CNET Injecting Malware into Downloads

http://insecure.org/news/download-com-fiasco.html

by skitzzo • 15 years ago

192 74 15 years ago

insecure.org

risource• 15 years ago

CNET was a very tested brand in its day.

iamandrus• 15 years ago

I remember back in 2006 when the Download.com logo had "Safe, Trusted, and Spyware-Free" under it.

EDIT: Picture. http://www.crunchbase.com/assets/images/original/0000/5821/5...

DanBC3• 15 years ago

Previous post was mentioned on HN (http://news.ycombinator.com/item?id=3317121)

chalst• 15 years ago

There was also a report in late August, when I think CNET started the practice: http://news.ycombinator.com/item?id=2910554

The list of news reports on seclist.org's page justifies the new story. I guess that this will get mainstream coverage soon.

skitzzo2• 15 years ago

Yeah, I guess I wasn't paying enough attention but this was the first I'd heard of it.

DanBC3• 15 years ago

Sorry, I wasn't meaning to say "This is already on HN", but more "Here's some more reading for people who are interested".

I need to practice my tone and style a bit.

rbanffy3• 15 years ago

When my mother forwards me the latest malware scare chain letter she got frm her friends, I tell her to picture her computer as a plane flying at Mach 4, high above in the stratosphere, confident almost nothing launched from the ground can harm her.

That's because she doesn't use Windows.

karolist3• 15 years ago

But this is ignorant and not true.

kajecounterhack• 15 years ago

For laymen's purposes it pretty much is, though. When was the last time anyone on Linux/OSX got some adware / popups?

I've also never heard of antivirus for Linux. Which doesn't mean there aren't viruses, it means it's not a concern on the most part.

rbanffy3• 15 years ago

I can tell you that since she moved away from Windows, I never had to clean up her computer. Under Windows, it was a monthly chore.

I am aware there are attack vectors than can be employed against her setup, but the odds of something that could affect her friends also affecting her are vanishingly small - and I have never observed one of those on the wild. Education plays a role too and I took the steps to show her what looks fishy. Her box is also behind a very paranoid router that will page me if anything fishy starts to happen on her side of the network. It was so silent I programmed a weekly "lamp test" so I know it's still watching.

einhverfr2• 15 years ago

It's "relatively true."

The fact is that there is malware including viruses for Linux. The fact is though that they are pretty rare, and the types involved are unlikely ever to become serious threats on the desktop.

It's not perfectly safe, but it's safe enough that safe enough that basic precautions for the desktop are currently good enough. Of course mobile systems are something different.

smackfu• 15 years ago

Don't forget smug as fuck.

pnathan• 15 years ago

It's true for very broad values of true.

Techies know that there are OSX/Linux viruses, rootkits, etc. But there just aren't enough of them to have to expect the grief we get from Windows.

Brajeshwar• 15 years ago

That's a nice one.

easy_rider• 15 years ago

CNET was the top choice for me back 10-12 years ago whenever i wanted to download a utility / piece of freeware/shareware.

Of course when their market share went down... they had to change their business-model...This is just the next step after bloating their pages with ads.

I'm guessing that not the same people are in charge as those who were in their glory days:_)

Georgiy6• 15 years ago

I'm surprised software catalogs are still alive :D Especially when you can get literally everything you need from torrents with keygens/cracks.

suprgeek2• 15 years ago

What good alternatives would people suggest? What should be the "goto" site we could suggest to a novice for finding a clean copy of almost any software...any suggestions? (Assuming that an expert user would straight to the source website)

Deestan• 15 years ago

Any good "goto" site won't stay that way for long, because it will automatically have strong incentives to try tons of stupid crap like this.

But you can use these sites for software lookup. Then you check the listed developer name, Bing your way onto their website, and look for a download link.

monochromatic• 15 years ago

Bing? What happened, did some malware install a Bing toolbar on your computer or something? :)

blub2• 15 years ago

The software producer's website is the only safe place.

gus_massa• 15 years ago

If you download something from the programmer page it is impossible to be sure that it has no spyware/crazy-toolbars/whatever. Some time ago, if you download it from download.com you know that it was safe.

suprgeek2• 15 years ago

True but when you want to suggest to a novice "Why don't you use "X" " It is unrealistic to expect them to search for X in Google, go to the appropriate link of X's creator, figure out the right page to download it from.

Instead - Go to filehippo search for X in the big search bar at top - download first result - is a much easier workflow. (Trust me on this one - I tech support about 6 relatives)

waitwhat2• 15 years ago

Regular users have no way to reliably identify the software producer's website. Advising them to "just google it" is likely to end up with them clicking a scammy AdWords link where paying $40 to download some freeware counts as getting off lightly.

waitwhat2• 15 years ago

filehippo is excellent, and they have a pretty good update checker (although that is obviously not as comprehensive as, say, sumo.)

nicpottier• 15 years ago

This is one reason app stores will continue to gain traction. It's a single place you can go and know you are getting the developer approved version, all with the addition of easy updates.

narcissus• 15 years ago

Not a site for grabbing any software, but for most of the software I (or, for example, my mother in law) would use (outside of dev tools), I go to ninite.com, tick the boxes of what I want and get what is essentially a single installer for everything.

