Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

Market Research Company Secretly Installs Spyware

Posted by Zonk on Sun Dec 10, 2006 02:20 PM
from the you-wanted-to-participate-anyway dept.
Privacy Security Businesses
An anonymous reader writes "Forbes reports that two security experts are raising new questions about comScore, claiming that company's tracking software is being installed without consent on an unknown number of computers. The widely-used online research company takes screenshots of every Web page viewed by its 1 million participants, even transactions completed in secure sessions, like shopping or online checking. ComScore then aggregates the information into market analysis for its clients, which include such large companies as Ford Motor, Microsoft and The New York Times Co." From the article: "'[The] software is sneaking onto users' computers without the user agreeing to receive it,' says Harvard University researcher Ben Edelman, who documented at least ten unauthorized comScore downloads. Eric Howes, director of malware research at antivirus company Sunbelt Software, and his researchers separately observed hundreds of unauthorized comScore downloads in a three-month period this fall."
+ -
story

Related Stories

[+] Technology: Are Web Ratings Dangerous To Sites? 54 comments
Freshly Exhumed writes "For website publishers, a poor web rating can be disastrous. Bad television ratings mean television shows get canceled, bad web ratings mean websites go out of business. For advertisers, accurate web ratings are critical to optimize spending. Inaccurate ratings data means advertisers will overspend on poorly performing sites or not advertise on smaller sites whose numbers are really much higher than reported. In the case of Canadian web site Digital Home, already hit with an advertising boycott by Bell Canada over the site's pro-consumer editorial content, the site's owner is now in danger of ending operations, apparently due to the inaccuracies of ComScore rankings. For example, Google Analytics reported Digital Home served up over 2.7 million page views in January to almost 250,000 unique visitors. A web buyer at one of Canada's largest advertising agencies confirmed that ComScore reported just 32,000 visitors. Added to this is ComScore's secretly-installed spyware troubles."
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

Market Research Company Secretly Installs Spyware 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • Well? (Score:4, Insightful)

    by flyneye (84093) <flyneye_1@hotmaiSTRAWl.com minus berry> on Sunday December 10 2006, @02:25PM (#17186330) Homepage
    Is anyone going to do something about this?
    Some justice,revenge,butt chewing,anything?
    Do we write our congressman,DOS them or what?
    all problems and no solutions.
    It must be illegal on some level.
    do we file a massive suit and each collect $5 or what?

    • Personally,
      I think we should all write in this style.
      A real Story-of-Mel [wizzy.com] style.

      Hawt.

      Seriously. The world
      might not be made better for it.
      But *I* might be made better for it.

      When Congress writes anti-spam/anti-spyware laws
      in this style, and the FBI enforces them,
      with judges reading sentences in
      i-am-bic pentameter,
      humanity will be restored
      (whatever THAT means).

      [Now, watch slashdot's formatter totally f this up]

      • Re: (Score:3, Interesting)

        by TheLink (130905)
        Well that applied to the Sony rootkit thing too. So what happened?

        In contrast that silly UK guy is going to get deported to the US because he was looking for UFOs by getting into US Gov machines without permission.

        • Re: (Score:3, Insightful)

          by mpe (36238)
          Yes, but then they'll point out that when you downloaded that Naked Britney Spears Screensaver, you clicked on a EULA which authorised them to read all your bank passwords. The fact that no-one in their right mind would do so is irrelevant.

          Or more likely the ELUA attached to the program said "We can change this however and whenever we like". With there being a piece of HTML somewhere on their website which says "We own anythihng on your computer".

          Personally I'm getting close to the point where I'm going

        • Re: (Score:3, Insightful)

          by theCoder (23772)
          It's not really a Windows technical problem (what comScore did could probably be done on Linux), but more of a Windows culture problem. I don't know about you, but I get nervous when I download source code for a program and run it without looking over the code. I get doubly nervous if I download a binary and run it. Back when I ran Windows (many years ago), I had no problems downloading and running programs from the Internet. If I happen to use Windows today, I still do that (though I'm pretty selective
  • I'm sorry but monocultures and all that. I've given up warning people. It's their own responsibility to look after their computers? What they can't? Dearie me, that'll be hmmm, $$$ then.

