Re: WMP Adware: A Case Study in Deception in Security

Re: WMP Adware: A Case Study in Deception in Security http://www.dslreports.com/forum/r12300078 en Sun, 29 Nov 2009 18:56:26 EDT Sun, 29 Nov 2009 18:56:26 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12370774 rogue_ :

said by b dalton:

Three comments:

1. The digital signing of a software component (be it an application, plugin, active-x control, or whatever) doesn't guarantee that its safe to use, it merely guarantees that it hasn't been altered by some hacker. That is, if a hacker gets a legit program, alters it into malware, then releases it to the web still in the guise of the original legit program, the malware version of the program won't match the legit program's digital sig (and indeed, the malware won't be signed at all in this case). A side benefit of digital signing is that most hackers won't bother to digitally sign their malware, whether it's an altered version of legit software or an original creation.

It would seem logical to me that the 'hacker' would consider hacking the signature as well if it meant the difference between a hack that worked and one that did not.
--
Bozone (n.): The substance surrounding stupid people that stops bright ideas from penetrating.]]> http://www.dslreports.com/forum/remark,12370774 Thu, 13 Jan 2005 01:16:55 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12370318 anon : Three comments:

1. The digital signing of a software component (be it an application, plugin, active-x control, or whatever) doesn't guarantee that its safe to use, it merely guarantees that it hasn't been altered by some hacker. That is, if a hacker gets a legit program, alters it into malware, then releases it to the web still in the guise of the original legit program, the malware version of the program won't match the legit program's digital sig (and indeed, the malware won't be signed at all in this case). A side benefit of digital signing is that most hackers won't bother to digitally sign their malware, whether it's an altered version of legit software or an original creation.

2. There is a call for Microsoft to "patch" this "loophole" by eliminating the ability for a media file to launch a web page. Well, the WM spec has always allowed for three streams: video, audio, and scripting. The scriptting stream allows (among other things) the media file to contain instructions to launch a particular URL when a particular point in the audio/video stream is reached when being played (QuickTime (and Real, I believe) also has this ability). And there is useful functionality that this allows. Simply doing away with this in order to patch this "loophole" is just more of the "we must cripple useful functionality because it might prove unsafe" mindset that speaks of people running scared. Patching things simply by killing functionality provides a victory to the hackers. Aren't you guys tired of running scared all the time?

3. There is a call for Microsoft to "patch" this "loophole" by reimplementing the DRM mechanism by not displaying any web page or whatever. Well, frakly, most of the comments here regarding the DRM license-fetching mechanism are actually just rabid anti-DRM comments rather than comments about this particular "loophole", and I don't put much weight into these comments. Same goes for the comments that are little more than Microsoft-bashing.]]> http://www.dslreports.com/forum/remark,12370318 Thu, 13 Jan 2005 00:16:58 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12349906 Mele20 : I don't know if this works if you have version 10 installed or if it works with SP2. But you could try this. I did this on XP Pro SP1a after I installed WMP version 9 and wanted to get rid of it.

First, associate all extensions with 6.4 which is included in XP. It's listed as MPLAYER2.EXE in C:\Program Files\Windows Media Player. Remove the checks from 9.0. This is very important. If you don't do this, 9.0 will be removed but 8.0 will be default and while you can still reassociate the extensions at this point with 6.4, you will still have 8.0 on your computer.

Then go to Start/Run and type this command:

RunDll32 advpack.dll,LaunchINFSection %SystemRoot%\inf\wmp.inf,Uninstall

Windows will ask for confirmation and may protest a bit. After uninstalling you will need to reboot and because you reassociated the extensions with 6.4 before doing this, this should remove both version 8 and 9 even though 8 is built into XP and will tell Windows to make 6.4 default.

When I did this, I ended up with a file in the C:\Program Files\Windows Media Player folder DLMIMPORT.exe which is the set up for WMP version 8 and I also have a file wmplayer.exe which is the execute file for WMP version 9. I cannot trash these two files. They come back. But neither of these are the actual players. The two players are GONE.

If this (Mike Hallagan's instructions - the uninstall string is from MS support) doesn't work then there are other suggestions in this very long, ongoing forever, thread: »www.annoyances.org/exec/forum/wi···10069240
--
The first and foremost function of our jurors is to protect private citizens from a tyrannical and intrusive government...Jurors are the last line of defense for liberty. Thomas Jefferson 1789]]> http://www.dslreports.com/forum/remark,12349906 Tue, 11 Jan 2005 00:33:06 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12349323 psloss :

said by bobince

:

> show them how to completely remove WMP 9/10 from their boxes.

How would you do it?

A Google search finds a procedure for doing this that invokes a section of the WMP INF file.
--
Feedback? e-mail: stuff@lupwa.org ]]> http://www.dslreports.com/forum/remark,12349323 Mon, 10 Jan 2005 23:29:12 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12349193 bobince : > show them how to completely remove WMP 9/10 from their boxes.

How would you do it?

The sysoc.inf trick makes an entry for WMP7+ in Add/Remove Windows Components, but this only removes some shortcuts, leaving the application(*) itself in place.

The only way I have found to kill the blighter is to hack out Windows File Protection and then delete it. Not something I'd recommend for noobs though, really, hex-editing system DLLs and that...!

Can I just say 'Media Player Classic' again? (Cheers then.) If WMP 6.4 isn't quite enough (no play queue for music) it's an excellent choice, and can replace the DVD player app, QuickTime and RealPlayer whilst it's at it.

(* - oh, application? I mean "essential part of the operating system" of course. ta MS, I nearly forgot.)]]> http://www.dslreports.com/forum/remark,12349193 Mon, 10 Jan 2005 23:16:47 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12346942 Mele20 : Just instruct people to not use IE and to use WMP 6.4 and show them how to completely remove WMP 9/10 from their boxes.

Those who don't want to do this and who steal music and look at porn...well IMO they get what they deserve. I wouldn't want to make things easy for them. :D

I use FF and WMP 6.4 and version 9 has been yanked off this box (not true that you cannot do it. You can and when you do it correctly, the hidden 6.4 appears and becomes default).

Anyone who can read can understand that the certificates have only to do with whether or not the company that claims to have produced the software actually did produce it. Safety doesn't enter the picture at all.
--
The first and foremost function of our jurors is to protect private citizens from a tyrannical and intrusive government...Jurors are the last line of defense for liberty. Thomas Jefferson 1789]]> http://www.dslreports.com/forum/remark,12346942 Mon, 10 Jan 2005 19:17:13 EDT Re: Technical versus business integrity http://www.dslreports.com/forum/remark,12344959 R2 : Sorry.

Well, ...can only:

write ActiveX programs (controls) for Windows that need to be downloaded by Internet Explorer (or any sub-fraction thereof).

Since MS created the problem by not curtailing the power of ActiveX within Internet Explorer, is it so illogical for them to be the ones fixing it?]]> http://www.dslreports.com/forum/remark,12344959 Mon, 10 Jan 2005 15:25:33 EDT Re: Technical versus business integrity http://www.dslreports.com/forum/remark,12344590 dave :

said by R2

:

As for dave's concern about writing programs only for Windows... well, I guess. Isn't that what many programs are written for anyway?

You misparsed me.

I am not concerned with those who write only for Windows (as opposed to writing for Plan9, or Unix, or whatever).

I am concerned with the problem that only those approved by Microsoft (which group may at some future date fail to include me, or some 14-year-old kid with no budget, or the FSF, or Sun) can write code for Windows.]]> http://www.dslreports.com/forum/remark,12344590 Mon, 10 Jan 2005 14:43:17 EDT Re: Technical versus business integrity http://www.dslreports.com/forum/remark,12344535 R2 : Well, yes, it should have been sandboxed. If it had been we would not be in the mess that we are in right now -- and that's what we all know would happen if it wasn't sandboxed.

To be fully accurate I believe an ActiveX Control (.ocx) is nothing more than a mildly specialized DLL (.dll).

As for dave's concern about writing programs only for Windows... well, I guess. Isn't that what many programs are written for anyway?

I realize it puts MS as the "fox" watching the "hen house", but if they are REALLY interested in Trustworthy Computing perhaps it is time that they started proving it.

Regardless, I really think third-party individuals would be needed to police such a structure -- people like JavaCool, Eric Howes, etc. might need to make "policing" programs to look after the "fox". But at least it is putting some control where there is chaos now...]]> http://www.dslreports.com/forum/remark,12344535 Mon, 10 Jan 2005 14:36:58 EDT Re: Technical versus business integrity http://www.dslreports.com/forum/remark,12343790 EGeezer :

said by B

:

Aren't we then back to reengineering ActiveX back into the sandboxed Java it should have been in the first place?

That's about it.. And having the operating system be its own layer, as in hardware, OS, application and user interface layers. The issue I see with the micro/mini platforms today is that they have integrated up to the application level to the point that they are metastasised beyond present methods of securing them from each other.

We've had an "allow all except" mentality for so long that the exceptions are becoming so huge as to be unmanageable. We will need applications and operating systems that are protected from each other.
--
N-X-211 ====== N-328KF]]> http://www.dslreports.com/forum/remark,12343790 Mon, 10 Jan 2005 12:52:56 EDT Re: Technical versus business integrity http://www.dslreports.com/forum/remark,12343714 B :

said by EGeezer

:

In the meantime, it seems one should be able to always know when some piece of code attempts to install. Subject to restrictions by the system administrator, I feel the system user should have the option of rejecting or installing;

for session only,
until user logoff from the workstation
until workstation power off
permanent install for user
Permanent install for all users

It ain't perfect, but would beat the heck out of permanent - only installs until something better comes along.

