Slashdot Mirror
Market Research Company Secretly Installs Spyware
An anonymous reader writes "Forbes reports that two security experts are raising new questions about comScore, claiming that company's tracking software is being installed without consent on an unknown number of computers. The widely-used online research company takes screenshots of every Web page viewed by its 1 million participants, even transactions completed in secure sessions, like shopping or online checking. ComScore then aggregates the information into market analysis for its clients, which include such large companies as Ford Motor, Microsoft and The New York Times Co." From the article: "'[The] software is sneaking onto users' computers without the user agreeing to receive it,' says Harvard University researcher Ben Edelman, who documented at least ten unauthorized comScore downloads. Eric Howes, director of malware research at antivirus company Sunbelt Software, and his researchers separately observed hundreds of unauthorized comScore downloads in a three-month period this fall."
Is anyone going to do something about this?
Some justice,revenge,butt chewing,anything?
Do we write our congressman,DOS them or what?
all problems and no solutions.
It must be illegal on some level.
do we file a massive suit and each collect $5 or what?
*Repent!Quit Your Job!Slack Off!The World Ends Tomorrow and You May Die!
I'm sorry but monocultures and all that. I've given up warning people. It's their own responsibility to look after their computers? What they can't? Dearie me, that'll be hmmm, $$$ then.
Deleted
the previous story mentioned social justice in the headline... social justice here would be to have CD copies of their malicious software being rammed up their backsides "without their consent" so to speak...
Why is the DOJ worried more about aunt Eunice downloading MP3s than they are about people who are maliciously causing harm?
sigh, I'll write but I wonder if my representatives will actually notice...
Support NYCountryLawyer RIAA vs People
First, we have the NSA, DHS, et al target their illegal wiretapping programs at spammers and spyware makers. They've got the infrastructure to track these people down, and this is a justification for the programs everybody can get behind.
Second, when a spammer is caught, we ship them down to Gitmo. It doesn't matter, in this case, whether torture is an effective means of getting information. We don't need information from them, we just want them out of circulation. We can hope that it would be a deterrent, but really they'll be getting it for the simple reason that they deserve it. Republican/Christians get to torture and sodomize to their shrivelled little hearts' content, and we don't have to worry about damaging our reputation in the world community. Everybody's happy!
Gentlemen, there is no way that we can lose on this one!
Keep in mind when reading that by "unauthorized download" they don't mean copyright infringement, they mean that a third party installed ComScore software without *your* authorization.
I want to proactively block any chance of getting caught by this. I just added this to my (Windows/XP HOME SP2) HOSTS file (C:\windows\system32\devices\etc\HOSTS):
I recognize this is but a start. I expect this has been investigated by others already. Rather than re-invent the wheel, I'm looking for some input on what else I can do to protect myself from them. (I already use ONLY firefox, and also have AVG, AdAware, Spybot, and WinPatrol)
Questions:
FYI: Wikipedia's ComScore Entry
The thing that really gets me is that their monitoring software installs a root certificate in the user's browser so that they can do a "man in the middle" attack to https:/// connections at their proxy servers. In many cases, comScore gets permission from end users to do this, but I don't think many users really realize how much information they're exposing by doing this. Most obvious is bank passwords, etc, but comScore says they don't monitor those. comScore DOES however say that they verify their user's name, address, income, etc., which I'd imagine most users wouldn't actually agree to if they were fully informed.
why the hell don't the cops show up at the company's door, break it down, and arrest everyone responsible and make sure CNN news crews are there to record it and make a story out of it. Then maybe these stupid, evil marketing people will stop thinking they can get away with it! It's called illegal for a reason. If they can arrest a guy for putting a distributed processing screensaver on school computers, they can arrest marketing execs!
Google's Super Secret Search Algorithm: SELECT @search_results FROM internet WHERE @search_results = 'good'
This isn't what the actual article says. It says "virtual photos". Most likely is that it's just collecting URLs.. and maybe the contents of the page.. There would be no reason to do screenshots... It would make things much more difficult to analyze.
-- these are only opinions and they might not be mine.
So what good is the Computer Fraud and Abuse Title Act 18 Section 1030 if the FBI will not enforce it?
They have to install it on the computers of people who don't agree to it, because if they only monitored people who agreed to it, it would skew their results, because they'd be using self-selected samples! Think of the marketers!
I suffer from attention surplus disorder.
Just don't let it get too popular.
Information wants to be free.
Entertainment wants to be paid.