     

      • Re: (Score:3, Insightful)

        by Ngarrang (1023425)
        Yawn? Don't plug into the net? What arrogant uncaring tripe. What kind of jackass gives that sort of a response? Oh, right, an OS snob. People have the right to privacy and surf the net unmolested, no matter the OS they use. ComScore trampled on that right and deserve to burn, so don't turn this around and blame the user.

        • Do you have to deal with the problems? (Score:4, Interesting)

          by Colin Smith (2679) on Sunday December 10 2006, @03:47PM (#17186910)

          Yawn? Don't plug into the net? What arrogant uncaring tripe. What kind of jackass gives that sort of a response? Oh, right, an OS snob
          Actually it's the sort of response that you get from someone who's constantly asked to fix computers that are repeatedly infested with viruses, spyware and other malware.

          Maybe you're 12 and your time's worthless. Mine isn't and I now charge $$$ to fix computers. You don't want to pay? YeeHaw! Go away, fix it yourself then, or find some rather dim student who has nothing better to do.

          People have the right to privacy and surf the net unmolested, no matter the OS they use.
          Awww, how sweet. Welcome to the real world, not the idealised socialist one you have in your head.
           

            • Re:Do you have to deal with the problems? (Score:4, Insightful)

              by jlarocco (851450) on Sunday December 10 2006, @04:47PM (#17187312) Homepage
              You sound like you lack the social skills necessary to tell people that it consumes too much of your time to fix all your friends computers in such as fashion as to retain them as your friends.

              Real friends don't expect you to do work for them. If that offends them, good riddance.

              You should be able to teach similar sorts of things to your friends, strengthen your friendship and give yourself more time to do fun things.

              Yes, but it's not my responsibility, nor is it a way I want to spend my free time. There are much more fun ways to strengthen friendships that don't involve one person doing work for free.

              As far as I'm concerned, my help stops after I tell them to run Debian.

              • Re:Do you have to deal with the problems? (Score:4, Insightful)

                by bmo (77928) on Monday December 11 2006, @02:10AM (#17191520)
                "Real friends don't expect you to do work for them. If that offends them, good riddance."

                Hear, hear old chap!

                It's about time we all stopped subsidizing Microsoft's insecure shitware. If everyone who had Windows had to pay GeekSquad's rates every time a computer died, there would be much more pressure on Microsoft to release something secure. But they don't, because they don't have to.

                And seriously, it takes a good whole 12 hours of watching the cleaning software chew through all the data on drives these days and when you're done, you're still not sure you got everything.

                Yet some "friends" want us to do it for free or for prices that wind up being about minimum wage when the billable hours are worked out. Sometimes that's ok. Some charity cases are OK in my book, but when the charity case comes back 6 months later with the same old "my computer is slow", one feels like a chump.

                So now my line is "I'll do it for free if you let me put Linux on it."

                Last Friday, a colleague asked me if his computer was infected because it was slow. I told him it was probably a couple of hundred infections (true). He was wondering if he should give it to me or GeekSquad. I told him GeekSquad will just format and reinstall. I did tell him that while he could pay me to do the same thing at a cheaper rate than GS, I would put Linux on it for free. He's thinking.

                --
                BMO
            • You should be able to teach similar sorts of things to your friends
              From what I've seen most people don't care enough to be bothered to learn about these things. It's computers, it's complicated, they don't care. If you try to explain it to them they just wave you away. When it slows down, it means it's broken so they get a new one.

      • Re:Yawn... (Score:5, Insightful)

        by Temsi (452609) on Sunday December 10 2006, @02:59PM (#17186618) Journal
        That's about as stupid as teaching abstinence only as the only way to fight STD's.

        Interestingly, the advice given is almost the same too: don't plug in...

