WinPatrol: Changing of the Guard

The first release of WinPatrol was made public on November 19, 1997.  Since that first release, WinPatrol has developed a huge user base of people who depend on "Scotty, the Windows Watchdog" to alert them to changes to their computer. 

As many devoted WinPatrol fans know, the past few years have presented some difficult challenges for the Pytlovany family.  As a result, Bill made the tough decision to seek a new owner of WinPatrol.

The primary prerequisite for a new owner of WinPatrol was that the person have the same high ethical standards as Bill, someone who strongly believes in conducting security business the right way.  That prerequisite has been met by Bret Lowry.

Introducing Bret Lowry

Bret has been a software developer for almost 30 years and has worked in the security sector since 2005.

Bret has extensive experience within both Fortune 500 and start-up environments and was directly responsible for 5 major commercial software releases, as well as, numerous point releases of high-volume, distributed software.

As architect/lead at the former Sunbelt Software Bret was responsible for the shipment of many major and minor releases to VIPRE, as well as worked on many of the back-end systems.

Ethics

Bret's long history working with Alex Eckelberry at Sunbelt Software would be solid proof to me of his integrity.  Substantiation supporting my confidence that Bret will carry on the development of WinPatrol with the same high standards as Bill is evident from the introductory email I received from Bret, which he gave me permission to quote:

"Why did I purchase WinPatrol? I really enjoyed working in the security sector, protecting people and their computers from the bad guys. Purchasing WinPatrol was the perfect opportunity for me to start my own business by obtaining an established product that conducted security business the right way. No pop-ups, no add-ins, no toolbars, none of the stuff programs put in simply as a way of trying to drive revenue w/o adding value to their customers. I won’t do that. Bill has run WinPatrol with integrity for 16+ years now, I will continue that tradition."

Transition

To ensure a smooth transition of WinPatrol, Bill Pytlovany will continue working with Bret through the end of the year.  The soon to be released WinPatrol update (Ruiware) includes changes that Bret has been working on.  I understand from Bret that he has improvements to features that I have no doubt other WinPatrol users will appreciate.

I am pleased to add that Bret provided his approval for the continuation of the unofficial support site, WinPatrol Help & Information, at LandzDown Forum (LzD).  When the dust settles, Bret assures me that he will be registering at LandzDown post announcement.  There are a number of long-time WinPatrol supporters at LzD available to help answer questions and help with WinPatrol features.

Thank you, Bill

On a personal note, I have long respected Bill Pytlovany and, because of his honesty and high ethical standards, held him in high esteem.  I know I won't be losing contact with him but still wish to take this opportunity to publicly thank Bill for providing an excellent product.

Additional information is available from Bill at WinPatrol™ Generation II.

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

avast! Users Frustrated With Unwanted Chrome Browser

Reports of the inclusion of Google Chrome with the latest avast! upgrade began trickling in several days ago when Version 7 was released. 

As  illustrated below, the issue is complicated by differing reports of the upgrade process.

• Some avast! users report that they were not presented with the pre-checked option to install Google Chrome.
• There are reports that the avast! window presented after reboot does not remain active long enough to uncheck the pre-checked options.  (Note:  it was also reported that the window was presented after the first hard restart rather than the initial restart installing the upgrade.)
• People with Google Chrome installed have reported that even unchecking the installation option resulted in a second install of Chrome! In addition, that second install wrecked havoc with the existing Chrome installation, resetting the current users profile to default and extensions missing.
• Others reported problems with Hostman Server and Sandboxie, necessitating an uninstall/reinstall of avast!.

Granted, the Google Chrome browser is not scareware, adware or spyware.  When a vendor includes an add-on such as a toolbar or, in this case, the Google Browser, the point is "pay per install", thus the reason for the pre-checked option. 

From the sampling below of comments from the avast! forum, in a situation where the option to uncheck the install is either not left long enough for the user to access or their choice is ignored, trust in the vendor product is lost:

"I used to recommend Avast.  I won't be doing that anymore.  I just don't trust it after this happened and I see all the issues others had."

"One more dissatisfied user here!  Avast notified me that it wanted to install Version 7.  NOTHING ABOUT CHROME!!  Then after it installed 7 a screen pops up asking if I wanted to install Chrome.  I responded NO and the then the 7 installation wanted me to click "Finish."  When the screen  cleared there was a Chrome icon on the desktop."

"The install welcome screen launched and before I had time to read the screen the install started never a chance to opt-out or configure the install."