You just want to be cheap.
Download their software onto a 'tame' computer, and use it to browse 'interesting' sites.
Who would have thought that people who regularly view Ford's web site also like Goats ?
To be frank, the only software that will ultimately protect you is another operating system. Windows is fundamentally broken. Switch to Linux - or better yet, Mac OS X - and you will not only have a better internet experience, you'll have a better desktop experience overall.
-- thinkyhead software and media
OK, now you're just being silly.
Sure, abstinence is the only 100% effective way of preventing STD's, but teaching that and nothing else, is an extraordinarly dumb thing to do, because it goes against our natural instincts. We are born with the need for sex, and when it awakens it tends to go a little nuts. Abstinence only education can lead directly to teen pregnancies and the transmission of std's, because kids are not given an alternative method of protection, and in fact statistics show that it simply doesn't work in any way shape or form. Ignorance is not protection.
Your gun lesson analogy is a bad one. Firing guns is not a natural urge written into our genes.
ALL teens have sexual urges, but only a handful of nutcases have the urge to shoot their classmates.
Thus, your argument is a red herring.
That being said, it wouldn't hurt to have an alternative method of protection against guns, such as trigger-locks, and not rely solely on the "don't do it because I said so" method (which incidentally is the same one used in abstinence only education).
A more proper analogy would be:
You have a swimming pool in your back yard. You can tell your kids not to go in it all you want, but one day, when you're not looking, they will, and when that time comes, wouldn't it be safer if they've been taught how to swim?
-- This sig for rent.
I hope that some group or someone special takes the lead on this and not only goes after civil penalties but criminal penalties as well. I was to see someone in control of these decision sent to prison for their decisions to make this happen. I ALSO want to see the programmers and implementers of the methods used here sent to prison for their misdeeds.
I think there is a point that needs to be driven home into our culture that it's NOT okay to do anything for money. Because I believe that at some level we all somehow forgive these people for their tresspasses because their motivation was for profit... and we all understand the need for profit right? No, there are limits to what is acceptable behavior with a profit motive and like HP's spying (which arguably wasn't directly a profit motive but performed by a profit seeking competitive organization) we should not simply dismiss this as yet another "white collar crime" and move on. If people felt like they were risking more than a few hundred thousand of their millions of dollars, they just might think twice before ordering these things be done.
Maybe you're 12 and your time's worthless. Mine isn't and I now charge $$$ to fix computers. You don't want to pay? YeeHaw! Go away, fix it yourself then, or find some rather dim student who has nothing better to do. People have the right to privacy and surf the net unmolested, no matter the OS they use. Awww, how sweet. Welcome to the real world, not the idealised socialist one you have in your head.
Deleted
Flamebait? Maybe, but I personally think you are on to something there, though it has little to do with linux per se, but rather with that Ubuntu CD. What about it? It's a livecd. Use that, and you *will* be safe from even the most blatant user errors and the most malicious crackers (but not social engineering, sadly). Replace it once a year to be on the safe side.
Now actually, that would make browsing a mite slow. So maybe an install option where everything is mounted read-only? It might work.
This is of course only meant for the "I write email & browse the web" people. But those are the ones most likely to get hit by something like this.
Religion is regarded by the common people as true, by the wise as false, and by rulers as useful.
Windows users: when you use linux, a program that does just what you need is almost always just a few clicks away, is free, and doesn't have toxic junk like this attached to it. Usually linux comes with your choice of industrial-strength database servers and clients, web servers and scripting languages, a complete software development kit for the whole thing in dozens of programming languages, a choice of office suites and so much more that it's just amazing. One of the nicer things about it is that you can throw out that filing cabinet with the installlation CDs , packaging and license agreements that came with every piece of hardware and software because you just don't need it. You can replace it with a nice japanese fountain and improve your Feng Shui.
Help stamp out iliturcy.
- AOL
- Best Buy
- Borders
- CareerBuilder.com
- Clear Channel Communications
- Columbia House
- Digitas
- Discover Financial Services
- Eli Lilly and Company
- Expedia
- ESPN
- Ford Motor Company
- General Mills
- Google
- HP Home & Home Office Store
- Hyatt Corporation
- Interpublic Group
- iVillage
- Johnson and Johnson
- Knight Ridder Digital
- Mattel
- Medscape (Web MD)
- Mercado Libre
- Microsoft
- Monster Worldwide
- NASDAQ
- NAVTEQ
- Nestlé USA
- The Newspaper Association of America
- New York Times Digital
- Office Depot
- OMD Digital
- Orbitz
- Pepsi
- Procter and Gamble
- Starcom IP
- Terra Networks
- Ticketmaster, LLC
- T-Mobile
- Tribune Interactive
- Verizon
- Viacom International
- Washington Mutual
- Yahoo!