        People are doing it and kids will do it, so instead of closing your eyes and yelling "don't do it", you should at least show them how to use protection first.

        • Re:Yawn... (Score:5, Funny)

          by Harmonious Botch (921977) * on Sunday December 10 2006, @03:05PM (#17186646) Homepage Journal
          But most Windows users are as interested in secure computers as teenagers are in condoms.

          • Re:Yawn...Just say no to sex. (Score:4, Insightful)

            by Temsi (452609) on Sunday December 10 2006, @03:40PM (#17186868) Journal
            OK, now you're just being silly.

            Sure, abstinence is the only 100% effective way of preventing STD's, but teaching that and nothing else, is an extraordinarly dumb thing to do, because it goes against our natural instincts. We are born with the need for sex, and when it awakens it tends to go a little nuts. Abstinence only education can lead directly to teen pregnancies and the transmission of std's, because kids are not given an alternative method of protection, and in fact statistics show that it simply doesn't work in any way shape or form. Ignorance is not protection.

            Your gun lesson analogy is a bad one. Firing guns is not a natural urge written into our genes.
            ALL teens have sexual urges, but only a handful of nutcases have the urge to shoot their classmates.
            Thus, your argument is a red herring.
            That being said, it wouldn't hurt to have an alternative method of protection against guns, such as trigger-locks, and not rely solely on the "don't do it because I said so" method (which incidentally is the same one used in abstinence only education).

            A more proper analogy would be:
            You have a swimming pool in your back yard. You can tell your kids not to go in it all you want, but one day, when you're not looking, they will, and when that time comes, wouldn't it be safer if they've been taught how to swim?

  • That's sort of odd... (Score:4, Insightful)

    by zappepcs (820751) on Sunday December 10 2006, @02:32PM (#17186374) Journal
    the previous story mentioned social justice in the headline... social justice here would be to have CD copies of their malicious software being rammed up their backsides "without their consent" so to speak...

    Why is the DOJ worried more about aunt Eunice downloading MP3s than they are about people who are maliciously causing harm?

    sigh, I'll write but I wonder if my representatives will actually notice...

    • Re: (Score:3, Insightful)

      by StikyPad (445176)
      Because Joe Websurfer doesn't have a lobbiest bending the ear of Congress.
      • Well, Department of Justice employees are appointed or hired, not elected, and if caught taking bribes are in deep doo-doo ... but the DOJ is not as independent an entity as one might desire. There are a lot of political favors that have to be accepted in order to reach a high rank in such an organization, and those favors are often owed (Mr. Gonzales, this means you) to people (are you listening, Mr. Hatch? Mr. Berman?) who don't mind a few extra contributions.

  • Win-win-win solution (Score:5, Funny)

    by straponego (521991) on Sunday December 10 2006, @02:36PM (#17186410)
    I think everyone who isn't a total scumbag agrees that spammers and spyware makers are evil and a drain on society. Furthermore, in terms of lifetimes wasted, they time they cost us surely adds up to many times the lives we've lost due to terrorism. I have the answer, one which will heal the political rift in the US as a side effect.

    First, we have the NSA, DHS, et al target their illegal wiretapping programs at spammers and spyware makers. They've got the infrastructure to track these people down, and this is a justification for the programs everybody can get behind.

    Second, when a spammer is caught, we ship them down to Gitmo. It doesn't matter, in this case, whether torture is an effective means of getting information. We don't need information from them, we just want them out of circulation. We can hope that it would be a deterrent, but really they'll be getting it for the simple reason that they deserve it. Republican/Christians get to torture and sodomize to their shrivelled little hearts' content, and we don't have to worry about damaging our reputation in the world community. Everybody's happy!

    Gentlemen, there is no way that we can lose on this one!

    • Re:Win-win-win solution (Score:4, Interesting)

      by Steve B (42864) on Sunday December 10 2006, @04:03PM (#17187022) Homepage
      One important point is that spam is about the perfect method of communicating "go-codes" to terrorist cells -- it's trivial to encode a message in the anti-filtering gibberish attached to most spam, and the indiscriminate broadcast completely negates traffic analysis.
      • Republicans/Christians? What kind of trolling idiot are you?