"I didn't have Chrome on my pc before I updated avas6. On rebooting the pc I found to my absolute horror that the developers at avast thik they know better than me about what software I need and had installed chrome. At no time did ANY warning appear, or my consent was sought to install anything other than the update. I consider this action to be one of MALWARE."

Recommendations

1. When upgrading to avast! Version 7, select "Custom" install and select the options you want to use.
2. After the installation is complete.  Watch for the following window to appear:
   
   
   
3. According to your preferences, leave checked or uncheck the option to "Participate in the avast! community".
4. If you already have Google Chrome installed or do not want Google Chrome installed, uncheck the boxes in the following order:
   
   a)  First, uncheck "Make Google Chrome my default browser". 
   b)  Next, uncheck "No, do not install the Google Chrome web browser".
   c)  Click Finish.

References

• DSLReports Forums: Avast 7 installs Chrome
• Calendar Of Updates: Installers Hall of Shame (Unwanted add-on)
• Calendar Of Updates: avast! v7.0.1407
• Avast Forum: Avast 6 to Avast 7 installed Chrome, destroys existing Chrome install
• Avast Forum: Avast 7 installs chrome without permission

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

SUPERAntiSpyware Adds Opt-in Toolbar

Personally, I prefer not to use toolbars.  However, there are many people who like add-on toobars on their browser of choice.

Something that has been a point of contention, particularly within the security community, is the inclusion of pre-checked toolbars with security software.  This practice has resulted in discontinuing recommendations for those programs, even though the software is offered free for personal use.

SUPERAntiSpyware has apparently found it necessary to supplement the support of the free version of SUPERAntiSpyware by the inclusion of the Ask Toolbar.  The difference between the inclusion of the toolbar by SUPERAntiSpyware and other vendors is that it is opt-in rather than opt-out (pre-checked).

 

Nick Skrepetos*, developer of SUPERAntiSpyware, provided the statement below at Wilders Security Forums:

"It's not bundled, but rather an optional install that, if elected, enables a Professional feature - scheduled scanning at no charge. A "bundle" means it's included and installed as part of the package - we have an optional install. Nothing is disabled or features lost if the user elects not to install - it's still the great free SUPERAntiSpyware we have always produced!"

Recommendation

If SUPERAntiSpyware is your anti-malware software program of choice, consider purchasing a license for the software.  However, if your preference is to continue using the free version, the built in Windows Scheduler is an option to use in order to schedule scanning.

• How To Schedule Tasks in Windows XP
• Schedule a task in Windows Vista
• Schedule a task in Windows 7

*SUPERAntiSpyware was acquired by Support.com in June, 2011. Press Release: Support.com Expands Software Offerings With Acquisition of SUPERAntiSpyware

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Avira AntiVir Adds Ask Toolbar and Scareware PopUp

Avira AntiVir has long been a favorite provider of free antivirus protection.  The product has also received acclaims for the quality of protection.  Unfortunately, Avira has made several changes, resulting in removing the product from the "recommended list".  

1. Avira AntiVir had replaced the Avira Personal Free edition notifier.  It is no longer suggesting upgrading to Avira premium or the security suite.  Instead, the notifier is advertising Uniblue "Registry Booster". 
2.  Licensed users of Avira Premium are receiving e-mails advertising the same Uniblue "Registry Booster" product. 
3.  The addition of a toolbar with the pre-checked option to include the Ask Toolbar (AntiVir WebGuard) and change the default search provider to Ask. 

Although some people have referred to Uniblue's "Registry Booster" product as a rogue, based on descriptions of how it works, the product is better described as scareware.  Scareware products are those that provide scan results that imply there are serious issues with the computer.  However, the only way to fix the issues is purchase the product.

To add to the computer owner's confusion is that Uniblue proudly displays the Microsoft Partner logo.  This gives the impression that the company has any close relationship with Microsoft.  It is important to understand that there is no vetting to become a registered Microsoft partner. All it means to be a Microsoft Partner is that the company employs the requisite number of certified professionals and has completed the registration process, nothing more. 

In my opinion, as well as that of many members of the security community, it is deplorable when a security vendor adds a pre-checked option to include an unnecessary add-on and change the user's preferences.  A responsible security vendor should provide a clean installer, focusing on improving the product, fixing any bugs and continuing to improve the product. 