Retrieved from http://www.comscore.com/about/clients.aspI find it sort of funny that whenever I want to find a place to download the garbage mentioned in stories, I can't.. I can only remember Gator letting you go on their website to directly download what it is you wanted.
(For those wondering, sometimes I feel like downloading things just so I can play with it if I wanted to, in a VM for example, where a snapshot can make everything go away)
There is another kind of evil which we must fear most, and that is the indifference of good men. -- Boondock Saints
This is just ignorant and backwards and puritanical and not practical. It's 2006, not 1621.
---Technology will liberate us if it doesn't enslave us first.
They commission third parties to do it. That's plausible deniability.
Enticing a third party to commit a crime should carry heavier penalties than doing the crime yourself. Especially when as in this case multiple third parties are enticed.
And comShare is receiving stolen property - property stolen only because they offered to buy it. But do we need new law in this area to properly jail these fuckers?
"with their freedom lost all virtue lose" - Milton
.. that is some pretty important information.
from the article:
"Two years ago, university IT managers busted comScore for tricking students into installing tracking software packaged with a free Web-accelerator program."
Why are university students downloading a "Web-accelerator program"? Because they're too stupid to know that these programs are worthless bullshit. Once again, we see that the biggest problem is not viruses or "spyware" -- it's user stupidity.
How is that news? I mean spyware is a part of windows and is even installed stock from windows 2000 and upwards. This is just yet another spyware company.
I gave up with the idea of an useful sig...
It hasn't received much coverage (it was only made public a couple of weeks ago), but there is an exploitable buffer overflow vulnerability that affects Links. Technically, it affects the libpng library that Links links against, but the exploit / vulnerability development was focussing on Links as the vector to achieved the buffer overflow.
InfoSec that matters, when it counts.
Macs are just as vulnerable, if not even more so, to this kind of thing. We're lucky we haven't been targeted yet, but if we ever are, it will be just as hellish as on Windows.
I think about Windows as being similar to people who smoke unfiltered cigarettes. They'll just kill you quicker than the other kinds. And, when you can do it, abstinence is the only foolproof way - just don't visit that web site unless you know what it has inside.
They know that Windows-only computing is risky to their computer's health, compared to other platforms. If they don't see that, consider your role as their friend. Don't you have an obligation to not enable their risk taking and self-destructive behaviors, and intervene?
Show them some Apple commercials, take them to an Apple store, and show them the stuff you do on your Macintosh or Linux system. Also show them Firefox, Noscript (controls javascript), and Little snitch (which monitors outgoing internet connections and allows you to opt-in for the ones you want).
1. Users are the larger factor in vulnerability to this type of thing.
2. Mac users are an entirely different type than Windows users
3. Mac users are only interested in buying into the hip and trendy
4. Companies trying to get Mac user money already know this and don't need to study habits
This is works out well because since they aren't being targeted Mac users tend to get uppity about how Macs are the best, thus increasing the hip and trendy value to other potential Mac users and gathering the next generation of Starbucks sippping, one button clicking, iPod listening hipsters willing to spend twice the value of the computer to get the pretty white Mac logo and the trendy points with their hipster friends.
The only change I can believe in is what I find in my couch cushions.
Firing guns may not be a factor of our genes, but our fight or flight response is. We teach children the concept of self control so that they don't run away all the time like whipped pups, or so they don't go postal on their schoolmates. I'm just tired of the "you can't teach kids to abstain, so why bother" camp. You'll find that, most of the time, kids will rise to the level of expectations placed upon them. Expect that your kids will be lazy slackers who won't clean their rooms and--surprise, surprise--they grow up to be lazy slackers who won't clean their rooms. Instill and reinforce expectations early and often and most kids rise to the challenge. I don't care whether it's self care or staying out of the sack while young--the concept is the same. Sure, some will try the other path, but they will be the minority. At one time, they were considered bad examples that reinforced the lessons of a common morality. Moral relatism put that in the crapper, though, so the viablity of a return to this type of society is unlikey without seeing a far-reaching moral realignment among the citizenry of much of the world...
I use irony whenever I can, but my shirts are still wrinkled...