Interesting, but that aspect opens up its very own can of worms too. How the heck do you ensure that a program adheres to those rules? As far as I know, ActiveX is just an obscuring way of saying .EXE, and I can't immediately conceive of how one can define those kind of conditional installation periods for executables on a Windows system. ?

Aren't we then back to reengineering ActiveX back into the sandboxed Java it should have been in the first place?

-- B
--
In a realm outside causality and function]]> http://www.dslreports.com/forum/remark,12343714 Mon, 10 Jan 2005 12:41:24 EDT Technical versus business integrity http://www.dslreports.com/forum/remark,12343642 EGeezer : I'm in your camp here in that there are two distinct areas where certs can provide verification and there is an erroneous and widespread user perception that both areas are covered by present certs.

1) Existing certs from Verisign, Thawte et.al. to provide twchnical verification that file/application Af is actually from company Ac. Although this provides a source verification, is it useless as a method to verify the business integrity of company Ac. Any sleazeball with the money can buy a cert for his company Ac from these cert vendors and distribute "certified" malware Af. The DRM is just one more "cert" that causes popup messages from Microsoft implying that DRM certified malware Af should be installed. See Eric's initial post screenshots 1 and 4.

2) A business or (let's call it)"integrity" level cert, not yet in existence as far as I can tell. This is where trusted third parties provide a certification of the business or conduct related integrity of the provider of company Ac who provides file Af

Now, how this could be done;

Would it require another cert technical standard based on X509 or addition of the integrity information on the existing cert?

Who would be - or establish - the "trusted third party" who determines eligibility for "integrity" certification? Would it be ISO? Dun & Bradstreet? Better business bureau? ISAC?

What standards would be applied? Financial stability? software testing by independent labs? criminal background checks on company officers?

As you can see, the implementation issues will be fraught with organizations jockeying to be the controlling provider and certifier and will likely result in "integrity" certification by industry group (Banking, IT, retail, wholesale, travel etc).

In the meantime, it seems one should be able to always know when some piece of code attempts to install. Subject to restrictions by the system administrator, I feel the system user should have the option of rejecting or installing;

for session only,
until user logoff from the workstation
until workstation power off
permanent install for user
Permanent install for all users

It ain't perfect, but would beat the heck out of permanent - only installs until something better comes along.
--
N-X-211 ====== N-328KF]]> http://www.dslreports.com/forum/remark,12343642 Mon, 10 Jan 2005 12:33:52 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12343254 B :

said by dave

:

OK, so we make a restriction that people can only write programs for Windows (which is what you're proposing, for a specific type of program) with Microsoft's permission.

How well do you suppose that will sit with anti-trust authorities around the world?

Err, »en.wikipedia.org/wiki/Trusted_Co···Alliance

-- B
--
In a realm outside causality and function]]> http://www.dslreports.com/forum/remark,12343254 Mon, 10 Jan 2005 11:38:50 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12342566 dave :

said by R2

:

Everyone author that wants to create an ActiveX Control would need to purchase an ActiveX Author Key from MS. Then, the distribution of the second key, the User Key, could be completely controlled by Microsoft.

OK, so we make a restriction that people can only write programs for Windows (which is what you're proposing, for a specific type of program) with Microsoft's permission.

How well do you suppose that will sit with anti-trust authorities around the world?

Plus, you're proposing that Microsoft also act as the police force, denying execution rights for programs that transgress the unwritten rule. That sounds like a political and legal minefield. See the discussions about whether MS can be trusted to run a spyware/adware database!]]> http://www.dslreports.com/forum/remark,12342566 Mon, 10 Jan 2005 10:02:04 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12342504 R2 : Speaking of keys makes me think that the level of sophistication behind this could be bumped up even further. Microsoft holds the rights to ActiveX, correct? It is their 'intellectual property' and they could specifically control how it is used, correct? (That doesn't mean they didn't borrow it from someone else, but that is a different topic!)

Well, if MS wanted to really crack down on ActiveX abuse, they certainly could. Just create a TRUE double key system. Yep. Everyone author that wants to create an ActiveX Control would need to purchase an ActiveX Author Key from MS. Then, the distribution of the second key, the User Key, could be completely controlled by Microsoft.

If you visit a web site that wants to download an ActiveX Control, a new improved Warning Message appears telling you that you do not have the required User Key for this ActiveX Control -- and therefore it will NOT be installed on your system. A button in the box would be used to send the user to the "Microsoft ActiveX User Key Site" where the user can:

specific

OK, this is quite authoritarian, but THIS is what safe computing is all about.

This method also 'closes the circle' and makes 'trusting' authors much more plausible. Additionally, if MS has control of the Author Keys (Certificates) instead of VeriSign, then they would make the money off of the certification process. This depends on whether MS is really more trustworthy than VeriSign. :)

MS would also issue a new key for each ActiveX Control that an author created -- something in the Control itself would need to work with the Author Key for it to work. That way a disgruntled author could not go around creating evil Controls. Plus, MS has the power to pull the User Key off the distribution site if an author's control goes to the Dark Side. Even more complete would be for Windows Update to deactivate "rogue" User Keys if they were identified.

OK, now I am rambling, but you get the idea. I think it is possible to curtail ActiveX, it would just take a little effort...]]> http://www.dslreports.com/forum/remark,12342504 Mon, 10 Jan 2005 09:51:08 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12338477 Doctor Four : Looking at Ben Edelman's analysis of this, it almost seems
to be a variant on the Bofra/iFrame exploit. It is dropping
nearly the same parasites as that one did, in fact it
appears they are identical. I don't know if this is also
the case with the fake WMAs as the example tested was a WMV,
but I'd be willing to bet that the other one does the same.
--
"Kayura or Badamon, whichever you are, you should know that I will never give up this battle. By the will of the Ancient, I shall succeed!" - Shuten (Anubis) from the Ronin Warriors.]]> http://www.dslreports.com/forum/remark,12338477 Sun, 09 Jan 2005 19:48:52 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12335194 B : R2

, I love your reputation-based ActiveX advisory described at »WMP Adware: A Case Study in Deception

It's quite similar, I believe, to the multiply signed keys and web of trust envisioned in the PGP/GPG arena. That is, you trust a key (or signed control) in part based on the trust OTHERS whom you trust have placed in it.

Of course, I still don't accept most ActiveX controls when forced to use IE.

said by R2

:

It's "the reputation of the provider" that is quite difficult to quantitate for the average user -- or any user. Unless the provider is "Microsoft Corp.", it's a crap shoot most of the time. And some would argue that even their reputation is questionable. :)

That's another thing -- does anyone actually trust Verisign and Thawte and GeoTrust to accurately discern ALL possible permutations of known company names?

That is, do you really expect to NEVER be vulnerable to some sleaze who has acquired a "Microsoft Corps." cert instead of the real "Microsoft Corp." one (or whatever the real one is). I know I'm always very suspicious -- the domain buying frenzy of the last 10 years leaves a LOT of companies with very similar corporate names, let alone domain names. (This doesn't even touch on the famous case 2 years ago where prankster/evildoers easily acquired REAL Microsoft certs for themselves, due to the phony Wizard Of Oz do-nothing nature of Verisign.)

One last thing -- as far as I know Thawte is still wholly owned by Verisign, so anything bad or foolish attributed to Thawte (e.g., the "guaranteed safe to install/download" claim above) should be properly blamed on the villainous Verisign organization itself.

-- B
--
In a realm outside causality and function]]> http://www.dslreports.com/forum/remark,12335194 Sun, 09 Jan 2005 12:41:22 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12334461 R2 : It's "the reputation of the provider" that is quite difficult to quantitate for the average user -- or any user. Unless the provider is "Microsoft Corp.", it's a crap shoot most of the time. And some would argue that even their reputation is questionable. :)]]> http://www.dslreports.com/forum/remark,12334461 Sun, 09 Jan 2005 10:37:38 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12332907 NoOneButMe : MPAA and i think the RIAA uses this to play with file traders to]]> http://www.dslreports.com/forum/remark,12332907 Sun, 09 Jan 2005 01:08:18 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12332609 Steve :

said by R2

:

Perhaps this is off base, but doesn't Microsoft at least attempt to create the illusion of a relationship between "authenticated" and "safe"?

For Microsoft-signed things, sure. MS drivers and controls are designed and tested carefully so you can be reasonably sure that you're not getting badware (though it's not a guarantee against defect-free software).

Isn't that ostensibly why ActiveX Controls are divided into "Signed" and "Un-Signed"? IE makes the user choose different settings for "Signed" and "Un-Signed" -- presumedly based on the assumption that "Signed" controls are safer.

Well, in a sense they are safer because your decision-making process has more information.

As dave

has suggested, there are multiple dimensions of quality+safety, and part of assessing that is "the reputation of the provider". With signed code you can consider that, but with unsigned you cannot.

Steve
--
Stephen J. Friedl � Unix Wizard � Microsoft Security MVP � Tustin, California USA � my web site]]> http://www.dslreports.com/forum/remark,12332609 Sun, 09 Jan 2005 00:17:12 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12332518 R2 :

said by Steve

:

...all the certificate stuff says that it really and truly was produced by the company it claims to be (Microsoft, Adobe, Screw-U Software), and that company claims that it's safe.

Let me back track. Perhaps this is off base, but doesn't Microsoft at least attempt to create the illusion of a relationship between "authenticated" and "safe"?

Isn't that ostensibly why ActiveX Controls are divided into "Signed" and "Un-Signed"? IE makes the user choose different settings for "Signed" and "Un-Signed" -- presumedly based on the assumption that "Signed" controls are safer. But aren't these "Thawte certified" controls the definition of "signed" controls?? Would anyone consider these controls safe? Eric says 31 different programs are installed. Safe?]]> http://www.dslreports.com/forum/remark,12332518 Sun, 09 Jan 2005 00:06:23 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12332123 Steve :

said by SnowyOne

:

Yes, but statements like "Thawte guarantees the software has not been tampered with and is therefore safe to install/download." made by companies that should know better sure don't help.