If you are using Avira AntiVir antivirus software, I encourage you to read the articles listed in the references section below and decide for yourself if this is a product you wish to continue using. 

There are still two recommended antivirus software programs that are free for personal use, avast! 6 Home Edition and Microsoft Security Essentials. My favorite licensed antivirus choice is ESET.

References

• AntiVir Personal for Windows Support Forum: [Off-topic] Uniblue scareware ads (hello Uniblue, goodbye Avira)
• AntiVir Premium and Avira Premium Security Suite Support Forum: [Off-topic] Registry Booster 2011 email from Avira
• Calendar Of Updates: AntiVir/Avira adds ask.com toolbar
• Complaints Board: UNIBLUE REGISTRY BOOSTER Complaints - Deceptive Advertising and Sales Practice

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Comodo On Rerun

It is the same old, same old from Comodo, yet again.

"Yet again we find the same group "ISystem Inc" scamming the public with their bogus products ... with a little more help from Comodo. Now I ask you ... how many times do I have to report the same group being issued a certificate from Comodo, before they take the necessary steps to prevent the general public from being ripped-off by these bad actors?"

See the complete report at Hosts News, Comodo continues to ignore Malware warnings.

Note: Written by Corrine, not Donna or "MVP Mike".





Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Rogue or Real A-Squared Marketeer?

It was reported at Malwarebytes Forum that someone claiming to be a representative of A-Squared Anti-Malware has been sending messages to helpers on forums requesting that they drop Malwarebytes' Anti-Malware (MBAM) and use A-Squared instead.

Although the review, "a-squared Anti-Malware 4.0 - Alarming False Positives" by PC Magazine is for version 4.0 and not the current 4.5, perhaps the person thinks what s/he is doing will help overcome the negative aspects presented in that review. After reading what this person is spreading, it is difficult not to think that the false/positive detection of MBAM was intentional. (See this July 3, 2009, report at WOT, Todays ASquared F/P's.)

The truth of the matter is that on the forums we recommend the software program that does the necessary work to remove malware. It is for that precise reason that so many of the forum security experts recommend MBAM. I certainly have seen successful results in logs when recommending MBAM and will continue recommending Malwarebytes' Anti-Malware.

I sincerely hope that this is a "rogue marketeer" and not a true representative of A-Squared and that A-Squared representatives extend an appropriate public apology.

Update posted by Fabian Wosar, (Technical Support) at a-squared forum:

"Mike Christenson, the person responsible for the PM you quoted, is no longer part of Emsi Software GmbH. He was fired today (actually yesterday) as soon as we became aware of the mails and PMs he was sending out.

I can't say anything more official yet as all people who could give a more official statement right now are not available. You will have to wait until it's day in Austria/Germany (it's 02:40 AM right now)."

and confirmed by Marcin Kleczynski (Malwarebytes President and CEO):

"I spoke with the CEO of Emsisoft regarding this situation. Christian confirmed it was an employee of Emsisoft and he has dealt with him properly. I thank Christian for his efforts."

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Is Comodo President/CEO a Liar? You Decide

It appears that Comodo's "Hero Administrator" has sunk to the level of referring to anyone who criticizes Comodo as a liar. Well, Melih, your claim is wrong.

Here is the situation: I was checking blog visitor statistics this morning. When there is a referral link from a forum or another blog rather than as search results, I generally follow the link to see the source of the link. This is what I found today:

VISITOR ANALYSIS
Referring Link	http://forums.comodo.com/empty-t42573.0.html;msg288724;topicseen

Following the link, I saw this blog post by Melih Abdulhayoglu, the President and CEO of Comodo:

"And its been over a week and she still hasn't put my response to her post on her site Surprise Surprise!

http://securitygarden.blogspot.com/2009/07/parents-beware-of-comodo-firewall.html

I responded to her site on July 4th... and knowing the possibility of them censoring my post, i took a snapshot of my screen as I posted it.....7 days on... they rather censor what their users read...welldone Donna! Somehow I had a hunch that being concerned about telling the truth to her readers wasn't the first thing in her mind

Today its 11th July, they still continue to spread the lies and haven't changed a thing...

Your sole purpose is a witchhunt against Comodo.. I hope you are being paid well for that

Melih"

Since the only comments I reject are spam links or comments containing vulgarities, I proceeded to check the Dashboard. A screen copy of the Dashboard notice of comments that were awaiting moderation at Security Garden is too wide to incorporate here. The image is available at http://securitygarden.googlepages.com/MelihCommentNotices.GIF

As can clearly be seen in the above-linked screen copy as well as the e-mail notice, reproduced in References below, the comment was left not on July 4 but rather last evening, July 11, at 11:29 PM. It is apparent that Comodo President/CEO "doth protest too much".