"ALL teens have sexual urges, but only a handful of nutcases have the urge to shoot their classmates."
On an unrelated topic: This is why sex on TV/Video games gets more attention than violence.
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
Heh. This is the first time I read about some famous person dying... and it turned out to be true!
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
Yeah, but your kids only need to do it once, for something to go wrong. When your child say, leaves his room like its been hit by a bombshell, that can be undone. You can't undo pregnancies (and abortion is a rather horrible solution).
Stopping Content Restriction Annulment and Protection means not calling it DRM.
You have a swimming pool in your back yard. You can tell your kids not to go in it all you want, but one day, when you're not looking, they will, and when that time comes, wouldn't it be safer if they've been taught how to swim?
That's a nice analogy, but it doesn't fit. Almost every friend I've set up with Firefox, firewalls, anti-virus programs, etc. has, within days, DISABLED those programs and gone back to surfing bareback.
Why? I ask.
Every bogus reason in the book:
"It was too *slow*" (It wasn't)
"I didn't *like* it!" (Won't say why)
"It *messed up my computer*" (How, they can't say).
"The Icons look wrong" (no joke)
Now I just walk away. Why waste my time with bozos when actual work is available for which I'll not only get paid, but get a "thank you" along with the check?
If comScore isn't being devious or underhanded, why don't they have a clear install/operation routine that warns you every time you fire up a web-browser session?
All it would take is a box, perhaps giving you an opt-out for that session or simply just recording URLs. This would still provide accurate and interesting data. Especially in the latter.
Then the marketing droids would see which kinds of information people didn't want them to track.
I'm guessing they chose the spyware/malware route (which I see this software as) because they realized the obvious: who, in their right minds, would allow all their web surfing habits to go to someone else?
Additionally, how long do you think it is going to take for someone to alter the URL/IP in the software to send that data to another proxy? How long would it take any non-very-technical user to figure out this had been done?
It's just another example of a piece of software that could be made for the Mac (or Linux, etc.) that simply wasn't. There is no reason why they couldn't try to trick Mac users into installing the software like they do to the Windows/IE users.
"Your gun lesson analogy is a bad one. Firing guns is not a natural urge written into our genes." You might NOT be a redneck if...
Yet another reason to own a Mac.
:-)
Snob.. Own a Mac.
Sensible about security.. Own a non-Windows computer.
Smile
The truth shall set you free!
I think an even better analogy would be: A company is installing illegal spyware on your computer, what do you do?
I don't know why the hell we're even discussing abstinence, STDs, and guns. The article doesn't have anything to do with any of those things.
-1 disagree is not a modifier for a reason. -1 troll, flaimbait, redundant, overrated are NOT acceptable substitutes.
Because I'm horny, and while I know there are very real risks, I know they can be mitigated.
After all, I am strangely colored.
Don't be alarmed ! It affects only Windows.
We Linux users are safe.
Wrong.
There is no comparison between temporary anger/frustration and the continuous urge that drives the population boom. It's the essence of natural selection. If you're horny, you're more likely to procreate, and thus your gene pool lives on.
-- This sig for rent.
Firing guns may not be a factor of our genes, but our fight or flight response is. We teach children the concept of self control so that they don't run away all the time like whipped pups, or so they don't go postal on their schoolmates.
This a case of modifying a natural behaviour. Humans generally don't need to "run away like whipped pups", for the simple reason that they are typically high level predators. (Especially in groups.)
I'm just tired of the "you can't teach kids to abstain, so why bother" camp
It's more that you are expecting these people to do something entirely un-natural.
...of the first thing I read when I looked at the heading, bone-tired: cumSore.
Mhm.
Free PC version of ChipWits at http://www.breueronline.de/klaus/chipwits/
Most servers on the Internet run Linux. Problems are rare.
Linux is not the most common desktop platform but it is not the least common either. It's more popular than Mac OS-X.
Linux is not a monolithic platform. Each distro has quirks that distinguish it and those quirks make it harder to build spyware that works on every linux box. Boxes where the software fails spectacularly become red flags that alert people to the presence of malware, as developers attempt to figure out why it failed.
Many novices are running linux now with no problems. Some default configurations leave little to attack - no remote services listening for example, no software installation unless you've been prompted, etc.
It's hard to hide the kind of junk referred to in TFA into the source code. You might get it accepted to someone's project or repository, but when word got out their project or repository would become instantly unpopular, so I imagine they check pretty thoroughly.