Are you serious? That is actually what they claim?

wow - what idiots.
--
Stephen J. Friedl � Unix Wizard � Microsoft Security MVP � Tustin, California USA � my web site]]> http://www.dslreports.com/forum/remark,12332123 Sat, 08 Jan 2005 23:09:23 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12332099 SnowyOne :

said by R2

:

That is why we have SpywareBlaster, AdAware, etc. Users cannot be expected to ACTUALLY use their head. Haven't we learned that already?

Yes, but statements like "Thawte guarantees the software has not been tampered with and is therefore safe to install/download." made by companies that should know better sure don't help.
--
Houoli Makahiki Hou ]]> http://www.dslreports.com/forum/remark,12332099 Sat, 08 Jan 2005 23:05:56 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12332060 R2 :

said by Steve

:

It is hard to imagine a technological approach that will obviate the need to use your friggin' head.

Ah... but that is EXACTLY what we need. That is why we have SpywareBlaster, AdAware, etc. Users cannot be expected to ACTUALLY use their head. Haven't we learned that already?

Wow, your last post is even more cynical than mine! ;)]]> http://www.dslreports.com/forum/remark,12332060 Sat, 08 Jan 2005 23:00:11 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12332044 Steve :

said by R2

:

But you have the ability to choose which "Anti-Crapware" program or "Crapware Definition List" you want to use.

The free market works for "reputations" as effectively as it does "ideas" and "prices"

Steve
--
Stephen J. Friedl � Unix Wizard � Microsoft Security MVP � Tustin, California USA � my web site]]> http://www.dslreports.com/forum/remark,12332044 Sat, 08 Jan 2005 22:57:41 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12332026 R2 :

said by SnowyOne

:

a dozen rogue software rating services would popup overnite.

Agreed. But you have the ability to choose which "Anti-Crapware" program or "Crapware Definition List" you want to use. For example, you may choice hpguru's list because you know him from what he posts here. You may choose Eric's IE-SpyAd list because of his posts here.

Grant it, some people will be duped by bogus list makers. We cannot prevent every bad thing from happening...]]> http://www.dslreports.com/forum/remark,12332026 Sat, 08 Jan 2005 22:56:11 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12332015 Steve :

said by dave

:

Certificates only deal with (1), but people are somehow expecting them to deal with (2) as well.

When you see that traditional ActiveX download dialog box, all the certificate stuff says that it really and truly was produced by the company it claims to be (Microsoft, Adobe, Screw-U Software), and that company claims that it's safe.

The wording then says that you should only install it only if you trust the company to make that assertion

I trust Microsoft, Adobe, and dave

to make "it's safe" assertions, but I wouldn't trust - say - Gator.

It is hard to imagine a technological approach that will obviate the need to use your friggin' head.

Steve
--
Stephen J. Friedl � Unix Wizard � Microsoft Security MVP � Tustin, California USA � my web site]]> http://www.dslreports.com/forum/remark,12332015 Sat, 08 Jan 2005 22:54:08 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12331990 R2 : I don't think WE are confusing these things -- but I suspect society in general is confusing these. In addition, the situation is further obfuscated by terminology that certainly does not make it easy for the average user to sort these out. Is this intentional or only poor planning?

I think a viable Security model should deal with BOTH of them, but that is not what we are offered. I recognize that, I just don't accept that.]]> http://www.dslreports.com/forum/remark,12331990 Sat, 08 Jan 2005 22:50:27 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12331951 dave : I think, overall, we're confusing two things here:

1. Was this software really produced by who it claims to be produced by?

2. Is this software safe?

Certificates only deal with (1), but people are somehow expecting them to deal with (2) as well.]]> http://www.dslreports.com/forum/remark,12331951 Sat, 08 Jan 2005 22:46:24 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12331769 SnowyOne : Reassurances, that's the part I was missing.
If a reliable software rating (softwarecop) service were to manifest itself, a dozen rogue software rating services would popup overnite. The antispyware market is testament to that.

EDIT You can be reasonably assured that anything offered up by idownloads.com is crap. :)
--
Houoli Makahiki Hou
]]> http://www.dslreports.com/forum/remark,12331769 Sat, 08 Jan 2005 22:20:20 EDT Re: WMP and certificates "sold" as security http://www.dslreports.com/forum/remark,12331742 Steve :

said by dave

:

At some point, I have to decide whether I want to trust 'Screw-U Software' enough to install something that comes from them

... which is influenced, in part, by the prospects of seeing Anna Kournikova naked :)]]> http://www.dslreports.com/forum/remark,12331742 Sat, 08 Jan 2005 22:16:53 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12331662 dave : A hosts file does absolutely nothing to reassure me that the file I'm copying from downloads-r-us.com, ostensibly created by Reliable Software Inc., was in fact created by Reliable Software Inc.

That reassurance requires cryptography.

(OK, it really only tells me that the file was created by someone who knows Reliable Software Inc's private key).]]> http://www.dslreports.com/forum/remark,12331662 Sat, 08 Jan 2005 22:08:39 EDT Re: WMP and certificates "sold" as security http://www.dslreports.com/forum/remark,12331446 SnowyOne : The idownload.com is listed in Hpgurus host file.
It's better than a kick in the head :)
--
Houoli Makahiki Hou ]]> http://www.dslreports.com/forum/remark,12331446 Sat, 08 Jan 2005 21:40:18 EDT Re: WMP and certificates "sold" as security http://www.dslreports.com/forum/remark,12331311 R2 : I would think not. A Hosts file only controls the Name Resolution process. So it could block you from going to a bad site, but it would not prevent a site that was not yet listed from downloading an evil ActiveX control.

That is part of redundancy. You cannot rely on solely a Hosts file to block everything evil as new sites may appear every day, or even every hour.]]> http://www.dslreports.com/forum/remark,12331311 Sat, 08 Jan 2005 21:20:29 EDT Re: WMP and certificates "sold" as security http://www.dslreports.com/forum/remark,12331216 SnowyOne : Wouldn't a well maintained, trusted host file do the same thing as a strict Certificate Security Model?
--
Houoli Makahiki Hou ]]> http://www.dslreports.com/forum/remark,12331216 Sat, 08 Jan 2005 21:07:32 EDT Re: WMP and certificates "sold" as security http://www.dslreports.com/forum/remark,12330968 R2 :

said by dave:
I agree, but how else are you going to do it?

Well, now that you ask... ;)

Ideally one or more third-parties would have to be used to determine the "reliability" of the source.

For example, on various sites where items can be purchased on-line each vendor is rated -- one-to-five stars, for example. You may have no qualms about buying something from a vendor rated 5-star, but you may think twice if the vendor is rated at only 1-star.

If there were one or more non-partisan groups rating the reliability of the various ActiveX sources, then Certificate Security might be useful. The above image is a sort of a joke -- it is not likely that MS would actually list the ratings in the Security Warning dialog box. However, there is a plausible way to make something like that occur.

Much in the same way that we have definition lists for Restricted sites or evil CLSID's, there could be lists of ActiveX providers. Bad or good providers could be placed on a list and this list could be installed on your computer. MS could have the Security Warning box then query this list and display the results in the Warning box. This would identify the provider as either "Reliable", "Unreliable", or "Unlisted". (I don't really think a -10 to +10 scale is necessary!).

This would give credibility to the Certificate Security Model -- because it would form a complete circle. Thawte authenticates that the provider is who it says it is, and your reference list confirms that the provider has been judged to be "reliable" by a source that you trust.

Without this last step I don't see how the Certificate Security Model is useful...

]]> http://www.dslreports.com/forum/remark,12330968 Sat, 08 Jan 2005 20:32:32 EDT Re: WMP and certificates "sold" as security http://www.dslreports.com/forum/remark,12327770 dave :

said by R2

:

One major fallacy of the "Certificate Security Model" is that a routine user is going to know which companies they are to trust and which ones not to trust.

I agree, but how else are you going to do it?

At base, I only install things from sources I trust, or that have been vouched for by people I trust.

There is no other way to determine whether a piece of software is 'desirable' or not, and this applies whether or not there's a certificate system in place or not. At some point, I have to decide whether I want to trust 'Screw-U Software' enough to install something that comes from them.]]> http://www.dslreports.com/forum/remark,12327770 Sat, 08 Jan 2005 12:49:37 EDT Re: WMP and certificates "sold" as security http://www.dslreports.com/forum/remark,12327741 EGeezer : We are in complete agreement - thanks for your expansion of the subject!

The value of certificates as a means of protection has been promoted beyond its technical verification function and marketed to imply that if a source has a valid Thawte, Verisign, etc. certificate that the vendor and/or vendor's product is trustworthy when no such verification has taken place. Anyone with the money can buy a cert.

The level of expectation needs to be set and this marketing of certificates at their present level of function needs to be changed to reflect reality.

I've been in discussions where certifications are proposed based on financial stability, ISO standards, BBB standards ands so on. However, agreement on how to certify and how to implement is far from real progress.
--
N-X-211 ====== N-328KF]]> http://www.dslreports.com/forum/remark,12327741 Sat, 08 Jan 2005 12:45:47 EDT Re: WMP and certificates "sold" as security http://www.dslreports.com/forum/remark,12327644 R2 : I noticed the same thing. However, where exactly does Thawte's role end?

I believe they are only supposed to authenticate that the publisher is who they say they are, but I don't think they have the responsibility to verify that everything Ultra Web Host and iDownload do is 'desirable' for all users.

