Slashdot Mirror
Market Research Company Secretly Installs Spyware
An anonymous reader writes "Forbes reports that two security experts are raising new questions about comScore, claiming that company's tracking software is being installed without consent on an unknown number of computers. The widely-used online research company takes screenshots of every Web page viewed by its 1 million participants, even transactions completed in secure sessions, like shopping or online checking. ComScore then aggregates the information into market analysis for its clients, which include such large companies as Ford Motor, Microsoft and The New York Times Co." From the article: "'[The] software is sneaking onto users' computers without the user agreeing to receive it,' says Harvard University researcher Ben Edelman, who documented at least ten unauthorized comScore downloads. Eric Howes, director of malware research at antivirus company Sunbelt Software, and his researchers separately observed hundreds of unauthorized comScore downloads in a three-month period this fall."
Is anyone going to do something about this?
Some justice,revenge,butt chewing,anything?
Do we write our congressman,DOS them or what?
all problems and no solutions.
It must be illegal on some level.
do we file a massive suit and each collect $5 or what?
*Repent!Quit Your Job!Slack Off!The World Ends Tomorrow and You May Die!
I'm sorry but monocultures and all that. I've given up warning people. It's their own responsibility to look after their computers? What they can't? Dearie me, that'll be hmmm, $$$ then.
Deleted
the previous story mentioned social justice in the headline... social justice here would be to have CD copies of their malicious software being rammed up their backsides "without their consent" so to speak...
Why is the DOJ worried more about aunt Eunice downloading MP3s than they are about people who are maliciously causing harm?
sigh, I'll write but I wonder if my representatives will actually notice...
Support NYCountryLawyer RIAA vs People
First, we have the NSA, DHS, et al target their illegal wiretapping programs at spammers and spyware makers. They've got the infrastructure to track these people down, and this is a justification for the programs everybody can get behind.
Second, when a spammer is caught, we ship them down to Gitmo. It doesn't matter, in this case, whether torture is an effective means of getting information. We don't need information from them, we just want them out of circulation. We can hope that it would be a deterrent, but really they'll be getting it for the simple reason that they deserve it. Republican/Christians get to torture and sodomize to their shrivelled little hearts' content, and we don't have to worry about damaging our reputation in the world community. Everybody's happy!
Gentlemen, there is no way that we can lose on this one!
Keep in mind when reading that by "unauthorized download" they don't mean copyright infringement, they mean that a third party installed ComScore software without *your* authorization.
I love it when the organization in question blames the distributors/staffers/private investigators:
"I had no idea Joey Three-Fingers would break you kneecaps. I merely asked him to follow up on some overdue accounts."
I want to proactively block any chance of getting caught by this. I just added this to my (Windows/XP HOME SP2) HOSTS file (C:\windows\system32\devices\etc\HOSTS):
I recognize this is but a start. I expect this has been investigated by others already. Rather than re-invent the wheel, I'm looking for some input on what else I can do to protect myself from them. (I already use ONLY firefox, and also have AVG, AdAware, Spybot, and WinPatrol)
Questions:
FYI: Wikipedia's ComScore Entry
The thing that really gets me is that their monitoring software installs a root certificate in the user's browser so that they can do a "man in the middle" attack to https:/// connections at their proxy servers. In many cases, comScore gets permission from end users to do this, but I don't think many users really realize how much information they're exposing by doing this. Most obvious is bank passwords, etc, but comScore says they don't monitor those. comScore DOES however say that they verify their user's name, address, income, etc., which I'd imagine most users wouldn't actually agree to if they were fully informed.
why the hell don't the cops show up at the company's door, break it down, and arrest everyone responsible and make sure CNN news crews are there to record it and make a story out of it. Then maybe these stupid, evil marketing people will stop thinking they can get away with it! It's called illegal for a reason. If they can arrest a guy for putting a distributed processing screensaver on school computers, they can arrest marketing execs!
Google's Super Secret Search Algorithm: SELECT @search_results FROM internet WHERE @search_results = 'good'
This isn't what the actual article says. It says "virtual photos". Most likely is that it's just collecting URLs.. and maybe the contents of the page.. There would be no reason to do screenshots... It would make things much more difficult to analyze.
-- these are only opinions and they might not be mine.
So what good is the Computer Fraud and Abuse Title Act 18 Section 1030 if the FBI will not enforce it?
"That's about as stupid as teaching abstinence only as the only way to fight STD's."
Well since they're called Sexually Transmitted Diseases, then yes abstinence (not engaging in SEX) is the one hundred percent way of avoiding STDs through that vector.
"People are doing it and kids will do it, so instead of closing your eyes and yelling "don't do it", you should at least show them how to use protection first."
And kids are bringing guns to school and shooting everyone. Maybe we should start them on some gun lessons, and practice at the firing range?
