talking cheap, too.

You know, I have a large team of people trolling adware distributor websites every day. We cover tons of installs. It’s not hard to find the sites. For us, it’s harder to create the stuff that actually gets rid of the installs. And adware vendors at least know where their stuff is located.

And on a final note: Why is the problem of “rogue distributors” only relegated to adware? Why don’t we see it with legitimate free products, like the Google Toolbar? Well, umm, there’s money involved. Distributors get paid for installs, so they’ll go to any means to get adware on a system.

And another final, final note: All the people getting excited about the Spy Act, read this from the DR release: “We support efforts designed to create national standards for the entire online media industry, such as the federal Spy Act now before Congress whose provisions we have already adopted.”

Gives me great confidence in this legislation.

Alex Eckelberry

What is it about Fathers and Daughters on the internet? In our family, it is always my Dad who gets all the spyware (my sister hardly gets any). In others, it is Daughters. Here are some examples:

– From the Good Morning Silicon Valley Blog: John Paczkowski attributes the following quote to Intel CEO Paul Otellini at the All Things Digital Conference, “Sure, I could get a Mac, but the time I spend with my daughter removing spyware is very precious.”

– Our own Alex Eckelberry (The Blog Machine) has talked about how he has had to clean-up spyware downloaded by his daughter.

– Recently, I was speaking with a local radio talk-show host, Dave Gerber from bitsandbytesradio. He told me he had just spent a good amount of time cleaning spyware off his daughter’s machine.

– Wayne Porter, on Revenews, mentions how his daughter is at risk in her search for games.

– Also from Revenews, they talk about “Mr. Boser, a Spammer, stating that he despises viruses and adware and told a story about how his daughter’s computer was ruined by adware.”

– At the CNET Spyware Workshop, one of the top executives at a major Adware company stated that his daughter had really trashed their computer at home because she had a Spyware infestation. Of course, there is no irony in the world, because he then went on to complain about how the anti-spyware companies couldn’t clean the spyware off their machine.

Notice this affliction is not limited to Hardware People, Software People, Media People, Anti-Spyware People, Spammers, nor Adware People. Everyone’s daughter is getting it.

Inappropriate Sites?

I asked my 70+ year-old Dad, in as stern a tone as I could muster, if he had been to any “inappropriate sites”. His response is unprintable, but I believe him when he said he was just doing “normal” internet tasks. The same can be said for most people’s daughters. It is Smileys and E-cards and other fairly benign activities, yet the infestation happens. For my Dad this is almost forgivable, but it really bugs me that these same types of activities happen to children. Ben Edelman has a ton of info about how this is often happening to children (this link is one of many).

What do we do?

Maybe we should just have a rule that no Father or Daughter should be able to use the internet? I tried that one on my Dad and his response was something about “ungrateful children”. So instead, I had him implement a set of prevention steps, like the ones posted in the Protection Section at Spyware Warrior (obviously for the anti-spyware scanner, I had him use our own product).

Daughters and “Other” Children

What would I recommend for people with daughters and “other” children? Unfortunately, until something is done about the firms that are taking advantage of children, there is little more that we can do except the same type of prevention steps mentioned above, and a lot of education from the parents. We can not expect these firms to see the light, so hopefully my team will continue to find these programs and our product will continue to remove them.

Dave Bove
Spyware Research Manager