One major fallacy of the "Certificate Security Model" is that a routine user is going to know which companies they are to trust and which ones not to trust. The dialog box warns you that "Caution: Company X asserts that this content is safe", but there is no way for an average user to know whether Company X is reliable or not. Furthermore, when the Control is disguised with a name such as "Required: Media Player Update", I am sure many users would bother to read all the fine print...

I do not consider myself an routine user. But, if you search the archives here you will find that I also make stupid, hasty mistakes. When trying to quickly view song lyrics on the infamous Lyrics.com site, in my haste I must have clicked something that lead to an onslaught of ActiveX Controls being installed. If I was not in a hurry, it would have never happened -- but my haste cost me about three hours of clean-up work. Certainly a user anxious to view a 'cool' media file in WMP might easily be hasty enough to dismiss these "authenticated" downloads just to get to the video...

Thanks, Eric. I assume the same thing, but one never knows...]]> http://www.dslreports.com/forum/remark,12327644 Sat, 08 Jan 2005 12:32:36 EDT WMP and certificates "sold" as security http://www.dslreports.com/forum/remark,12327327 EGeezer : In view of Microsoft's marketing of "security" certificates as a tool to protect users, the language in the original post screenshots (especially #1 and #4) imply to a user that Microsoft says they need to install this malware and that it is "certified" by Thawte. the implications by MS could lead to actionable damages to users who trust MS based on their promulgations in the message text and public positions.

Anyone smell a lawsuit coming on?

See »M$'s Peter Torr Attacks Firefox Security and linked articles by an MS developer for background of marketing strategy and implications of security.

EDIT - Mozillazine only went back to 12/22, here's the blog itself »blogs.msdn.com/ptorr/archive/200···511.aspx and a link to an EWeek article at »blog.ziffdavis.com/seltzer/archi···183.aspx
EG

(PLEASE, no IE Vs. FF replies. start a new thread if you feel compelled :) )
--
N-X-211 ====== N-328KF]]> http://www.dslreports.com/forum/remark,12327327 Sat, 08 Jan 2005 11:46:28 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12327161 eburger68 : R2:

My understanding is that the hosted instance of IE used for license acquisition behaves like any other default IE window, which means that it should be classed as the Internet zone.

Eric L. Howes]]> http://www.dslreports.com/forum/remark,12327161 Sat, 08 Jan 2005 11:21:37 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12326642 R2 : I think we can dismiss the anonymous posts about "porn" as jokesters -- or people who clearly don't grasp the issue.

I suspect ryri's point about the Restricted sites zone is valid. I don't have time to test this, but WHAT IS the zone that these are run it at present?? Is it the Internet zone? (I certainly hope). In which case a Restricted Internet zone again comes to the rescue. Or, heaven forbid, is this run in the Local Machine (My Computer) zone??]]> http://www.dslreports.com/forum/remark,12326642 Sat, 08 Jan 2005 09:54:02 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12318161 B :
You know those banner ads you hate? They started on porn sites.

You know those popups you hate? They started on porn sites. (and X10).

You know that spyware you hate? They started on porn sites.

You know that spam you hate? They started on porn sites. (Actually a law firm first.)

Do you get me, oblivious?

When there's a potential problem with a tool, you ask the producer to fix it, regardless of context, and within reason. Slapping a ruler across the complainant's knuckles, as you've done, is both easy and pointless. (GM: "You wouldn't need these fancy airbags if you'd just drive safely!")

-- B
--
In a realm outside causality and function]]> http://www.dslreports.com/forum/remark,12318161 Fri, 07 Jan 2005 11:15:35 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12318107 anon : so.. stop looking at porn! and if you simply must feed an online addiction, do not install porn plug-ins for WMP!

The text of the screen shots alone that you include were descriptive enough, to me at least, to indicate the questionable nature of this content about to be installed, and to continue with the install would be assuming some level of risk.

To lay this all on MS is a cop out IMO

caveat emptor]]> http://www.dslreports.com/forum/remark,12318107 Fri, 07 Jan 2005 11:08:39 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12317674 R2 : Well, you could locate the DLL and rename that, but you may be dismantling more than you bargained for...]]> http://www.dslreports.com/forum/remark,12317674 Fri, 07 Jan 2005 10:15:58 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12317491 edbott :

>> But why can't I just cripple IE instead? I typically rename IEXPLORE.EXE, which might be enough in some circumstances, but there's nothing to prevent further dismantling. And of course disallowing Windows Explorer's Internet rights in my personal firewall software.

Programs that host an instance of Internet Explorer aren't necessarily using Iexplore.exe. They're usually calling a DLL directly.

Like I said, the best way to avoid this if you're really concerned about it is to change the file association for Windows Media files to another program that can play files without doing DRM.]]> http://www.dslreports.com/forum/remark,12317491 Fri, 07 Jan 2005 09:48:15 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12315879 mers2 :

said by B

:

But why can't I just cripple IE instead? I typically rename IEXPLORE.EXE, which might be enough in some circumstances, but there's nothing to prevent further dismantling. And of course disallowing Windows Explorer's Internet rights in my personal firewall software.

Does Media Player Classic play WMP 10 files yet? (And what places can be trusted for codec packs?)

-- B

I have IE, Windows Explorer and WMP blocked from internet acess by my firewall unless I need to use them. Unfortunately as most users primarily use IE and WMP with unlimited access and a lack of knowledge on renaming files and setting DRM settings in WMP, etc. the only real solution will be a patch by MS.
--
"Think for yourself and let others enjoy the privilege of doing so too." - Voltaire ]]> http://www.dslreports.com/forum/remark,12315879 Fri, 07 Jan 2005 01:12:11 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12315665 B :

said by edbott

:

Using an alternate default browser doesn't help, since the player calls IE to provide the contents of the License Acquisition dialog box. If you're really concerned, the single best thing you could do is change the default associations for WMA and WMV file types to point to an alternate player that doesn't accept DRM. It will just fail when it tries to play a licensed file, without trying to acquire a license.

But why can't I just cripple IE instead? I typically rename IEXPLORE.EXE, which might be enough in some circumstances, but there's nothing to prevent further dismantling. And of course disallowing Windows Explorer's Internet rights in my personal firewall software.

Does Media Player Classic play WMP 10 files yet? (And what places can be trusted for codec packs?)

-- B
--
In a realm outside causality and function]]> http://www.dslreports.com/forum/remark,12315665 Fri, 07 Jan 2005 00:37:26 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12314751 bobince : > Andrew, keep us posted on that please.

Well, the page that would(*) be opened by the licence acquisition process leads into a long chain of CWS crap (paths available on request), including:

- MS-ITS/CHM exploits
- old-school MS Java permissions classload exploits
- one method cacheing exploit
- two HHCtrl exploits

XP SP2 is vulnerable to the last item. AFAIK no patch available yet. This is the first time I have personally seen CWS exploit SP2.

The result would be loading at least:

- CWS/Filter
- CWS smart-security.info desktop background hijacker
- Pugi/Yuups (YuupSearch toolbar, CWS affiliate)
- TIBS dialers (TIBS3, WebSiteViewer)
- MediaTickets (ClickSpring)
- TopConverting (CrazyWinnings)

The last two would of course kick off another round of silent parasite downloads.

(* - haven't had the ad rotator return a pointer to this URL yet, but it's sitting in the ad list.)]]> http://www.dslreports.com/forum/remark,12314751 Thu, 06 Jan 2005 22:47:08 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12312833 Doctor Four : The only legitimate use I see for this function in WMP's
DRM would be for files that could be traded on the P2P
networks, but could only be played a couple of times. Once
your free plays of the DRM-crippled file were over, it would
launch a page in IE the next time that you tried to play it
where you would be offered to buy a license to unlock
the file. This is perhaps how the RIAA-approved P2P networks
being developed will work. Any other use of the DRM,
especially to drop adware/spyware or other parasites, is
clearly a misuse of the technology.
--
"Kayura or Badamon, whichever you are, you should know that I will never give up this battle. By the will of the Ancient, I shall succeed!" - Shuten (Anubis) from the Ronin Warriors.]]> http://www.dslreports.com/forum/remark,12312833 Thu, 06 Jan 2005 19:38:15 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12312475 Daemon : i'll jump in here late, but i do have a few questions/thoughts.

first, if a p2p pr0n file wants to install DRM, you might as well just cancel it and delete it anyway. They are all junk files sent out to flood the network and the vast majority of them are just sample files from real pr0n websites anyway.

second, this just looks like a (possibly) useful feature run amok, where Microsoft didn't consider the possible uses when it wrote it. The ability to open a website in an IE instance could be useful to show a licencing agreement, etc.

I suggest, in the future, that all IE instances spawned by WMP run in the restricted sites zone with active content completely disabled. There is no reason any media content would need to spawn active X controls. However, a DRM file could contain some sort of special codec, which would present itself for download much the same way ActiveX does. I used to get movies that would prompt WMP to install the indeo codec and it used the same dialogs when asking to be installed. (although, those dialogs were spawned by WMPs autodownload feature, not by a DRM link)
--
-Ryan
Computational Engineering Student looking for BioMedical/Computational BioEng internship. PM me if you know of any available!]]> http://www.dslreports.com/forum/remark,12312475 Thu, 06 Jan 2005 19:01:53 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12311682 bobince : This is actually a worry for Firefox users, as by default it tries to allow Windows Media Player to be used in a plug-in on web pages. (This has never worked on my system, for which I am thankful, but I've seen it running fine elsewhere.) I think WMP always uses Internet Explorer to display the license acquisition process regardless of the default browser settings.

So if you were running FF on a web page it could probably (I've not tested this yet but can't see any reason why not) include an embedded WMP file that launched an IE window with an exploit in.