        I'd say a Democratic/Atheist one, you know, so long as we're making snap judgments about people.

  • "unauthorized download" (Score:2, Insightful)

    by Anonymous Coward
    Keep in mind when reading that by "unauthorized download" they don't mean copyright infringement, they mean that a third party installed ComScore software without *your* authorization.

  • HOSTS entry to block? (Score:4, Informative)

    by martyb (196687) on Sunday December 10 2006, @02:43PM (#17186486)

    I want to proactively block any chance of getting caught by this. I just added this to my (Windows/XP HOME SP2) HOSTS file (C:\windows\system32\devices\etc\HOSTS):

    127.0.0.1 comscore.com # ComScore, nee MediaMetrix, et al

    I recognize this is but a start. I expect this has been investigated by others already. Rather than re-invent the wheel, I'm looking for some input on what else I can do to protect myself from them. (I already use ONLY firefox, and also have AVG, AdAware, Spybot, and WinPatrol)

    Questions:

    1. What other entries should I add to my hosts file? (Prevent)
    2. What program(s) have you used to locate and remove this? (Detect and Remove)

    FYI: Wikipedia's ComScore Entry [wikipedia.org]

  • Intercepts https:// (Score:5, Interesting)

    by interiot (50685) on Sunday December 10 2006, @02:44PM (#17186498) Homepage
    The thing that really gets me is that their monitoring software installs a root certificate in the user's browser so that they can do a "man in the middle" attack to https:/// [https] connections at their proxy servers. In many cases, comScore gets permission from end users to do this, but I don't think many users really realize how much information they're exposing by doing this. Most obvious is bank passwords, etc, but comScore says they don't monitor those. comScore DOES however say that they verify their user's name, address, income, etc., which I'd imagine most users wouldn't actually agree to if they were fully informed.

    • Most obvious is bank passwords, etc, but comScore says they don't monitor those. comScore DOES however say that they verify their user's name, address, income, etc., which I'd imagine most users wouldn't actually agree to if they were fully informed.

      In other words, comScore does a credit check. People routinely agree to those. So I'm not sure that your last statement is correct.

      • It's sort of like credit check, I suppose, but they can (and based on the "buying power" reports they generate, I believe there's a good chance they do) track purchases made, and may track bank balances (I'm not sure how easy this is to do, but it's possible they do this for the X largest ecommerce sites and the X largest banking sites).

        Yes, people routinely agree to credit checks, but usually there's a direct financial benefit... eg. getting a loan or something like that. comScore rarely pays its parti

    • Re:Intercepts https:// (Score:5, Insightful)

      by Beryllium Sphere(tm) (193358) on Sunday December 10 2006, @03:47PM (#17186908) Homepage Journal
      Inviting the question, even if you trust them with your credit card numbers, and trust all their employees, do you want to bet that there won't be a security breach on one of their servers?

      This is a serious limitation of SSL on commodity operating systems, by the way. IE's list of trusted root certificates is simply entries in the registry. Even if you're part of the infinitesimal fraction of users who knows what a CA cert is and where to look for them, how can you do a security review on all 39 of the root certificates that come with Firefox, or spot a new unwanted one? (One of those root certs is from AOL, by the way). If you trust the Mozilla foundation to audit the security and practices of each and every one, do you have the same trust in a proprietary browser's developers? Even assuming the developers make the decision instead of the marketers?

  • this is what they should do! (Score:5, Interesting)

    by ILuvRamen (1026668) on Sunday December 10 2006, @02:48PM (#17186538)
    why the hell don't the cops show up at the company's door, break it down, and arrest everyone responsible and make sure CNN news crews are there to record it and make a story out of it. Then maybe these stupid, evil marketing people will stop thinking they can get away with it! It's called illegal for a reason. If they can arrest a guy for putting a distributed processing screensaver on school computers, they can arrest marketing execs!
    • Exactly!

