Market Research Company Secretly Installs Spyware

An anonymous reader writes "Forbes reports that two security experts are raising new questions about comScore, claiming that company's tracking software is being installed without consent on an unknown number of computers. The widely-used online research company takes screenshots of every Web page viewed by its 1 million participants, even transactions completed in secure sessions, like shopping or online checking. ComScore then aggregates the information into market analysis for its clients, which include such large companies as Ford Motor, Microsoft and The New York Times Co." From the article: "'[The] software is sneaking onto users' computers without the user agreeing to receive it,' says Harvard University researcher Ben Edelman, who documented at least ten unauthorized comScore downloads. Eric Howes, director of malware research at antivirus company Sunbelt Software, and his researchers separately observed hundreds of unauthorized comScore downloads in a three-month period this fall."

HOSTS entry to block?

[martyb]

I want to proactively block any chance of getting caught by this. I just added this to my (Windows/XP HOME SP2) HOSTS file (C:\windows\system32\devices\etc\HOSTS):

127.0.0.1 comscore.com # ComScore, nee MediaMetrix, et al

I recognize this is but a start. I expect this has been investigated by others already. Rather than re-invent the wheel, I'm looking for some input on what else I can do to protect myself from them. (I already use ONLY firefox, and also have AVG, AdAware, Spybot, and WinPatrol)

Questions:

1. What other entries should I add to my hosts file? (Prevent)
2. What program(s) have you used to locate and remove this? (Detect and Remove)

FYI: Wikipedia's ComScore Entry [wikipedia.org]

Re:HOSTS entry to block?

[interiot]

Oops, I forgot to include the Texas Tech link [ttu.edu] with the IP addresses.

Re:Screenshots?

[interiot]

The installed software re-routes all of your internet traffic [stanford.edu] through comScore's proxy servers. In most cases, they're probably just monitoring the URL's you visit, but they also check check more specific information in some cases... they say they verify the user's demographics (name, address, it sounds like purchases are tracked as well), and depending on what they're doing research on at the time, they sometimes track P2P activity, audio streaming activity, instant messaging statistics, etc.

Re:HOSTS entry to block?

[flyingfsck]

http://everythingisnt.com/hosts.html [everythingisnt.com] http://en.wikipedia.org/wiki/Hosts_file [wikipedia.org]

Re:So what good is a unenforced law?

[Threni]

> So what good is the Computer Fraud and Abuse Title Act 18 Section 1030 if the FBI will not enforce
> it?

It would also appear to break the UK's Interception Of Communications Act 1988.

Re:Screenshots?

[interiot]

From TFA:

While ordinarily an HTTPS connection would simply pass through a proxy securely, in this case MarketScore also installs a new root certificate in your browser so that it can decrypt all intercepted SSL connections (a "man-in-the-middle" attack) without triggering a security warning from the browser. In normal operation, browsers would complain if a site certificate doesn't match the domain of the URL, but the new root certificate tells the browser to trust ComScore's site certificate for any URL.

Client List

[phantomcircuit]

Corporations supporting comScore's actions

• AOL
• Best Buy
• Borders
• CareerBuilder.com
• Clear Channel Communications
• Columbia House
• Digitas
• Discover Financial Services
• Eli Lilly and Company
• Expedia
• ESPN
• Ford Motor Company
• General Mills
• Google
• HP Home & Home Office Store
• Hyatt Corporation
• Interpublic Group
• iVillage
• Johnson and Johnson
• Knight Ridder Digital
• Mattel
• Medscape (Web MD)
• Mercado Libre
• Microsoft
• Monster Worldwide
• NASDAQ
• NAVTEQ
• Nestlé USA
• The Newspaper Association of America
• New York Times Digital
• Office Depot
• OMD Digital
• Orbitz
• Pepsi
• Procter and Gamble
• Starcom IP
• Terra Networks
• Ticketmaster, LLC
• T-Mobile
• Tribune Interactive
• Verizon
• Viacom International
• Washington Mutual
• Yahoo!

Retrieved from http://www.comscore.com/about/clients.asp [comscore.com]

Re:So what good is a unenforced law?

[Anonymous Coward]

And the UK Computer Misuse Act 1990.

But the authorities won't do anything without a complaint. So if you find this software on your computer then make a complaint to the police. Otherwise nothing will happen.