N.Y. attorney general takes aim at an Internet menace

Suit is seen as first step to controlling spyware

April 29, 2005|By Jon Van | Jon Van,CHICAGO TRIBUNE

Jalapenos dancing across your computer screen might look amusing, but their charm wanes once you realize they spice up your PC with unwanted pop-up ads.

This malevolent software, known as adware, is rising rapidly as an Internet menace, rivaling spam in annoyance but potentially far more damaging. Its cousin, spyware, sits unseen on a computer but has the ability to track Internet use - including some programs that monitor keystrokes, a serious security threat.

Yesterday, New York Attorney General Eliot Spitzer filed a lawsuit against Los Angeles-based Intermix Media Inc., accusing the marketing firm of secretly installing spyware and adware on millions of home computers.

Typically, the software moves onto a computer when a user downloads free screensavers or games. Spyware generally hides itself in the computer and is designed to be difficult or impossible to remove.

Spitzer's suit against one company amounts to spitting in the ocean when it comes to ending the flood of malevolent software on the Internet. But computer security experts say that even though Spitzer won't stop spyware, he's taking a necessary first step toward eventually controlling it.

"As it stands right now, there's no prosecution, no consequences for people who do this," said Michael Dahn, a senior consultant for Ambiron LLC, a Chicago-based computer security firm. "Spyware is very lucrative."

Spitzer's lawsuit seeks to stop Intermix from using the dozens of Web sites it operates to infect computers with software that implants pop-up ads and hijacks their browsers.

Spitzer's office said it had documented a pattern of behavior that he argues is illegal under current laws, although state and federal lawmakers are studying new legislation that would specifically target spyware.

Intermix's general counsel, Christopher Lipp, issued a statement that his company doesn't "promote or condone spyware." Lipp said the practices cited in Spitzer's lawsuit happened "under prior leadership" at the company.

He also said consumers gave permission for any software downloaded to their machines under the company's "opt-in" policies.

Spitzer's investigation found many offers included the promise that "this software is freeware. No spyware and nagging screens included in software." But spyware was embedded despite the promises, investigators found.

One such Web site promised to provide a Hot Jalapeno Dance and another promoted a "nutty Santa." In one case, an Intermix site kept providing boxes offering new downloads and an investigator kept clicking "no," but spyware was downloaded anyway, the lawsuit stated.

According to Spitzer, Intermix owns and operates such Web sites as mycoolscreen.com, cursorzone.com and flowgo. com, which advertised screensavers, games and other software available for download. Though those programs are free, they often carry other software for delivering ads and can interfere with normal computer use, he said.

One of the company's ad- delivery programs, "KeenValue," delivered pop-up ads, while another program, "IncrediFind," redirected Web addresses to Intermix's own search engine, Spitzer said.

Computers infected with spyware can become so sluggish as to be rendered unusable, Spitzer said, and the rising tide threatens electronic commerce.

Like spam, spyware is easily generated and costs very little, Dahn said. It is likely to become a greater problem as people create do-it-yourself kits that enable anyone to generate spyware in much the way that they generate spam, he said.

Spitzer's lawsuit contends that Intermix recruits others to help spread adware. That is a growing trend, said Joe Stewart, a security analyst with LURHQ Inc., a computer security firm based in Lombard, Ill.

"We've seen at least one Web site that offers 20 cents apiece for every U.S. computer that is installed with adware," he said.

This is attractive to computer hackers who use automated programs to take over computers of unsuspecting people, he said.

"There are lots of kids with botnets [networks of compromised PCs] controlling a few thousand computers," Stewart said. "It costs them nothing to infect those computers with adware, and they can get a paycheck for a couple hundred dollars.

"We need additional wording of legislation that makes it clear that installing these programs on computers is illegal. Right now, it's tough to prosecute because there's a murkiness to it."

For the most part, people who never download anything from the Web to their computer may avoid spyware, said Stephen Canale, an anti-spam activist with OnlyMyEmail.com, an Ann Arbor, Mich., spam filter service.

"My friends send me a simple e-mail saying `Happy Birthday' because they've learned that I won't download any of those cute cards they used to send," Canale said. "When it comes to cute cards and videos on the Internet, you have to be a skeptic. You can't be trusting."

The Associated Press contributed to this article. The Chicago Tribune is a Tribune Publishing newspaper.

Invasive software

Spyware refers to programs that use your Internet connection without your knowledge to gather and transmit information about your computer and how you use it. Some spyware can track keystrokes, which can reveal credit card numbers and other information.

Adware is software that can bring targeted advertising to your computer. It typically tracks your browsing habits and reports them to an ad server.

Baltimore Sun Articles
Please note the green-lined linked article text has been applied commercially without any involvement from our newsroom editors, reporters or any other editorial staff.