No, Melih, I do not get paid for blog posts or help on the forums. My issue is not only with Comodo but also with any so-called security company with practices I perceive as not being representative of a security vendor (see Ethics tag).

As to HopSurf, the domain registration information from DNS Stuff is copied below and HopSurf is registered to Comodo. That does not, however, change my warning to parents, as originally posted. HopSurf is a pre-checked toolbar for a so-called security product with a EULA clearly warning against the toolbar being available to anyone under age 18:

"1.5.The Toolbar and the Services are not intended for use by or availability to persons under the age of 18.IF YOU ARE UNDER 18 YEARS OF AGE, YOU MAY NOT DOWNLOAD, INSTALL OR USE THE TOOLBAR AND YOU MAY NOT ACCESS THE SERVICES."

With such a warning, I have no other choice but to believe that use of the toolbar would provide "adult-only" results in searches.


References:

• DNS Stuff Lookup: www.hopsurf.com A record

  
    
  Domain
  Type
  Class
  TTL
  Answer
    
  www.hopsurf.com.
  A
  IN
  3600
  91.199.212.173
    
  hopsurf.com.
  NS
  IN
  3600
  ns0.comododns.net.
    
  hopsurf.com.
  NS
  IN
  3600
  ns0.comododns.com.
    
  hopsurf.com.
  NS
  IN
  3600
  ns1.comododns.com.
    
  hopsurf.com.
  NS
  IN
  3600
  ns1.comododns.net.
    
  ns0.comododns.com.
  A
  IN
  21600
  91.209.196.4
    
  ns0.comododns.net.
  A
  IN
  21600
  149.5.128.4
    
  ns1.comododns.com.
  A
  IN
  21600
  67.51.175.4
    
  ns1.comododns.net.
  A
  IN
  21600
  91.209.196.5
   
  
  

• E-mail notice: "New comment on Parents Beware of Comodo Firewall."

Anonymous to me

Anonymous has left a new comment on your post "Parents Beware of Comodo Firewall

":

HopSurf is a Comodo product, developed and published solely by Comodo, not ASk.com.
Please get you facts straight before posting what could be considered and is False information.

Publish

this comment.

Reject

this comment.

Moderate

comments for this blog.

Posted by Anonymous to Security Garden

at July 11, 2009 11:29 PM

Reply

Forward

Reply

|

Anonymous to me

show details 11:32 PM (10 hours ago)

Reply

Anonymous has left a new comment on your post "Parents Beware of Comodo Firewall

":

Please note - failure to publish any posted comments that are contrary to your posts is proof you are completely biased and therefore unreliable. People should be made aware of this fact.

Publish

this comment.

Reject

this comment.

Moderate

comments for this blog.

Posted by Anonymous to Security Garden

at July 11, 2009 11:32 PM

Reply

Forward

• Referral link: http://forums.comodo.com/empty-t42573.0.html;msg288724;topicseen
  
  
• Screen Copy of Dashboard Comments: http://securitygarden.googlepages.com/MelihCommentNotices.GIF
  
  
• Security Garden: Ethics tag
  
  
• Security Garden: Parents Beware of Comodo Firewall

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Comodo continues to damage it's reputation

As reported (again) by Microsoft MVP Mike Burgess, Comodo does it again:

"Here again we find another bogus Antispyware program that does nothing but take your money ... with a little help from Comodo"

Read about it at Comodo continues to damage it's reputation.

Remember, Security Garden readers, the following firewall programs are free for personal use.

Online Armor Free
Agnitum Outpost Firewall
Kerio Personal Firewall




Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Parents Beware of Comodo Firewall

Oh yes, Comodo promised to remove the Ask Toolbar and they did. In its place is another IAC product, the HopSurf Toolbar -- also a pre-checked installation. Not only is the toolbar pre-checked, as reported by Consumer Security MVP, Donna Buenaventura, there is no EULA (End User License Agrement) included with the installer.