So the only solution I can think of is just never to let that MS DRM "security" "upgrade" install.

Media Player Classic is safe for launching media files from the desktop though. (And kicks WMP's arse, as far as I'm concerned.)]]> http://www.dslreports.com/forum/remark,12311682 Thu, 06 Jan 2005 17:40:02 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12310848 Lou_n_Di : FWIW-
These are the folks responsible for the code used---
It's a shame mail bombs are now illegal

]]> http://www.dslreports.com/forum/remark,12310848 Thu, 06 Jan 2005 16:07:32 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12310403 gkweb : excellent research and explanation, good job ;)

regards,

gkweb.]]> http://www.dslreports.com/forum/remark,12310403 Thu, 06 Jan 2005 15:21:11 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12310199 edbott :

So do I correctly gather that if you stay away from MS DRM, use alternate players, and use any browser except Internet Explorer, then WMV files are fairly safe?

Using an alternate default browser doesn't help, since the player calls IE to provide the contents of the License Acquisition dialog box. If you're really concerned, the single best thing you could do is change the default associations for WMA and WMV file types to point to an alternate player that doesn't accept DRM. It will just fail when it tries to play a licensed file, without trying to acquire a license.]]> http://www.dslreports.com/forum/remark,12310199 Thu, 06 Jan 2005 14:58:53 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12308892 suzi :

quote:
FWIW we're currently looking at another source of parasite-poisoned DRM'd media files that *does* seem to point to a IE security hole exploit (CoolWebSearch, again).

Andrew, keep us posted on that please.
--
aka Suzi, Spyware Warrior]]> http://www.dslreports.com/forum/remark,12308892 Thu, 06 Jan 2005 12:35:44 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12307841 B :
Perversely, this all makes me happy!

I was under the impression it was a LOT easier than this to exploit WMV files. I've seen WMV files launch the browser unexpectly, and I was under the impression they could launch HLP files too.

But the evilware companies here are jumping (or their victims are) through several different hoops in order to get the malware running.

So do I correctly gather that if you stay away from MS DRM, use alternate players, and use any browser except Internet Explorer, then WMV files are fairly safe?

Thank you for your fine work yet again, Eric. (And Ed and Ben too. Welcome to DSLR.)

-- B
--
In a realm outside causality and function]]> http://www.dslreports.com/forum/remark,12307841 Thu, 06 Jan 2005 10:34:38 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12307250 bobince : FWIW we're currently looking at another source of parasite-poisoned DRM'd media files that *does* seem to point to a IE security hole exploit (CoolWebSearch, again).

Stay away from untrusted ASF (WMA/WMV) files, kids!]]> http://www.dslreports.com/forum/remark,12307250 Thu, 06 Jan 2005 09:13:21 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12304621 MrBentor : The base article that Eric wrote here is very good. In depth it is actually disturbing.

I like to know exactly what is going on at all times and that is getting harder and to do that. It is taking so many more eyes and brains looking at every little facet of modern software to know what is above board and what needs a closer look.

I’m glad to have folks like you on our watch.]]> http://www.dslreports.com/forum/remark,12304621 Wed, 05 Jan 2005 22:41:54 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12304559 edbott : I believe the connections are being made so that the player can update the page with the online services on it (icons, etc.). I honestly don't know if you can disable it, although I suspect you could just set the media player for offline access and that might do it.]]> http://www.dslreports.com/forum/remark,12304559 Wed, 05 Jan 2005 22:35:12 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12304494 MrBentor : Thanks for that, I just re-looked at that what you pointed out, edbott, and I see what you are talking about. But my concern is that I am never opening that tab or looking at the “guide.” I am not using that feature at that time. I am directly opening local video-camera generated files; which directly opens WMP and plays back the content. I do not have the options enabled statistics sharing with MS activated and basically have told it not to download content automatically. All of that content seems not to be downloaded until that tab is activated, but nevertheless opening a local file still makes WMP ping all those sites every time.]]> http://www.dslreports.com/forum/remark,12304494 Wed, 05 Jan 2005 22:28:28 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12304445 Owlbet :

said by Transmaster

:

Wow 10 out of 10!!!! this is the kind of info' which keeps me coming back for all of these years.

I agree. Erics threads are always informative, enlightening, & educational. I suck up every word and then spread the word.

As usual, Eric, two thumbs up.
--
Rocky is, was, and always will be Dawg E. Dawg.]]> http://www.dslreports.com/forum/remark,12304445 Wed, 05 Jan 2005 22:23:22 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12304351 edbott : Those are the online stores available with WMP 10, music and video and radio. If you choose View, Online Stores you will see virtually all of the companies on that list.]]> http://www.dslreports.com/forum/remark,12304351 Wed, 05 Jan 2005 22:13:55 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12304266 MrBentor : Maybe you all have seen something similar from WMP. I posted the following to grc.spyware on 12/4/2004 and repost for the purposes of reiteration and experience sharing. And as one who has noticed some strange activity from WMP even when playing files I created with my own video camera I wanted to see who else experienced this. This is getting so that even one with fifteen years in the “industry” can’t tell what the hell is going on. I sometimes want to move to an isolated island with only Margarita serving me Margaritas!

#[include]
What is Microsoft Windows Media Player (v.10) doing pinging all
of these sites every time I open a local video file? All I did
was open a local file and then I noticed that the Firewall log
would burst with the lines seen below.

Why is WMP pinging these sites every time I open a local video
file (even if it is one I shot myself not that it matters)?

What exactly is being transmitted and received?

Why is the details of this not in the help files?

Behavior seems the same every time: I open the .WMV or .AVI
file which auto launches Microsoft Windows Media Player.

I could not make out what was in the data traffic I reviewed in the capture file from the packet sniffer (netmon)

I am not a spring-chicken here either. I’ve been a computer
tech and network admin for many years, and I remember when there
was just UUCP. I also currently perform basic network and system
security at my day job, so my curiosity is doubled. I saw this on
my home system can only fret what is going on in the corporate
network.

Enquiring minds just want to know.

Firewall Log Sample for the few seconds in which I started one local .WMV or .AVI file....

2004/12/04 20:46:02 TCP from 192.168.1.10:2321 to www.go.microsoft.akadns.net (207.46.248.122):80
2004/12/04 20:46:02 TCP from 192.168.1.10:2322 to entimg-origin.msn.com (207.68.181.118):80
2004/12/04 20:46:02 TCP from 192.168.1.10:2324 to locator.metadata.windowsmedia.com.akadns.net(207.46.196.121):80
2004/12/04 20:46:02 TCP from 192.168.1.10:2325 to www.go.microsoft.akadns.net (207.46.248.122):80
2004/12/04 20:46:03 TCP from 192.168.1.10:2326 to sms.napster.com (63.241.55.113):80
2004/12/04 20:46:03 TCP from 192.168.1.10:2327 to cinemanow.com (147.208.188.228):80
2004/12/04 20:46:03 TCP from 192.168.1.10:2328 to 63.236.14.35 (63.236.14.35):80
2004/12/04 20:46:03 TCP from 192.168.1.10:2329 to downloads.walmart.com (161.170.254.27):80
2004/12/04 20:46:03 TCP from 192.168.1.10:2330 to www.xmradio.com (216.251.231.128):80
2004/12/04 20:46:03 TCP from 192.168.1.10:2331 to courttv.com (209.73.26.183):80
2004/12/04 20:46:03 TCP from 192.168.1.10:2332 to 209.133.113.22 (209.133.113.22):80
2004/12/04 20:46:03 TCP from 192.168.1.10:2333 to moontax.vo.llnwd.net (69.28.159.7):80
2004/12/04 20:46:03 TCP from 192.168.1.10:2334 to 63.240.84.86 (63.240.84.86):80
2004/12/04 20:46:03 TCP from 192.168.1.10:2335 to a1321.cb.akamai.net (66.93.87.72):80
2004/12/04 20:46:03 TCP from 192.168.1.10:2336 to music.msn.com (207.68.180.245):80
2004/12/04 20:46:03 TCP from 192.168.1.10:2337 to downloads.walmart.com (161.170.254.27):80 ]]> http://www.dslreports.com/forum/remark,12304266 Wed, 05 Jan 2005 22:06:10 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12303993 edbott :

>> In retrospect, it all looks like a high-tech game of "telephone."

Exactly, and that was my point in my original post. I certainly wasn't trying to "throw cold water" on the story, and please note that as soon as I heard that a sample file existed I contacted you to get a copy so I could do my own tests.

I do wish the larger sites would pick up on the real story, which is important and which people like you and Ben and Andrew and Suzi and me have dug out the hard way. But I guess that isn't sexy enough.]]> http://www.dslreports.com/forum/remark,12303993 Wed, 05 Jan 2005 21:37:15 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12303894 eburger68 : Ed:

You wrote:

said by edbott

:

My original post was skeptical about both of these reports, which were posted on very high traffic Web sites (Boing Boing is insanely popular, with more than 200,000 unique visitors a day and countless RSS subscribers). It turns out my skepticism was justified.

Fair enough. The Techdirt and Boing-Boing stories were not the best. Indeed, that's the kind of careless/clueless reportage that would have gone on no matter what PC World had written. The real story here is rather involved and difficult to understand, and Techdirt and Boing-Boing predictably made a hash of it. I see that all the time with spyware/adware issues, which are inherently confusing.

The PC World story, on the other hand, was well done for the most part. I just re-read it, and for the complexity of the issues covered, it does a respectable job of conveying the essentials. Here and there I might prefer a slightly different choice of words, but it's pretty close to what we understand now. Certainly nothing in there is outright false.