In comparison, in the Windows environment creeps can and do hide anything they want behind "Close this dialog box? Yes / Accept / OK." It takes articles like this or extreme hackers to find out that a major corporation has been installing rootkits in millions of PC's. There have been so many of these articles that one has to wonder exactly how many Windows boxes aren't compromised yet. Because you don't get the source code with anything, you're not suspicious about what they're hiding from you.
Help stamp out iliturcy.
What kind of crap fud is everyone spreading here? It would be difficult to create spyware which embeds itself into the system without root access certainly. There are no "quirks" in the system which would make it difficult to build a binary (or source code) for every distro. The only incompatibilities would be if a different processor was used (say arm or powerpc or motorola's 68000 or whatever) or if they used some sort of incompatible kernel or libc...anyone do this? I haven't seen any distros mod the kernel or glibc or use anything other than the Linux kernel and GNU libc--though I think Debian also supports the Hurd (others?) and if there are any embedded distros (haven't looked) they probably use a smaller libc.
Unless you are talking about the script kiddies who write projects and include a thousand obscure lib deps and no download option to just get the program staticly linked with the unusual ones. Libc, libjpeg, libpng, etc are fine, but weird programming languages, ultra specialized libs, and such should really be included in the package. Maybe your distro may have them, but for everyone else it will be a pain in the ass. Must be them Debian dudes who can just type apt-get and they have access to every library known to man. ;-)
The only other potential quirks are when developers don't include the correct header file(s), which is a developer mistake, not the distro's. They should go with the man page or other offical docs.
Any jack off can easily write a spyware binary which only needs libc (or even makes direct kernel syscalls) and it will work on any distro, assuming you didn't compile it with the latest bleeding edge libc and theirs is a lower version. You wouldn't expect a program made for WinXP to run on Win95. Would you? If any libraries are needed, they just have to staticly link them. No "quirks" involved.
No offense intended, but it irritates me so many are saying this. It simply is not true.
Moderation
:)
30% Funny
30% Overrated
20% Troll
Wow...I was just joking...guess I touched a nerve of some uppity emo trendsetting hipster Mac users.
The only change I can believe in is what I find in my couch cushions.
Wow, I haven't met an overbearing Christian since I got out of high school. I almost fell for the troll aspect of your post.
Life is full of risks. To paraphrase Benjamin Franklin, those who give up an important freedom for temporary safety deserve neither. Marriage is not the solution to the problems you raised. Effective birth control is. Indeed, many married couples don't want to have children.
Yes. I do want to gamble with my life. I do it every day. I shudder to think how boring a life I would have if I didn't.
After all, I am strangely colored.
""The Icons look wrong" (no joke)"
I have done the same for friends or family, what i do is just re-route the program to the new browser (ie firefox) but keep the icon the same, they dont notice the difference as long as you do some minimal configuration on the browser after install.
Also for other programs I make it so they can't go back (set passwords, change install paths, different user accounts, etc) and they just adapt.. if might be hard at first (everything is) but they get used to it and eventually realize that they aren't having the problems they used to have.
Of course there are always follow up questions but they become less and less and the users begin to understand more and more.. the only time I charge is when someone doesn't (want to) learn and keeps coming back with the "problems", then i see it as a billable service.
I really want to see Angelina Jolie nude, but when I download her pictures, angelinanude.exe won't open?
Mac users don't visit the kind of sites that peddle this malware because these sites and the stuff they offer doesn't work on macs. That means you need a whole new distribution network.
As I was saying, the only real reason is because they the stuff out there doesn't target the Mac.
Also: a large proportion of mac users tend to frequent Mac news/rumor sites. One wiff of something like this and it will be plastered all over these sites and the vast majority of mac users will know about it.
If you want to get malware out on macs, you have to do it really quickly or really stealthily.
This is the typical slashdot Mac user, which is like the typical slashdot Windows user - a pretty rare breed. You underestimate the number of people who bought a Mac because "They don't get viruses.", or had a Mac foisted on them by friends/relatives who were tired of fixing their Windows boxes. These people don't understand how their Windows install became infected, and how to take basic security measures to prevent infections. These people will be easy pickings for any kind of Mac malware, just like they were easy pickings for Windows malware.
Just browsing slashdot for this article, I see an ad for Privacy Crusader hosted on slashdot, which gets a less than glowing review from McAfee Site Crusader (http://www.siteadvisor.com/sites/privacycrusader. com).
Forget meta-moderation... all is not well in the state of Denmark...
Truth is, you really can't trust anyone.