Media Files That Spread Spyware (Ben Edelman On WMP Installing 31! Programs On His PC Alert)

Users have a lot to worry about when downloading and playing media files. Are the files legal? Can their computers play the required file formats? Now there's yet another problem to add to the list: Will a media file try to install spyware?

When Windows Media Player encounters a file with certain "rights management" features enabled, it opens the web page specified by the file's creator. This page is intended to help a content providers promote its products -- perhaps other music by the same artist or label. But the specified web page can show deceptive messages, including pop-ups that try to install software on users' PCs. User with all the latest updates (Windows XP Service Pack 2 plus Windows Media Player 10) won't get these popups. But with older software, confusing and misleading messages can trick users into installing software they don't want and don't need -- potentially so many programs that otherwise-satisfactory computers become slow and unreliable.

I recently tested a WindowsMedia video file, reportedly circulating through P2P networks, that displays a misleading pop-up which in turn attempts to install unwanted software onto users' computers. I consider the installation misleading for at least three reasons.

1) The pop-up fails to name the software to be installed or the company providing the software, and it fails to give even a general description of the function of the software.

2) The pop-up claims "You must agree to our terms and conditions" -- falsely suggesting that accepting the installation is necessary to view the requested WindowsMedia video. (It's not.)

3) Even when a user specifically requests more information about the program to be installed, the pop-up does not provide the requested information -- not even in euphemisms or in provisions hidden mid-way through a long license. Clicking the pop-up's hyperlink opens SpiderSearch's Terms and Conditions -- a page that mentions "receiving ads of adult nature" and that disclaims warranty over any third-party software "accessed in conjunction with or through" SpiderSearch, but that does not disclose installation of any third-party software.

On a fresh test computer, I pressed Yes once to allow the installation. My computer quickly became contaminated with the most spyware programs I have ever received in a single sitting, including at least the following 31 programs: 180solutions, Addictive Technologies, AdMilli, BargainBuddy, begin2search, BookedSpace, BullsEye, CoolWebSearch, DealHelper, DyFuca, EliteBar, Elitum, Ezula, Favoriteman, HotSearchBar, I-Lookup, Instafin, Internet Optimizer, ISTbar, Megasearch, PowerScan, ShopAtHome Select, SearchRelevancy, SideFind, TargetSavers, TrafficHog, TV Media, WebRebates, WindUpdates, Winpup32, and VX2 (DirectRevenue). (Most product names are as detected by Lavasoft Ad-Aware.) All told, the infection added 58 folders, 786 files, and an incredible 11,915 registry entries to my test computer. Not one of these programs had showed me any license agreement, nor had I consented to their installation on my computer.

I retained video, packet log, registry, and file system logs of what occurred. As in my prior video of spyware installing through security holes, my records make it possible to track down who's behind the installations -- just follow the money trail, as captured by the "partner IDs" within the various software installation procedures. When one program installs another, the second generally pays the first a commission, using a partner ID number to track who to pay. These numbers make it possible to figure out who's profiting from the unwanted installations and, ultimately, where the money is going.

As I started to follow the money trail, I was surprised to see that some of these programs receive funds from respected online merchants. The spyware installations added new toolbars to my computer's browser and new icons to my desktop. If users click through these links, then make purchases from the specified merchants, the merchants pay commission to the affiliates who placed these toolbars and icons on users' PCs. Even large, otherwise-reputable companies pay commissions through these systems, thereby funding those who install unwanted software on users' computers. In my testing, I received affiliate links to Amazon, Dell, Hotwire, Match.com, Travelocity, and others. Many of these links pass through affiliate tracking networks LinkShare and Commission Junction. Of course, the merchants may not have intended to support spyware developers; they may have approved the affiliates without fully understanding the affiliates' practices. In future work, I'll look in greater detail at which merchants pay affiliate commissions to which spyware distributors, and I'll also further document which merchants purchase advertising from companies whose software sneaks onto users' computers.