Just for the record, PC World was the first out with the word on this story. I wrote about it here at DSLR in the other discussion thread on this topic. DSLR/BBR news then picked it up, pointing both to the PC World story and the Security forum discussion thread. Techdirt got it from BBR/DSLR news, and Boing-Boing from Techdirt. In retrospect, it all looks like a high-tech game of "telephone."

Eric L. Howes]]> http://www.dslreports.com/forum/remark,12303894 Wed, 05 Jan 2005 21:27:24 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12303363 SYNACK : Thanks for the detailed analysis. Scary stuff.

Hopefully, the new California Spyware law can slow them a bit.

said by suzi:
I ended up with 11 desktop shortcuts for everything from "Get This Weeks Deals from Dell" to ...

Any good anti-spyware law also needs to go after the companies that advertise via spyware.]]> http://www.dslreports.com/forum/remark,12303363 Wed, 05 Jan 2005 20:36:41 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12302990 edbott : I'm not the only one who interpreted the PC World story as meaning that the Windows Media files in question actually contained spyware code.

Techdirt wrote:

Overpeer, a subsidiary of Loudeye, has been caught hiding adware and spyware within Windows Media files. [emphasis in original]

Boing Boing, which picked up the story from Techdirt, read it that way too:

According to PCWorld and TechDirt, Windows DRM contains a flaw that allows for attakcers [sic] to create music files that contain trojans that attack your computer when you play them. [emphasis added]

My original post was skeptical about both of these reports, which were posted on very high traffic Web sites (Boing Boing is insanely popular, with more than 200,000 unique visitors a day and countless RSS subscribers). It turns out my skepticism was justified.

These "poisoned" files don't contain spyware. Rather, they use a DRM mechanism to open a dialog box that hosts a Web page that can try to fool a user into installing hostile software. That's not good, and the techniques used to push the crapware contained on those Web pages are sleazy. But the files themselves do not contain any hostile code, and the user has to be tricked into cooperating before anything gets installed. That's a far cry from what was in the three original and sensationalist stories.

There are no corrections at any of those three sites, by the way. So what the average user thinks is "the Internet is riddled with WMA files that contain viruses and trojan horses and spyware." Even though that simply isn't true.]]> http://www.dslreports.com/forum/remark,12302990 Wed, 05 Jan 2005 19:55:35 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12301560 MagMan : Nice info Thanks;)]]> http://www.dslreports.com/forum/remark,12301560 Wed, 05 Jan 2005 17:23:27 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12301496 Transmaster : Wow 10 out of 10!!!! this is the kind of info' which keeps me coming back for all of these years. ]]> http://www.dslreports.com/forum/remark,12301496 Wed, 05 Jan 2005 17:18:50 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12301359 eburger68 : Ed:

You wrote:

said by edbott

:

The one license agreement says it will pop up porn ads on my computer. The other says it will do a whole paragraph's worth of awful things, including installing more spyware. I'm not sure which program is doing the installation of the 31 extras, because I didn't actually allow my test machine to be taken over.

It was the first one that installed most of the software in my testing, and that matches what Ben found as well.

The second one did install a few things, but not much beyond what was already there. I'm guessing that much of what it could have and would have installed independently was already installed by the time I clicked through the iDownload.com installation prompt.

Eric L. Howes]]> http://www.dslreports.com/forum/remark,12301359 Wed, 05 Jan 2005 17:06:06 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12301291 anon : Quit looking at pr0n]]> http://www.dslreports.com/forum/remark,12301291 Wed, 05 Jan 2005 16:58:08 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12300870 edbott : I should have put "honest" in quotes. How many more ways do I have to say these people are sleazy scumbags?

The one license agreement says it will pop up porn ads on my computer. The other says it will do a whole paragraph's worth of awful things, including installing more spyware. I'm not sure which program is doing the installation of the 31 extras, because I didn't actually allow my test machine to be taken over.

And the fact that it was in the license agreement doesn't make it right or acceptable or "honest." My point is that someone who is suspicious will find plenty of reasons not to click Install; someone who is naive may well be fooled by the social engineering techniques.]]> http://www.dslreports.com/forum/remark,12300870 Wed, 05 Jan 2005 16:17:48 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12300769 eburger68 : Ed:

I'm happy to let readers peruse your several comments on this issue and make up their own minds as to whether they were appropriate or not.

There are, however, two minor points that you make that I want to repond to:

said by edbott

:

The clear implication was that simply playing a music or video file will install a program on your machine. That turned out not to be true, as you and I have both shown.

That's one way to read that particular sentence from PC World. Another way is to read it is as literally as possible. Is the code contained in the WMP files *capable* of installing adware? Answer: yes. Now, assuming the user's IE is fully patched, the user's click-through is required, but that's a minor detail. PC World certainly could have qualified that statement just a bit, but strictly speaking what PC World wrote was correct.

said by edbott

:

I was shocked at how honest the license agreements were in describing the crappy things these programs would do.

But, Ed, they were *not* honest -- far from it. That's the whole point. I have seen spyware/adware EULAs that were scrupulously honest in the detail they provided about the software to be installed, but these two particular EULAs were not anywhere near that detailed, esp. the Ultra Web Host LLC EULA which said next to nothing. Failing to disclose the installation of 31 separate spyware/adware programs is the very definition of "unfair" and "deceptive" business practices.

Regards,

Eric L. Howes]]> http://www.dslreports.com/forum/remark,12300769 Wed, 05 Jan 2005 16:06:39 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12300522 edbott : I have a detailed response here:

»www.edbott.com/weblog/archives/000351.html

Quick summary:

My initial response was skeptical, and accurately so. The PC World article said, "PC World has learned that some Windows Media files on peer-to-peer networks such as Kazaa contain code that can spawn a string of pop-up ads and install adware." [emphasis added]. The clear implication was that simply playing a music or video file will install a program on your machine. That turned out not to be true, as you and I have both shown.

My remarks about digital signatures were not intended to justify the purveyors of this garbage or to imply that signed programs are somehow safe. My remarks were aimed at the readers of this forum and my Web site, who are already well informed about spyware and viruses and would be deeply suspicious of these dialog boxes. I was shocked at how honest the license agreements were in describing the crappy things these programs would do. I don't expect a sophisticated, suspicious user to be fooled by this stuff. I also don't expect a naive user to read license agreements ever.

As for "blaming the user," I stand by the remark I made. You are demanding that Microsoft patch this vulnerability. I agree that that should be done. But the reason that viruses and spyware spread is because no matter how hard we try to educate the masses, many people simply don't install patches after they're released. I get virus-infected e-mail messages every day, and my mail server blocks many more. In most cases those viruses can be prevented by a patch that were released three or four years ago. If someone hasn't installed a Critical Update from 2001, why would they install a new one to fix this vulnerability when it's available?]]> http://www.dslreports.com/forum/remark,12300522 Wed, 05 Jan 2005 15:40:06 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12300078 eburger68 : Ed:

You wrote:

said by edbott

:

As I've said since Day One, I believe that this is a security flaw and that Microsoft needs to issue a patch to Windows Media Player 9 and release it as a Critical Update. That's a far cry from an "attempt to minimize and pooh-pooh the risk or to subtly suggest that users are the problem for not upgrading to XP SP2 and for clicking through installation prompts."

I'm glad that you agree that MS needs to patch this behavior, but your comments have not always been as clear and unambiguous as you have suggested. First, you tried to throw cold water on the story:

»www.edbott.com/weblog/archives/000334.html

Then when you had the sample file in hand, you spent most of your next blog entry explaining why this wasn't such a serious problem:

»www.edbott.com/weblog/archives/000340.html

A comment like this...

said by Ed Bott:
The programs in question are digitally signed and are from known companies. The terms of service make it clear what you're getting. It takes one click and 10 seconds of reading to realize that the correct answer is no.

...is so misguided one hardly knows where to begin. And it was only after Ben, Suzi, and Andrew protested that you began clarifying your remarks.

Even after explaining in your next blog entry that you weren't trying to blame the user ( »www.edbott.com/weblog/archives/000341.html ), you ended your denial with these odd quips:

said by Ed Bott:
But really, isn't that the real problem here? People running old operating systems, with only a dim awareness of the need to do updates and a willingness to install anything? ... But how likely is it that the type of user Suzi is describing will download and install that patch?

As for contacting Microsoft Security, to the best of my knowledge they are already aware of this problem.

Regards,

Eric L. Howes]]> http://www.dslreports.com/forum/remark,12300078 Wed, 05 Jan 2005 14:47:51 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12299887 TheWickerMan : Scary stuff, to be sure.

I've flat-out refused to install any of that DRM junk from the beginning. Looks like I have even more reason to do so now.]]> http://www.dslreports.com/forum/remark,12299887 Wed, 05 Jan 2005 14:26:22 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12299855 edbott : Eric, have you reported your findings to Microsoft?

I have sent a report to security@microsoft.com. If you actually want a patch to get written, that's an important step. I'll let you know if I hear back. You might want to send your findings as well.

As I've said since Day One, I believe that this is a security flaw and that Microsoft needs to issue a patch to Windows Media Player 9 and release it as a Critical Update. That's a far cry from an "attempt to minimize and pooh-pooh the risk or to subtly suggest that users are the problem for not upgrading to XP SP2 and for clicking through installation prompts."]]> http://www.dslreports.com/forum/remark,12299855 Wed, 05 Jan 2005 14:23:01 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12299597 edbott : Excellent work, Eric.

Just for the record, I am not trying to minimize this. My statement that this is not "new and horrifying" simply reflects the reality that these are the exact same techniques that purveyors of crapware have been using from Web sites for years. The ActiveX dialog boxes you show here are identical in every respect to those that users see when they visit Web pages that push the same software. This is merely a new variation on an old theme.

