Adware

Mac users who practice unsafe hex will find more than they bargained for.

From Intego:

Exploit: OSX.RSPlug.A Trojan Horse
Discovered: October 30, 2007
Risk: Critical

OSX.RSPlug.A Trojan Horse Changes Local DNS Settings to
Redirect to Malicious DNS Servers

Description: A malicious Trojan Horse has been found on several pornography web sites, claiming to install a video codec necessary to view free pornographic videos on Macs. A great deal of spam has been posted to many Mac forums, in an attempt to lead users to these sites. When the users arrive on one of the web sites, they see still photos from reputed porn videos, and if they click on the stills, thinking they can view the videos, they arrive on a web page that says the following:

Quicktime Player is unable to play movie file.

Please click here to download new version of codec.
After the page loads, a disk image (.dmg) file automatically downloads to the user’s Mac. If the user has checked Open “Safe” Files After Downloading in Safari’s General preferences (or similar settings in other browsers), the disk image will mount, and the installer package it contains will launch Installer. If not, and the user wishes to install this codec, they double-click the disk image to mount it, then double-click the package file, named install.pkg.

If the user then proceeds with installation, the Trojan horse installs; installation requires an administrator’s password, which grants the Trojan horse full root privileges. No video codec is installed, and if the user returns to the web site, they will simply come to the same page and receive a new download.

Intego Press Release

Sunbelt Blog: Screenshot
Commentary: Mac trojan overhype? You tell me.

Well, we knew it was coming, Apple users may get hit hard now if the malware gangs are targeting.

Vnunet.com UPDATE: McAfee has confirmed the OSX.RSPlug.A trojan and reported that it is spreading through fake codec sites in addition to the porn website.

{ 0 comments }

Posted on its home page and giving no reason for the sudden closure.

Best Offers and Direct Revenue have ceased operations. To service legacy consumers we are maintaining this page of uninstall instructions, an uninstall software tool, and an email based support service.

By most accounts DirectRevenue made a lot of money off unsuspecting users.

{ 0 comments }

TechCrunch reported today that Zango has purchased Smart Shopper Networks, a browser based comparison shopping engine previously owned by New York based HotBar Inc.

Alex Eckelberry: So what’s the motivation behind Zango’s acquistion of SmartShopper?

It’s worth noting that Zango is primarily gaining new users through Seekmo, its porn branch. In other words, new user acquisition occurs from users downloading porn in exchange for free ads, not for funny videos of a cat jumping up and down. They need everything they can to gain legitimacy.

{ 0 comments }

Press release October 1, 2007.

Trojan Program Downloaded Spyware, Adware, Porno Pop-Ups to Consumers’ Computers
Operators who infected more than 15 million computers with destructive, intrusive spyware will give up $330,000 in ill-gotten gains from their venture to settle FTC charges that their scam violated federal law. The settlement will bar the defendants from downloading software onto consumers’ computers without disclosing its function and obtaining consumers’ consent prior to installation, bars them from downloading software that interferes with consumers’ computer use, and bars false or misleading claims.

Full Article

{ 0 comments }

Zango’s court case against Kaspersky has been thrown out, because Kaspersky has immunity as a result of the Communications Decency Act.

The decision can be seen at Ben Edelman’s site. (PDF)

Ben has also updated his list of legal actions: Threats Against Spyware Detectors, Removers, and Critics

{ 0 comments }

Among the allegations:

• Widespread Zango “ActiveX” Installations without Unavoidable, Prominent Disclosure of Material Terms (XP SP1 and Earlier). Details.

• Widespread Zango Banner-Based Installations without Unavoidable, Prominent Disclosure of Material Terms (XP SP2). Details.

• Ongoing Zango Installations with No Disclosure Whatsoever. Details.

• Unlabeled Zango Ads - Toolbars, Desktop Icons, and Pop-Ups. Details.

• Zango Ads for Bogus Sites that Attempt to Defraud Users. Details.

In my hands-on testing, Zango continues numerous practices likely to confuse, deceive, or otherwise harm typical users as well as practices specifically contrary to Zango’s obligations under its November 2006 settlement with the FTC.

Ben’s article and research: Zango Practices Violating Zango’s Recent Settlement with the FTC

{ 0 comments }

The House passed another cyber-security bill that would allow for civil penalties of up to $3,000,000. H.R. 964: Securely Protect Yourself Against Cyber Trespass Act or Spy Act.

Makes it unlawful for any person who is not the owner or authorized user (user) of a protected computer (a computer exclusively for the use of a financial institution or the U.S. Government, or a computer used in interstate or foreign commerce or communication) to engage in unfair or deceptive acts or practices in connection with specified conduct, including: (1) taking unsolicited control of the computer; (2) modifying computer settings; (3) collecting personally identifiable information; (4) inducing the owner or authorized user to disclose personally identifiable information; (5) inducing the unsolicited installation of computer software; and (6) removing or disabling a security, anti-spyware, or anti-virus technology.

Makes it unlawful for a person to: (1) transmit to a protected computer any information collection program (a program that collects personally identifiable information and uses the information to send advertising), unless such program provides notice required by this Act before execution of any of the program’s collection functions; or (2) execute any collection information program installed on a protected computer unless, before execution, the user has consented to such execution under notice requirements of this Act. Provides an exception with respect to Web pages visited within a particular website when the information collected is sent only to the provider of the website accessed.

Introduced by Rep. Adolphus Towns (D-New York), to protect users of the Internet from unknowing transmission of their personally identifiable information through spyware programs, and for other purposes.

Jun 6, 2007: This bill passed in the House of Representatives by roll call vote. The vote was held under a suspension of the rules to cut debate short and pass the bill, needing a two-thirds majority. The totals were 368 Ayes, 48 Nays, 16 Present/Not Voting.

http://www.govtrack.us/congress/bill.xpd?bill=h110-964

Other Bills with the Same Title.
108th Congress: H.R. 2929
109th Congress: H.R. 29

Technology & Marketing Law Blog:
Zango’s Busy Litigation Docket
PC Tools & Kaspersky Responses to Zango Lawsuit
Zango Also Loses Kaspersky TRO Motion

Vitalsecurity:
Rogue Security Applications Being Pushed On Myspace

Washington CEO Article

By Keith Smith, co-founder and chief executive officer of Zango Inc., an online advertising and media company.

Every company runs into obstacles. My company, Zango Inc., has encountered more than most.

Then we encountered an obstacle that threatened our existence. The third-party software distribution network we had established had to be dismantled. Some of these partners, despite contractual agreements, were defrauding us and, more importantly, harming consumers’ computers. Zango became the subject of a Federal Trade Commission (FTC) investigation. We had long since ceased our partnerships and, in some situations, had filed legal actions against these no-gooders, but we nonetheless worked cooperatively with the FTC, outlining steps to provide additional protection to consumers. In the end, we reached a settlement that stipulated a list of rules by which we must abide, almost all of which we had already implemented as part of our distribution and technology transition.

Hmmm….

Spyware Still Cheating Merchants and Legitimate Affiliates
Ben Edelman. May 21, 2007 - Updated, May 22, 2007