They have to install it on the computers of people who don't agree to it, because if they only monitored people who agreed to it, it would skew their results, because they'd be using self-selected samples! Think of the marketers!
I suffer from attention surplus disorder.
Just don't let it get too popular.
Information wants to be free.
Entertainment wants to be paid.
You just want to be cheap.
Download their software onto a 'tame' computer, and use it to browse 'interesting' sites.
Who would have thought that people who regularly view Ford's web site also like Goats ?
To be frank, the only software that will ultimately protect you is another operating system. Windows is fundamentally broken. Switch to Linux - or better yet, Mac OS X - and you will not only have a better internet experience, you'll have a better desktop experience overall.
-- thinkyhead software and media
Hi:
Yet another reason to own a Mac. No, I'm not being a snob, I just think that being able to screw over joe user who wants a computer that functions without hosing him is an entirely reasonable expectation.
I hope that some group or someone special takes the lead on this and not only goes after civil penalties but criminal penalties as well. I was to see someone in control of these decision sent to prison for their decisions to make this happen. I ALSO want to see the programmers and implementers of the methods used here sent to prison for their misdeeds.
I think there is a point that needs to be driven home into our culture that it's NOT okay to do anything for money. Because I believe that at some level we all somehow forgive these people for their tresspasses because their motivation was for profit... and we all understand the need for profit right? No, there are limits to what is acceptable behavior with a profit motive and like HP's spying (which arguably wasn't directly a profit motive but performed by a profit seeking competitive organization) we should not simply dismiss this as yet another "white collar crime" and move on. If people felt like they were risking more than a few hundred thousand of their millions of dollars, they just might think twice before ordering these things be done.
Maybe you're 12 and your time's worthless. Mine isn't and I now charge $$$ to fix computers. You don't want to pay? YeeHaw! Go away, fix it yourself then, or find some rather dim student who has nothing better to do. People have the right to privacy and surf the net unmolested, no matter the OS they use. Awww, how sweet. Welcome to the real world, not the idealised socialist one you have in your head.
Deleted
you should see what their ComeScore software does!
Flamebait? Maybe, but I personally think you are on to something there, though it has little to do with linux per se, but rather with that Ubuntu CD. What about it? It's a livecd. Use that, and you *will* be safe from even the most blatant user errors and the most malicious crackers (but not social engineering, sadly). Replace it once a year to be on the safe side.
Now actually, that would make browsing a mite slow. So maybe an install option where everything is mounted read-only? It might work.
This is of course only meant for the "I write email & browse the web" people. But those are the ones most likely to get hit by something like this.
Religion is regarded by the common people as true, by the wise as false, and by rulers as useful.
Windows users: when you use linux, a program that does just what you need is almost always just a few clicks away, is free, and doesn't have toxic junk like this attached to it. Usually linux comes with your choice of industrial-strength database servers and clients, web servers and scripting languages, a complete software development kit for the whole thing in dozens of programming languages, a choice of office suites and so much more that it's just amazing. One of the nicer things about it is that you can throw out that filing cabinet with the installlation CDs , packaging and license agreements that came with every piece of hardware and software because you just don't need it. You can replace it with a nice japanese fountain and improve your Feng Shui.
Help stamp out iliturcy.
- AOL
- Best Buy
- Borders
- CareerBuilder.com
- Clear Channel Communications
- Columbia House
- Digitas
- Discover Financial Services
- Eli Lilly and Company
- Expedia
- ESPN
- Ford Motor Company
- General Mills
- Google
- HP Home & Home Office Store
- Hyatt Corporation
- Interpublic Group
- iVillage
- Johnson and Johnson
- Knight Ridder Digital
- Mattel
- Medscape (Web MD)
- Mercado Libre
- Microsoft
- Monster Worldwide
- NASDAQ
- NAVTEQ
- Nestlé USA
- The Newspaper Association of America
- New York Times Digital
- Office Depot
- OMD Digital
- Orbitz
- Pepsi
- Procter and Gamble
- Starcom IP
- Terra Networks
- Ticketmaster, LLC
- T-Mobile
- Tribune Interactive
- Verizon
- Viacom International
- Washington Mutual
- Yahoo!
Retrieved from http://www.comscore.com/about/clients.aspI find it sort of funny that whenever I want to find a place to download the garbage mentioned in stories, I can't.. I can only remember Gator letting you go on their website to directly download what it is you wanted.
(For those wondering, sometimes I feel like downloading things just so I can play with it if I wanted to, in a VM for example, where a snapshot can make everything go away)
There is another kind of evil which we must fear most, and that is the indifference of good men. -- Boondock Saints
They commission third parties to do it. That's plausible deniability.
Enticing a third party to commit a crime should carry heavier penalties than doing the crime yourself. Especially when as in this case multiple third parties are enticed.