The reason that spyware and viruses are epidemic is that older versions of Windows make it easy for people to push this crap, and as you correctly note, the confusing interfaces make it easy for naive users to be fooled by basic social engineering.

The bigger problem is finding a way to protect users of older Windows versions from agreeing to this stuff, regardless of where it comes from. If you fix the ActiveX problem in IE, you fix it here. It worked in Windows XP SP2, and there needs to be an equally effective way to make that protection work for users of older operating systems.

Ed Bott
»www.edbott.com/weblog]]> http://www.dslreports.com/forum/remark,12299597 Wed, 05 Jan 2005 13:47:57 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12299153 Cudni : Thank you for this fine fine report. It is as interesting as it would be scary for an ordinary user if faced with deluge of requests and popups (and most would succumb long before you did).
Add the desire to view the file, mix that with bona fide file from MS and user will think that anything after it is kosher.

Cudni
--
Whether you think that you can, or that you can't, you are usually right.
Help yourself so God can help you..it does exactly what it says on the sig]]> http://www.dslreports.com/forum/remark,12299153 Wed, 05 Jan 2005 12:55:13 EDT Re: WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12299078 eburger68 : Hi All:

I thought I'd provide a handy run-down of links to information on the WMP Adware story elsewhere on the web:

PC World stories:
»www.pcworld.com/news/article/0,a···6,00.asp
»www.pcworld.com/news/article/0,a···3,00.asp

DSLR discussion threads:
»Adware Installed through WMA Files
»WMP Adware: A Case Study in Deception

DSLR news topic:
»Spyware Hidden in WMA Files

Write-up by Ben Edelman:
»www.benedelman.org/news/010205-1.html

Write-ups by Ed Bott:
»www.edbott.com/weblog/archives/000334.html
»www.edbott.com/weblog/archives/000340.html
»www.edbott.com/weblog/archives/000341.html
»www.edbott.com/weblog/archives/000342.html

Spyware Warrior blog entries:
»netrn.net/spywareblog/archives/2···a-files/
»netrn.net/spywareblog/archives/2···a-files/
»netrn.net/spywareblog/archives/2···edelman/

Spyware Warrior discussion:
»spywarewarrior.com/viewtopic.php?t=8920

Other blog entries:
»techdirt.com/articles/20041230/0···_F.shtml
»www.boingboing.net/2004/12/30/wi···ici.html
»p2pnet.net/story/3421

Slashdot discussion:
»it.slashdot.org/article.pl?sid=0···2&tid=17

Best,

Eric L. Howes]]> http://www.dslreports.com/forum/remark,12299078 Wed, 05 Jan 2005 12:46:10 EDT WMP Adware: A Case Study in Deception http://www.dslreports.com/forum/remark,12298989 eburger68 : Hi All:

As you all know, it was recently discovered that Windows Media Player (WMP) files can serve as the vehicle for spyware and adware installations (see »Adware Installed through WMA Files ). Ben Edelman and Ed Bott have documented the installation process on Windows XP, including Windows XP SP2 -- see:

Ben Edelman: Media Files that Spread Spyware
»www.benedelman.org/news/010205-1.html

Ed Bott: "Poisoned" Windows Media files: more details
»www.edbott.com/weblog/archives/000340.html

For those who have not followed this story, researchers have discovered specially designed Windows Media Player files that will initiate the installation of spyware and adware when users attempt to play those files. These specially designed media files exploit the DRM (Digital Rights Management) functionality that Microsoft built into Windows Media Player by opening web pages in hosted instances of Internet Explorer. The ostensible purpose for opening these special Internet Explorer windows (which resemble dialog boxes) is to acquire license information needed to play the media files. Once open, though, these hosted instances of Internet Explorer can be used to initiate the download and installation of spyware and adware, just as happens in drive-by-downloads at regular web sites.

Windows XP SP2 vs. Earlier Versions of Windows

As Ed Bott has noted, Windows XP SP2 does offer some protection against this exploit, provided users are also running Windows Media Player 10. On Windows XP SP2 w/ Windows Media Player 10 the special Internet Explorer window that opens when Windows Media Player attempts to acquire license information for the media file will behave just like any other instance of Internet Explorer when web sites inititate the installation of ActiveX controls. That means SP2's Internet Explorer will automatically block the installation of those ActiveX controls and display summary information in the SP2 Information Bar, thus lessening the possibility that users will be bamboozled into consenting to the installation of unwanted spyware and adware.

If users are running Windows Media Player 9, however, those XP SP2 security enhancements will not protect users because, as Ed Bott observes, the "instance of IE that is being hosted in the WMP9 License Acquisition dialog box is not interacting properly with the security restrictions in SP2." Instead of seeing the XP SP2 Information Bar, users will see the standard ActiveX Security Warning box -- common to earlier versions of Internet Explorer -- prompting them to install software.

These installation prompts, we already know, are inherently confusing for most users, especially when users encounter them in unexpected circumstances (see my submission to the FTC last April for an extended discussion of this issue: »https://netfiles.uiuc.edu/ehowes/www/dbd-anatomy.htm ). Indeed, the whole purpose of the XP SP2 security enhancements was to improve Internet Explorer's handling of ActiveX installations and thus make the automated installation of software online less confusing for regular users. If users misunderstand what they are being asked to install, they could wind up consenting to the installation of unwanted spyware and adware.

As others have observed, many users will not be running Windows XP SP2 and thus will not enjoy the enhanced protections offered in that service pack. They may be running Windows XP without SP2, or they may even be running earlier versions of Windows. In such cases, users will also encounter standard ActiveX installation prompts, making these Windows Media Player adware installations as confusing and deceptive as the automated installations of spyware and adware that users already encounter at third-party web sites, as Ben Edelman stressed in his write-up.

Who's At Fault?

Some commentators have attempted to minimize the risks posed by this new method for installing spyware and adware, pointing out that with a fully patched version of Internet Explorer no software will be installed without users first being given notice in some form. Thus, these skeptics insist, users who consent to the installation of unwanted software through this process are themselves at fault for clicking through the installation prompts.

But just how clear are the installation prompts presented to users? How easy would it be for users to unwittingly consent to the installation of spyware and adware while attempting to play Windows Media Player files they had encountered on the Net or on a P2P file sharing network?

The answers to these key questions, I discovered, are quite disturbing. Taken in its entirety, the installation process that users will encounter when attempting to play these rogue Windows Media Player files is extremely baffling.

For starters, the installation prompts are presented in confusing circumstances, as most users would never expect that they could acquire spyware and adware simply by playing media files. Still worse, though, the several spyware and adware installation prompts are specifically designed to exploit this initial confusion and coerce users into falsely believing that the spyware and adware programs are license files or even security upgrades to Windows Media Player required to view the media files.

In sum, the installation process used by these Windows Media Player files is among the most deceptive installation processes I have ever encountered, and it is entirely understandable that users could unwittingly consent to the installation of an unbelievable load of spyware and adware.

To illustrate what many users will encounter on versions of Windows other than Windows XP SP2 and with versions of Windows Media Player prior to version 10, I tested the same Windows Media Player file used by Ben Edelman and Ed Bott on a PC with Windows 2000 SP4, Internet Explorer w/ SP1, and Windows Media Player 9. Attached to this post are four screenshots that are critical to understanding the confusion deliberately created by adware vendors through this Windows Media Player license acquisition and software installation process.

Confusion, Deception, & Coercion

When I attempted to play the Windows Media Player file (P2Pporn.wmv), I immediately encountered a prompt to install a "Security Upgrade" for Windows Media Player 9 (see the attached WMP901.JPG screenshot). This is, in fact, a legitimate Microsoft security file, as explained on the "Learn More" information page ( »www.microsoft.com/windows/window···yer.aspx ):

said by Microsoft:
Security Upgrade
Owners of secure content may also require you to upgrade some of the DRM components on your computer before accessing their content. When you attempt to play such content, Windows Media Player will notify you that a DRM Upgrade is required and then ask for your consent before the DRM Upgrade is downloaded (third party playback software may do the same). If you decline the upgrade, you will not be able to access content that requires the DRM Upgrade; however, you will still be able to access unprotected content and secure content that does not require the upgrade. If you accept the upgrade, Windows Media Player will connect to an Internet site operated by Microsoft and will send a unique identifier along with a Windows Media Player security file. This unique identifier does not contain any personal identifiable information. Microsoft will then replace the security file with a customized version of the file that contains your unique identifier. This increases the level of protection provided by DRM.

I clicked OK to allow the "security upgrade." It is important to note that even though this particular file was a legitimate Microsoft upgrade, it plays an important role in creating a potentially confusing set of expectations for users, who will encounter still more prompts to install software that is apparently required to play the media file.

Confusion...

After clicking through the "Security Upgrade" installation prompt I next encountered a box titled "License Acquisition" (see WMP902b.JPG). This was a special, hosted instance of Internet Explorer that displayed a web page from:

»www.protectedmedia.com/licensede···rial.asp

That "License Acquisition" box was quickly covered over, however, with an ActiveX Security Warning box prompting me to install software from "Ultra Web Host LLC" (see WMP903.JPG). This ActiveX installation was initiated by the same hosted instance of Internet Explorer that displayed the "License Acquisition" box. Indeed, many users would not even see the "License Acquisition" box because it is so quickly covered over. Moreover, they won't be able to return to that "License Acquisition" box (which contains a "Play" button) until they deal with the multiple ActiveX installation prompts.

The description for this software is not especially noteworthy. The ActiveX prompt box merely claims that "You Must Agree to Our Terms and Conditions," a claim that will be unsurprising to most users at this point. And the name of the company, "Ultra Web Host LLC," does nothing to suggest that anything is amiss -- strangely named companies are a dime a dozen on the Web.