      How is what these scum are doing any different from a thief photographing the contents of letters in your mailbox?

      None that I can see.

    • I don't think Ford, Microsoft, etc. would do business with them if what they did was really obviously illegal. Also, if taken to court or whatnot, they'd probably say that most users agreed to their EULA [opinionsquare.com], which says things like:

      Once you install our application, it monitors all of the Internet behavior that occurs on the computer on which you install the application, including both your normal web browsing and the activity that you undertake during secure sessions, such as filling a shopping basket, compl

  • Screenshots? (Score:5, Interesting)

    by slashkitty (21637) on Sunday December 10 2006, @02:56PM (#17186594) Homepage
    The submitter claims the software takes screenshots of every page the users visit.

    This isn't what the actual article says. It says "virtual photos". Most likely is that it's just collecting URLs.. and maybe the contents of the page.. There would be no reason to do screenshots... It would make things much more difficult to analyze.

    • Re:Screenshots? (Score:5, Informative)

      by interiot (50685) on Sunday December 10 2006, @03:05PM (#17186650) Homepage
      The installed software re-routes all of your internet traffic [stanford.edu] through comScore's proxy servers. In most cases, they're probably just monitoring the URL's you visit, but they also check check more specific information in some cases... they say they verify the user's demographics (name, address, it sounds like purchases are tracked as well), and depending on what they're doing research on at the time, they sometimes track P2P activity, audio streaming activity, instant messaging statistics, etc.

        • Re:Screenshots? (Score:5, Informative)

          by interiot (50685) on Sunday December 10 2006, @03:58PM (#17186998) Homepage

          From TFA:

          While ordinarily an HTTPS connection would simply pass through a proxy securely, in this case MarketScore also installs a new root certificate in your browser so that it can decrypt all intercepted SSL connections (a "man-in-the-middle" attack) without triggering a security warning from the browser. In normal operation, browsers would complain if a site certificate doesn't match the domain of the URL, but the new root certificate tells the browser to trust ComScore's site certificate for any URL.
    • This isn't what the actual article says.

      For that matter, the title "Market Research Company Secretly Installs Spyware" is completely wrong. Even the researchers aren't suggesting comScore* is actively involved in anything illegal, just that they're indiscriminate about what kind of scum they use as distributors.

      * I was going to ridicule the submitter/editor but they actually got the company's name right, while Forbes is wrong...

  • So what good is a unenforced law? (Score:5, Insightful)

    by canuck57 (662392) on Sunday December 10 2006, @02:59PM (#17186620)

    So what good is the Computer Fraud and Abuse Title Act 18 Section 1030 if the FBI will not enforce it?

    • Re:So what good is a unenforced law? (Score:4, Informative)

      by Threni (635302) on Sunday December 10 2006, @03:28PM (#17186770)
      > So what good is the Computer Fraud and Abuse Title Act 18 Section 1030 if the FBI will not enforce
      > it?

      It would also appear to break the UK's Interception Of Communications Act 1988.
    • Question: So what good is [Some law passed by Congress] if the FBI will not enforce it?

      Answer: It makes Congress look good. The can go home & tell their constituents "look what wonderful law I voted for".

      In reality, it takes either some Attorney General makes a stink over it, or some high profile mishap lights a fire under their asses.
    • Oh, they enforce it alright. Just not against people who actually cause harm (the people who the law is SUPPOSED to punish)...
  • They have to install it on the computers of people who don't agree to it, because if they only monitored people who agreed to it, it would skew their results, because they'd be using self-selected samples! Think of the marketers!

  • Skew them ! (Score:3, Insightful)

    by Anonymous Coward on Sunday December 10 2006, @03:31PM (#17186796)
    Download their software onto a 'tame' computer, and use it to browse 'interesting' sites.

    Who would have thought that people who regularly view Ford's web site also like Goats ?