And comShare is receiving stolen property - property stolen only because they offered to buy it. But do we need new law in this area to properly jail these fuckers?
"with their freedom lost all virtue lose" - Milton
.. that is some pretty important information.
from the article:
"Two years ago, university IT managers busted comScore for tricking students into installing tracking software packaged with a free Web-accelerator program."
Why are university students downloading a "Web-accelerator program"? Because they're too stupid to know that these programs are worthless bullshit. Once again, we see that the biggest problem is not viruses or "spyware" -- it's user stupidity.
How is that news? I mean spyware is a part of windows and is even installed stock from windows 2000 and upwards. This is just yet another spyware company.
I gave up with the idea of an useful sig...
It hasn't received much coverage (it was only made public a couple of weeks ago), but there is an exploitable buffer overflow vulnerability that affects Links. Technically, it affects the libpng library that Links links against, but the exploit / vulnerability development was focussing on Links as the vector to achieved the buffer overflow.
InfoSec that matters, when it counts.
I did not the RTFA, nor do I plan to RTFA, but did anyone else see the screenshot of every page part and their first though was, Dam that gotta be a hell lot of bandwidth. And how many employees did they fire for working and looking at Pron? (think about it for a second)
I use Linux, does this effect me?
Of course it doesn't dumb ass!!
If you don't have a proper firewall you could blackhole the route to the offending place.
On Linux: route add -net the_offending_ip_or_network netmask netmask_of_the_network_or_host reject
(On Solaris route add -reject network/netmask some_gateway)
I think about Windows as being similar to people who smoke unfiltered cigarettes. They'll just kill you quicker than the other kinds. And, when you can do it, abstinence is the only foolproof way - just don't visit that web site unless you know what it has inside.
They know that Windows-only computing is risky to their computer's health, compared to other platforms. If they don't see that, consider your role as their friend. Don't you have an obligation to not enable their risk taking and self-destructive behaviors, and intervene?
Show them some Apple commercials, take them to an Apple store, and show them the stuff you do on your Macintosh or Linux system. Also show them Firefox, Noscript (controls javascript), and Little snitch (which monitors outgoing internet connections and allows you to opt-in for the ones you want).
So in other words you can outgrow wisdom.
"Oh, and I suppose you're going to say..." If I didn't say it, then don't assume I said it. I'll make a deal with all the people saying "It's OK because we can't help ourselves". I'll take responsability for the consequences of my advice to others, if all of you will accept the financial responsability for your advice. For example if someone's son gets AIDS because his "It's better than an air gap and two layers of clothing" condom breaks. Or someone's daughter gets pregnant because their "chemicals! best invention ever" fails and they have to pay for an abortion (fraught with it's own risks, and let's not mention the mental trauma.), or have to arrange an adoption (and all that goes with it). Something tells me your side will never accept the consequences (financial or otherwise), while those who preach adstinence will have to foot your bill for decades to come.
Heh. This is the first time I read about some famous person dying... and it turned out to be true!
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
If comScore isn't being devious or underhanded, why don't they have a clear install/operation routine that warns you every time you fire up a web-browser session?
All it would take is a box, perhaps giving you an opt-out for that session or simply just recording URLs. This would still provide accurate and interesting data. Especially in the latter.
Then the marketing droids would see which kinds of information people didn't want them to track.
I'm guessing they chose the spyware/malware route (which I see this software as) because they realized the obvious: who, in their right minds, would allow all their web surfing habits to go to someone else?
Additionally, how long do you think it is going to take for someone to alter the URL/IP in the software to send that data to another proxy? How long would it take any non-very-technical user to figure out this had been done?
"I'm just tired of the "you can't teach kids to abstain, so why bother" camp. You'll find that, most of the time, kids will rise to the level of expectations placed upon them."
You can thank darwinism for that. If we're descended from monkeys, then that's as high as we have to reach. If you've ever seen monkeys they'll do sex at the drop of a hat with everyone looking on. Marriage? Nope. Top monkey has his back turned? Go for it.
Why can't you wait till marriage? Peer pressure?
Don't be alarmed ! It affects only Windows.
We Linux users are safe.
huh? How's what I said in any way flamebait?
I've been using Windows since 3.1 and after many iterations I wrote my thoughts about a switch to a Linux distribution and got called flamebait - huh. Seems like thos MS fan-boys are taking over this board.
I think I've had it with MS and their crowd - the asking price for Vista is wayyyyyy beyond what I'm prepared to pay for an OS. XP left a hole in my wallet but VIsta is just beyond the pale, I'll not be donating any more to Bill's retirement fund.
calling me flamebait
1) I may be mistaken, but AFAIK there is a large difference between "stupid" and "not knowing".