Some might point out that users can click the "You Must Agree to Our Terms and Conditions" link to view the End User License Agreement (EULA), which opens in an Internet Explorer window ( »spidersearch.com/barterms.php ). Setting aside the fact that many users will not know enough to click the link, that EULA they will encounter is clearly inadequate in the disclosure it provides. The only noteworthy clause comes near the top:

said by SpiderSearch.com:
By downloading our Free Porn Software you agree to receive ads of adult nature.

As Ben Edelman has pointed out, this license is clearly insufficient because it fails to disclose the installation of third-party software, which is in fact what will happen. Moreover, because users who intentionally downloaded this file will do so with the expectation of viewing porn, the clause quoted above is not likely to be of concern -- viewing "adult content" would be the entire reason they are attempting to play the media file. Many users will click through this installation prompt, and the result will be the installation of unwanted spyware and adware that was nowhere disclosed in a proper fashon.

When I first encountered the installation prompt for the "Ultra Web Host LLC" software, however, I clicked "No," rejecting the installation. To my surprise, the same prompt box popped up again. Again I clicked "No."

...Deception...

I was then confronted with yet another Active installation prompt, this time for a "Required Media Player Version 9 Browser Update" from iDownload.com (see WMP905.JPG). This installation prompt is particularly deceptive because it is clearly designed to exploit user confusion over the installation of required software for playing media files in Windows Media Player.

It should now be plainly apparent that adware vendors have already started tailoring their installations to Microsoft's WMP license acquisition process in order to maximize user confusion, and this is a rather clever way to do it. Given that users have already clicked through one update for Windows Media Player, many if not most would assume this was simply more of the same. Few regular users are going to fully understand what all these installation prompts mean or how they are in fact crucially different from one another. And that's on top of the fact that they certainly wouldn't expect a media file to be installing adware and spyware in the first place. The iDownload.com install cleverly attempts to preserve the fiction and keep them in the dark.

As with the first ActiveX Security Warning box, users can click a link to view the EULA ( »toolbar.isearch.com/terms.html ). Although this EULA is more extensive in its disclosures, it is still inadequate. The EULA claims:

said by iDownload.com/iSearch.com:
2. Functionality - Software delivers advertising and various information and promotional messages to your computer screen while you view Internet web pages. iSearch is able to provide you with Software free of charge as a result of your agreement to download and use Software, and accept the advertising and promotional messages it delivers.

By installing the Software, you understand and agree that the Software may, without any further prior notice to you, automatically perform the following: display advertisements of advertisers who pay a fee to iSearch and/or it's partners, in the form of pop-up ads, pop-under ads, interstitials ads and various other ad formats, display links to and advertisements of related websites based on the information you view and the websites you visit; store non-personally identifiable statistics of the websites you have visited; redirect certain URLs including your browser default 404-error page to or through the Software; provide advertisements, links or information in response to search terms you use at third-party websites; provide search functionality or capabilities; automatically update the Software and install added features or functionality or additional software, including search clients and toolbars, conveniently without your input or interaction; install desktop icons and installation files; install software from iSearch affiliates; and install Third Party Software.

In addition, you further understand and agree, by installing the Software, that iSearch and/or the Software may, without any further prior notice to you, remove, disable or render inoperative other adware programs resident on your computer, which, in turn, may disable or render inoperative, other software resident on your computer, including software bundled with such adware, or have other adverse impacts on your computer.

Unlike the first EULA from SpiderSearch.com, this EULA does mention the installation of third-party software, though only in vague, general terms. It never discloses the names of particular software programs, never discloses what the specific functionality of those programs will be, and never discloses the peculiar privacy practices of those other software programs. As such, this EULA is entirely inadequate.

By this point most users would likely already have agreed to the installation of software, either from this iDownload.com installation prompt or the earlier "Ultra Web Host LLC" prompt.

As with the "Ultra Web Host LLC" prompt, I clicked "No," rejecting the installation. But that wasn't the end of -- not by a long shot.

...Coercion...

After refusing the "Required Media Player Version 9 Browser Update" I had to refuse a good number more installs as well: both the SpiderSearch and the iDownload.com boxes popped up repeatedly, insistently. I also got one for the GAIN DashBar (again, refused). And then the regular Internet Explorer pop-ups started, with advertisements for porn, free gifts, and (what else?) dodgy anti-spyware applications like Spyware Stormer quickly filling my screen. Of course, attempting to close these pop-up ads simply spawned still more of them.

In the face of these repeated, insistent, confusing, and deceptive pop-ups, many if not most users would simply cave at some point, figuring the installs were necessary to view the media files, especially since the boxes kept popping up. And even though the media file will play if you refuse all the installations, users simply won't know that in advance (and you can't click the "Play" button in the original "License Acquisition" box until you dismiss the ActiveX installation prompts). All they'll know is that they've encountered a persistent, repeated set of prompts to install software that appears to be required to view the file -- just like the first WMP "Security Upgrade" they encountered from Microsoft.

...and then Submission

After refusing several more installation prompts I finally clicked through the "Ultra Web Host LLC" installation prompt, which had appeared numerous times at this point.

My test PC was quickly deluged with spyware and adware, but I still wasn't through yet. The iDownload.com "Required Media Player Version 9 Browser Update" installation prompt returned and I clicked through that as well, bringing still more spyware and adware down onto my system on top of the burdensome load already inflicted on the PC (which is a 1.8 Ghz Pentium 4 w/ 512 mb RAM and an ATI RadeOn video card). Although the "License Acquisition" box finally returned, allowing me to actually play the video file, shortly thereafter my PC ground to a stop, completely overrun with spyware and adware.

Ben Edelman reports the installation of 31 programs in 58 folders, 786 files, and 11,915 registry entries on his test PC. My own count was roughly the same, making this one of the more abusive adware/spyware installations I have ever encountered. In an earlier post here at DSLR, Suzi of Spyware Warrior reported a similar experience ( »Adware Installed through WMA Files ):

said by Suzi:
I installed the same WMA file on an old Win ME box with no protection except AVG free and the free version of Zone Alarm. I ended up with 11 desktop shortcuts for everything from "Get This Weeks Deals from Dell" to "Get Sex Toys Direct", "Hot Facial xxx Shots", and so on. Not to mention all the other crapware. None of them had EULA's except for the GAIN dash bar. That machine was infected faster than you could take a couple of deep breaths.

It took me nearly 2 hours to clean it up and I know what I'm doing. Image the "normal" user who doesn't have a clue. The computer becomes essentially useless until it's cleaned up.

My own experience cleaning up the mess was close to Suzi's. Most users would likely throw in the towel and opt for a complete format and re-install.

Security for Whom?

There is one other aspect of this situation that is rather irksome: the WMP "Security Upgrade" from Microsoft, which is required to view DRM protected media content. Both the pop-up box and the "Learn More" IE window -- which opens if you click for more info -- use the words "security" and "secure content" over and over again, yet the use of those terms is a bit slippery in this context.

Most of the time when you encounter "security upgrades" and what-not, the security that's being enhanced is your own. Your computer is upgraded to provide better protection to you from outsiders on the Internet.

Not so with this "security upgrade." This "security upgrade" is designed to protect copyright holders from YOU, because it is YOU who represent a threat to THEM -- YOU with your thieving, pirating, "fair use" exploiting ways.

I really have to wonder how many users will see all the talk of "security" and "secure content" without understanding who is really being protected from whom (and who is most certainly NOT being protected from whom).

If nothing else, this situation highlights Microsoft's poor implementation of DRM. Indeed, the truly cynical could now point out that the standard, illegal MP3 files that populate P2P networks are in some ways more secure than Microsoft's DRM-enabled WMA files. And that's a sad commentary on the industry's efforts to persuade consumers to accept "secure" DRM-enabled content.

Conclusion

Contrary to Ed Bott's assertion that this is not a "new and horrifying security risk" ( »Adware Installed through WMA Files ) the installation practices that users are forced to deal with when attempting to play these rogue Windows Media Player files are so confusing, deceptive, and coercive that regular users are at high risk for unwittingly consenting to the installation of spyware and adware, with potentially dire consequences for their computers, to say nothing of their privacy and security. The installation practices combine and exploit a dangerous combination of circumstances and qualities to bamboozle users into believing that they are consenting to the installation of software required to view media files. Among those circumstances and qualities are:

* a legitimate, required Windows Media Player "Security Upgrade" that conditions users to expect the installation of required software;

* ActiveX Security Warning boxes that users find inherently confusing because of the vague and inadequate information provided;

* ActiveX installation prompts for software deliberately named to give the impression that it is yet another required Windows Media Player upgrade;

* repeated, insistent pop-ups designed to coerce users into consenting to the installation of software;

* murky, confusing End User License Agreements that fail to disclose the installation of third-party software as well as the functionality and privacy practices of that software.

What we need from Microsoft is a swift fix for the problems summarized here, not attempts to minimize and pooh-pooh the risk or to subtly suggest that users are the problem for not upgrading to XP SP2 and for clicking through installation prompts. As I stressed in an earlier post here at DSLR, it is absolutely inexcusable that media files should have ever become a vehicle for pushing spyware and adware on unsuspecting users. Media files should simply not be a vehicle for adware installations. Period. That there are preventative measures for this unwelcome behavior and functionality is no excuse for the problem itself. It should have never existed in the first place.

Best,

Eric L. Howes

WMP "Security Upgrade"
"License Acquisition"
"Ultra Web Host LLC"
"Required Media Player Version 9 Browser Update"

]]> http://www.dslreports.com/forum/remark,12298989 Wed, 05 Jan 2005 12:36:03 EDT