Other companies partially responsible for these practices are the providers of the unwanted software -- who pay commissions to those who cause their software to be installed on users' computers. Some of the programs I received come from big companies with major investment backing: 180solutions received $40 million from Spectrum Equity Investors; DirectRevenue received $20 million from Insight Venture Partners; and eXact Advertising (makers of BargainBuddy and BullsEye) received $15 million from Technology Investment Capital Corp. With so much cash on hand, these companies are far from judgment-proof. Why are paying distributors to install their software on users' computers without notice and consent?

The problematic installations resulted most directly from the "feature" of Windows Media Player that lets media files open pop-up web pages. But most users will only receive the contaminated files if they download files from P2P filesharing networks. Of course, rogue media files are but one way that P2P networks spread spyware. For example, users requesting Kazaa receive a large bundle of software (including Claria's GAIN), after poor disclosures that bury key terms within lengthy licenses, without even section headers to help readers find what's where. Users requesting Grokster receive unwanted software even if they press Cancel to decline Grokster's installation (details).

Ed Bott offers an interesting, if slightly different, interpretation of these installations. Ed rightly notes that users with all the latest software -- not just Windows XP Service Pack 2, but also Windows Media Player 10 -- won't get the tricky pop-ups described above. Ed also points out that Windows Media Player displays of ActiveX installation prompt pop-ups are similar to deceptive methods users have seen before, i.e. when web sites try to trick users into installing software. True. But I think Ed gives too little weight to the especially deceptive circumstances of a software installation prompt shown when users try to watch a video. For one, legitimate media players actually do use these prompts to install necessary updates (i.e. the latest version of Macromedia Flash). In addition, the unusually misleading (purported) product name and company name make it particularly easy to be led astray here. Users deserve better.

Read

http://mvps.org/winhelp2002/unwanted.htm

haven't had any problems since

remember everything should be checked for updates every week (i.e. windows OS, virus programs, spyware programs, host file).

Thanks for the link.

Yes, I have everything is setup to check for updates once a week automatically. It's very good advice.

But the fact this ready exploit exists means every one should keep up their guard and lock down IE

Best advice going.

Get the shields up, report to battle stations and prepare to repel boarders!

24 posted on 01/03/2005 6:43:04 AM PST by Bloody Sam Roberts (All I ask from livin' is to have no chains on me. All I ask from dyin' is to go naturally.)

I was researching spy-ware solutions when I managed to infect my own computer at an unscroupulous "Computer Support" website!

I got most of the crap scrubbed out, but had one remaining spy (DelfinProject.com) that was so deeply embedded I couldn't find it.

Then I came across an old-school fix that employed a HOSTS file. By doing to the spy-ware requests (re-routing their requests to a dead IP), combined with a switch to Firefox, I completely broke the never ending cycle of auto-install, detect, eliminate, auto-install.....

Life is good!

"The First World Congress on Agroforestry.???"

You know you've just opened a can of worms here at FR!

Funny, you seem to be the only one distressed about my reference to it...

Quite frankly I don't know what your level of knowledge is, but I learned a lot attending that particular congress and in presenting the fine work of coffee growers in Rwanda and how this system of farming is helping them with restoring their food security needs.

I also toured several established and very profitable versions of Agroforestry systems in Florida. One was a cattle farmer growing valuable Pole Pine and the other was a nursery that supplies stock to Disney.

Conservation properly implemented is very conservative. Environmentalism that doesn't allow you to work your land, hike, hunt, or use your land is a liberal abuse.

But FTD is a big Gator advertiser.

And LinkShare makes tons of money through unwanted software on users' computers. (Consider: Ebates and all the other TopMoxie programs. 180solutions. BargainBuddy. And the list goes on.)

So LinkShare could do a lot more to stop these practices, if it wanted to. And FTD is specifically supporting Gator. They're not exactly model companies for helping make these problems better.

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.