A "not knowing" person needs to be educated (just like you needed to learn not to put your finger into that candle-flame). Only people that do something that they are warned for and than suffer the consequences can be called "stupid".
2) People have to decide, on meager information, if they want to trust someones word (or appearance) or not. You do the same every time you buy your food : you do not expect the store to put some addictive adjectives (let alone poison) into it.
3) Now the funny part of this all : The people that do realize that any-and-all software to be obtained can contain malware (embedded, or installed at the same time), and as a result refuse to install/run any software of unknown origin are looked funny at, even by the likes of "non-stupid" people.
They, after all, are not stupid : they have bought-and-installed at least one virus-scanner and a firewall (next to the one XP allready offered, as that one "does not work to well"), and than trust those measures to work. Oh yeah : they grab themselves the newest MS fixes like its a religion.
In other words : they have been conned into feeling safe, because some company told them that their products would keep them safe. Products they mostly do not know more about than those "download me, I'm a free game!" ones.
As a "thank you" that trustworthy company (MS) has conned you (by simple obsfucation : You could have known, if you would have read everything they did show you. Which you did not, as you trusted them) into installing that WGA application (which is a piece of spyware to say the least).
Who is laughing now ? You as a twice-warned "non-stupid" person, or all those "stupid persons" that are looking at a defeated "expert" ?
So in other words you want to gamble with your life, instead of taking a safer route. Fine. Are you willing to assume ALL of the the responsabilities if you gamble and lose? All the things I've mentioned can be expensive, and ongoing (for the rest of your life). Is a brief moment of sex really worth all that? I do hope you make better decisions in other aspects of your life, than what's so far being demonstrated in this one.
...of the first thing I read when I looked at the heading, bone-tired: cumSore.
Mhm.
Free PC version of ChipWits at http://www.breueronline.de/klaus/chipwits/
Most servers on the Internet run Linux. Problems are rare.
Linux is not the most common desktop platform but it is not the least common either. It's more popular than Mac OS-X.
Linux is not a monolithic platform. Each distro has quirks that distinguish it and those quirks make it harder to build spyware that works on every linux box. Boxes where the software fails spectacularly become red flags that alert people to the presence of malware, as developers attempt to figure out why it failed.
Many novices are running linux now with no problems. Some default configurations leave little to attack - no remote services listening for example, no software installation unless you've been prompted, etc.
It's hard to hide the kind of junk referred to in TFA into the source code. You might get it accepted to someone's project or repository, but when word got out their project or repository would become instantly unpopular, so I imagine they check pretty thoroughly.
In comparison, in the Windows environment creeps can and do hide anything they want behind "Close this dialog box? Yes / Accept / OK." It takes articles like this or extreme hackers to find out that a major corporation has been installing rootkits in millions of PC's. There have been so many of these articles that one has to wonder exactly how many Windows boxes aren't compromised yet. Because you don't get the source code with anything, you're not suspicious about what they're hiding from you.
Help stamp out iliturcy.
What kind of crap fud is everyone spreading here? It would be difficult to create spyware which embeds itself into the system without root access certainly. There are no "quirks" in the system which would make it difficult to build a binary (or source code) for every distro. The only incompatibilities would be if a different processor was used (say arm or powerpc or motorola's 68000 or whatever) or if they used some sort of incompatible kernel or libc...anyone do this? I haven't seen any distros mod the kernel or glibc or use anything other than the Linux kernel and GNU libc--though I think Debian also supports the Hurd (others?) and if there are any embedded distros (haven't looked) they probably use a smaller libc.
Unless you are talking about the script kiddies who write projects and include a thousand obscure lib deps and no download option to just get the program staticly linked with the unusual ones. Libc, libjpeg, libpng, etc are fine, but weird programming languages, ultra specialized libs, and such should really be included in the package. Maybe your distro may have them, but for everyone else it will be a pain in the ass. Must be them Debian dudes who can just type apt-get and they have access to every library known to man. ;-)
The only other potential quirks are when developers don't include the correct header file(s), which is a developer mistake, not the distro's. They should go with the man page or other offical docs.
Any jack off can easily write a spyware binary which only needs libc (or even makes direct kernel syscalls) and it will work on any distro, assuming you didn't compile it with the latest bleeding edge libc and theirs is a lower version. You wouldn't expect a program made for WinXP to run on Win95. Would you? If any libraries are needed, they just have to staticly link them. No "quirks" involved.
No offense intended, but it irritates me so many are saying this. It simply is not true.
Just browsing slashdot for this article, I see an ad for Privacy Crusader hosted on slashdot, which gets a less than glowing review from McAfee Site Crusader (http://www.siteadvisor.com/sites/privacycrusader. com).
Forget meta-moderation... all is not well in the state of Denmark...
Truth is, you really can't trust anyone.