That's my current 'goto' site, at least.

forcer4• 15 years ago

"This is probably why CNET switch to installing the Babylon Toolbar yesterday. This is a good and welcome move by Microsoft, but the whole process of paying “distribution partners“ to changer user's home page to MSN and search engine to Bing is rather sketchy"

I am puzzled by the reaction of some journalists and people here. Have you actually thought why the toolbar is marked as malware? Usually, that's because one guy in one of the AV companies installed the toolbar, didn't like it and so put a flag on. Malware as a definition is something that does harm to your computer. We could argue whether this is actually the case as most of the toolbars, including StartNow just provide search functionality and homepage reset - this is how they make money - there is no reason to do anything sketchy on top of that.

I am not trying to defend toolbar companies here but the quote above that its actually a good thing to replace StartNow with Babylon is misinforming the public. These toolbars all do the same thing and they should either be marked all by AV companies or not. Of course its never gonna happen because there are some AV companies that won't flag toolbars because hey - they distribute toolbars too!

Georgiy6• 15 years ago

Everything on CNET is being tested manually with VirusTotal. If it gets at least 4 positives/false positives from 43 antivirus engines they don't publish it or work with it, until developers get things settled down with anti-virus/anti-malware companies. They get not that much profit from paid accounts cause of small percentage of subscribers, and give away tons of traffic + man hours even for free products. That includes manual testing, checking and writing descriptions, reviewing, and that repeats for each update. And lots of companies update their products like 10 times a week, just to get bumped in search, or create like 20 versions of 1 program under different names, especially Chinese developers. So they just monetizing traffic and stimulating developers to get subscriptions to remove ad for their products. I personally hate all kind of that toolbar stuff, but hey, there are not so many ways to promote an alternative search engines that work for free.

eslachance• 15 years ago

The problem with this statement is that what you say is true... but only for the software the developers are actually distributing on CNET.

Whether CNET passes their own wrapped installer through VirusTotal is a good question, and I for one highly doubt that's the case. Who knows, maybe they tried, got a hit for malware and decided that they would ignore it because it would be counter productive...

marshray4• 15 years ago

Welcome to HN Georgiy.

Here's the deal: That still doesn't mean it's not crapware.

You mention the difficulty of funding your download site (built almost exclusively on supplying other people's free content). I can't imagine what the bandwidth costs must be on a site like that. I'm sure there are plenty of other visitors on HN that are familiar with this issue and are daily encountering similar ethical decisions about how best to fund their business.

There are many ways of resolving difficult ethical decisions. http://en.wikipedia.org/wiki/Normative_ethics One useful technique is to ask yourself: If everyone behaved in this manner, what kind of world would result?

So let's imagine such a world:

* Want to view a .pdf on the web? ... receive and run an executable downloader from an unrelated party.

* Want to watch a video on YouTube? ... receive and run an executable downloader from an unrelated party.

* Want to install an application? ... receive and run an executable downloader from an unrelated party.

Do you see the problem here?

(Maybe you don't, but most everyone else on HN will and I'm doubtful that you're even reading the responses. But if you are still interested I'm sure we can politely explain it further for you.)

chaostheory• 15 years ago

Which CNET office do you work at: NY, Kentucky, or SF? ;)

nodata3• 15 years ago

It's malware because it's installing something that you didn't agree to install.

forcer4• 15 years ago

I am not sure I follow you. By that you mean that CNET installer is a malware because its installing toolbar without disclosing it to the user? Surely StartNow toolbar should not be marked because somebody decides to bundle it. If I take your software and bundle it does it make it malware? I am arguing that all those toolbars do same things, and they should be marked as PUP not as malware as they are not in the same category as viruses.

khafra• 15 years ago

> the quote above that its actually a good thing to replace StartNow with Babylon

He meant it was good for Microsoft to stop paying them to screw people; not good for CNET to keep screwing people in the service of a different client.

forcer4• 15 years ago

OK. So the payment goes to Google instead of Microsoft, what's good about it?

dendory• 15 years ago

There's three things here. First, adding a toolbar and screwing with user settings is freaking lame, but everyone does it and it's something that's been an accepted way to monitize software development.

However, injecting that into other people's software is low, especially if the developers aren't aware of it. CNET should be ashame.

Lastly, the way they present it to users should be plainly criminal. There's a way to offer additional programs, and that's with a checkbox. The screenshot they show is CLEARLY meant to confuse users, whereas even I would have clicked next hadn't I seen the circled text. On this point CNET should be sued for deceptive tactics, because they put NMAP (or the name of whatever you downloaded) as the title, and present buttons that are meant to deceive, making it seem like it's NMAP's own EULA.

Georgiy6• 15 years ago

They do not injecting it, it's just a small downloader that helps to download applications even with bad connection. And potentially may use a p2p distribution, as for example some game developers upload their game clients(>1gb). Well-known companies pay per download for their software suits, and they don't really like to pay for the interrupted downloads.