  • I hope someone takes the lead on this (Score:3, Insightful)

    by erroneus (253617) on Sunday December 10 2006, @03:41PM (#17186874) Homepage
    I hope that some group or someone special takes the lead on this and not only goes after civil penalties but criminal penalties as well. I was to see someone in control of these decision sent to prison for their decisions to make this happen. I ALSO want to see the programmers and implementers of the methods used here sent to prison for their misdeeds.

    I think there is a point that needs to be driven home into our culture that it's NOT okay to do anything for money. Because I believe that at some level we all somehow forgive these people for their tresspasses because their motivation was for profit... and we all understand the need for profit right? No, there are limits to what is acceptable behavior with a profit motive and like HP's spying (which arguably wasn't directly a profit motive but performed by a profit seeking competitive organization) we should not simply dismiss this as yet another "white collar crime" and move on. If people felt like they were risking more than a few hundred thousand of their millions of dollars, they just might think twice before ordering these things be done.

  • Client List (Score:5, Informative)

    by phantomcircuit (938963) on Sunday December 10 2006, @04:17PM (#17187136) Homepage
    Corporations supporting comScore's actions
    • AOL
    • Best Buy
    • Borders
    • CareerBuilder.com
    • Clear Channel Communications
    • Columbia House
    • Digitas
    • Discover Financial Services
    • Eli Lilly and Company
    • Expedia
    • ESPN
    • Ford Motor Company
    • General Mills
    • Google
    • HP Home & Home Office Store
    • Hyatt Corporation
    • Interpublic Group
    • iVillage
    • Johnson and Johnson
    • Knight Ridder Digital
    • Mattel
    • Medscape (Web MD)
    • Mercado Libre
    • Microsoft
    • Monster Worldwide
    • NASDAQ
    • NAVTEQ
    • Nestlé USA
    • The Newspaper Association of America
    • New York Times Digital
    • Office Depot
    • OMD Digital
    • Orbitz
    • Pepsi
    • Procter and Gamble
    • Starcom IP
    • Terra Networks
    • Ticketmaster, LLC
    • T-Mobile
    • Tribune Interactive
    • Verizon
    • Viacom International
    • Washington Mutual
    • Yahoo!
    Retrieved from http://www.comscore.com/about/clients.asp [comscore.com]

  • Availability of garbage (Score:3, Interesting)

    by The Hobo (783784) on Sunday December 10 2006, @04:21PM (#17187156)
    I find it sort of funny that whenever I want to find a place to download the garbage mentioned in stories, I can't.. I can only remember Gator letting you go on their website to directly download what it is you wanted.

    (For those wondering, sometimes I feel like downloading things just so I can play with it if I wanted to, in a VM for example, where a snapshot can make everything go away)

  • They don't do it (Score:4, Insightful)

    by wytcld (179112) on Sunday December 10 2006, @04:25PM (#17187180) Homepage
    They commission third parties to do it. That's plausible deniability.

    Enticing a third party to commit a crime should carry heavier penalties than doing the crime yourself. Especially when as in this case multiple third parties are enticed.

    And comShare is receiving stolen property - property stolen only because they offered to buy it. But do we need new law in this area to properly jail these fuckers?

  • It's the stupidity, stupid. (Score:4, Funny)

    by rudy_wayne (414635) on Sunday December 10 2006, @04:31PM (#17187216)
    from the article:
    "Two years ago, university IT managers busted comScore for tricking students into installing tracking software packaged with a free Web-accelerator program."

    Why are university students downloading a "Web-accelerator program"? Because they're too stupid to know that these programs are worthless bullshit. Once again, we see that the biggest problem is not viruses or "spyware" -- it's user stupidity.

  • No reason to be worried ! (Score:4, Funny)

    by Mr Europe (657225) on Monday December 11 2006, @02:13AM (#17191528)
    Don't be alarmed ! It affects only Windows.

    We Linux users are safe.

    • Re: (Score:3, Interesting)

      by Technician (215283)
      Yet another reason to own a Mac.

      Snob.. Own a Mac.

      Sensible about security.. Own a non-Windows computer.

      Smile :-)

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2010 Geeknet, Inc.