Im not sure about the deceptive tactics, they just trying to get people attention, not just unmarking checkboxes without reading.

klon• 15 years ago

Hello CNET

marshray4• 15 years ago

They do not injecting it, it's just a small downloader

Oh I am so going to tweet that.

kermitthehermit5• 15 years ago

Most trojan & trojan downloaders are also "just a small downloader that helps to download applications".

The only problem is that you will have to reinstall the OS, erase everything and need a new bank account or even a new job.

Also, HELLO, CNET, NICE TRY.

Zirro• 15 years ago

"but everyone does it and it's something that's been an accepted way to monitize software development"

No piece of software that I have installed during the past two years has done so, and I sure wouldn't accept it as a way of funding development. I'd rather pay for a product in that case.

Can you give a few examples from your list of "everyone"?

colkassad2• 15 years ago

I think the Java runtime installer asks to install a toolbar. There is something else that I can't recall (flash runtime?) that asks to install the Ask.com toolbar all the time as well. Some popular open source projects too (PDFCreator).

vyrotek• 15 years ago

Trillian & Daemon Tools

lawnchair_larry• 15 years ago

Adobe tries to sneak Mcafee on your system with either flash or acrobat reader, which is worse and should also be criminal.

pvarangot• 15 years ago

jDownloader.

Both of the free antivirus I know about for Windows (AVG and Avast).

kermitthehermit5• 15 years ago

I strongly disagree with the following part: "but everyone does it and it's something that's been an accepted way to monitize software development".

Here's why:

- bundling such software with any product kills trust in one single fire; why would I allow such a software to make it into my environment? What if there are additional hidden things inside the code which steal data from my system and send it to a third party or to the maker of the app? What if it steals my credit card info or if it uploads confidential data somewhere?

- it's a "no go" for people in corporate environments - if it has anything bundled with it (optional or not), it's not installed on any system inside the company, no further questions asked

- it doesn't matter if you offer a "paid" version without these things in it, how can I know you haven't added some other "extras" which steal data?

- if you choose to bundle software with your apps, you have some kind of issues with your business model

- bundling such software always exposes the user to all kinds of exploits, hacks and trojans

As for "optimizing" the experience of the persons on the receiving end of this crappy wrapper which shoves adware / malware / trojans down the people's throats, it's like saying we screw you over, but we intend to make it look GOOD and actually make you like it.

CNET and download.com should really be blocked at company level, along with all the security policies. They live in 2005-2006, not at the end of 2011. I doubt the guys running CNET are capable of coming up with any business model which doesn't involve making money off the software of other individuals.

CoughlinJ• 15 years ago

Piriform uses this to great effect. Not sure what they're taking in from their enterprise level offerings, but everyone and their brother uses their free products.

jiggy2011• 15 years ago

When it comes for Windows software I only use 2 types, Open source software downloaded from the projects website directly or fully paid up commercial software.

I never install anything from ad banners

potatolicious• 15 years ago

It's funny seeing this posted so soon after "Don't be a Free User"...

forcer4• 15 years ago

Press release from the CNET few minutes ago:

A note from Sean Download.com Developer Community,

My last communication to you was shortly after we launched the Download.com Installer in late summer. At that time I asked for patience as we began work to deliver a mutually beneficial model to market.

We are on the verge of fulfilling our vision of coming to market with an installer model that delivers files faster and more efficiently to users, while enabling developers to a) opt-in to the Installer, b) influence the offers tied to their files, c) gain reporting insight into the download funnel, and d) share in the revenue generated by the installer. However, due to some press that surfaced yesterday and the potential for subsequent misinformation, I am reaching out now to address that press and to provide a progress report on the upcoming launch:

First, on the press that surfaced yesterday: a developer expressed anger and frustration about our current model and how his file was being bundled. This was a mistake on our part and we apologize to the developer and user communities for the unrest it caused. As a rule, we do not bundle open source software and in addition to taking this developers file out of the installer flow, we have gone in and re-checked all open source files in our catalog. We take feedback from our developer & user communities very seriously and take pains to both act on it and respond in a timely manner.

With that, I want to share progress made thus far: This week we will launch the alpha phase of our new installer. This alpha phase is intended to test the tech and do QA, and will roll through the next few weeks to ensure that our installer is bug free. Between this week and the end of January we will be completing the necessary engineering and administrative work to roll out our beta, which will include a small group of developers who've agreed to participate in the beta launch. Our goal is to exit beta by end of February and have the necessary systems in place to enable opt-in, influence over advertising offers (for those offers that impact your product), download funnel reporting and revenue share back to you, the developers. In the weeks/months following the full release, we will continue to iterate on the model, adding more features to the Installer and bringing greater efficiency to our own download funnel (read: increased install conversion). The initial feedback from developers on our new model has been very positive and we are excited to bring this to the broader community as soon as possible. More communication will follow as we move into Q1, and until then, thank you for continuing to work with Download.com.

Sincerely,

-- Sean

kermitthehermit5• 15 years ago

Dear CNET,

I hope your servers get fried, along with all your backups.

Sincerely,

kermitthehermit

CNET Injecting Malware into Downloads

Related Stories