Donna kindly provided links to the on-line EULA for the HopSurf Toolbar at both Comodo and HopSurf. Reading the EULA, I cannot help but be concerned regarding what sort of material is provided by HopSurf that results in the inclusion of the following:

"1.5.The Toolbar and the Services are not intended for use by or availability to persons under the age of 18.IF YOU ARE UNDER 18 YEARS OF AGE, YOU MAY NOT DOWNLOAD, INSTALL OR USE THE TOOLBAR AND YOU MAY NOT ACCESS THE SERVICES."

Based on the above, as well as the sneaky inclusion of the pre-checked toolbar and missing EULA in the installer, I strongly advise caution, particularly to parents who have young children using the family computer.

As Donna said:

"So Comodo’s promise to remove SafeSurf Toolbar happened but not to finish their agreement with A$k/IAC. Instead, the new version of Comodo is now bundled with HopSurf Toolbar which is IAC/Ask.com too. The installer become worst because there’s no EULA presented in addition to known method of misleading people by offering unnecessary third party service/component in a SECURITY software. Note that it is a security software that should offer clean installer no?"

So much for improvements.

See Donna's complete post in Comodo removed Ask/IAC SafeSurf Toolbar by replacing it with HopSurf/IAC/Ask Toolbar and the accompanying screen shots at CoU.

The following firewall programs are free for personal use and do not include a toolbar.

• Online Armor Free
• Agnitum Outpost Firewall
• Kerio Personal Firewall

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

The Tech Herald: Criminals using Comodo to attempt legitimacy

In his report on the recent Comodo controversy, The Tech Herald writer, Steve Ragan, added information everyone else missed:

The ten thousand dollar question, which no one asked of Mr. Abdulhayoglu, was why Comodo offers DV certificates free for 90-days.

“A free SSL certificate will secure your site and begin building trust,” Comodo’s site states, adding that a free SSL certificate is, “the same as our paid Essential SSL” They even promise no, “faxes, no paperwork and no delays - get the golden padlock within minutes and be ready to sell online.” How is this not making an offer to encrypt data for a recipient you have not verified?

Mr. Ragan also contacted VeriSign since they were mentioned in the discussions. A VeriSign spokesperson told The Tech Herald, “RapidSSL, Thawte, and GeoTrust are the only brands VeriSign issues DV certificates from.”

This additional information was provided by VeriSign, further illustrating that poor practices are not in place by other certificate authorities:

“The system we have in place automatically rejects obviously fraudulent sites and kicks anything questionable to a manual approval. And if anyone flags a site as malicious, we have a team that investigates these and revokes the certificate if found to be malicious/fraudulent.”

Jay Schiavo, Product Manager at VeriSign, mirrored that thought by adding, “For GeoTrust and RapidSSL we have the ability to revoke a cert issued to a malicious or rogue site instantaneously. The cert will then show up on our CRLs immediately."

Read Steve Ragan's article in The Tech Herald: Criminals using Comodo to attempt legitimacy





Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Comodo . . . again

Hot on the heels of Microsoft MVP Mike Burgess' report of Comodo issuing certificates to known malware, he made another discovery, reported in Oh Comodo here we go again!

As Melih Abdulhayoglu, the President and CEO of Comodo, explained previously:

"Comodo cares for their security, so when somoene gets a DV cert from Comodo, we do try to explain to them it is important that they get a higher validation certificate like OV (Organisation Validation) or EV (Extended Validation). This way at lease we can convert some of the people who whould have bought DV into a validated customers."

Perhaps instead of explaining to the DV certificate customer, Comodo would do better to take a few minutes to conduct a simple WhoIs domain search. As Mike put it here:

"First I very rarely see a certificate issued by GoDaddy to these type malware pushers ... now here is a tip ... perhaps the first clue would be to Google the domain name that wants to purchase a certificate ...

{snip}

Yet "Iam Monkey_boy=) from the comodo forums" states:
"Comodo can't really be blamed if a site that has a certificate hosts malware"

Let me put a little perspective on this ... "Conficker systems being updated with SpywareProtect2009"
Conficker is now believed to be the largest computer worm infection since the 2003 ... and Comodo issued the certificate to "SpywareProtector-2009" ... now you can't tell me that this domain name isn't a cause for concern? It gives me chills to think how many people were duped into purchasing this product.

Now if it was my company and I found out we were involved (even remotely) in the largest infection since 2003 ... I'd certainly want to make some changes in our policy as to how these certificates are issued ... but that's just me ..."

and here

"Comodo states: "To get a DV cert all you need is a domain name and $15..and no background check about your identity is required." As I stated in a previous post ... perhaps you should at least check the domain name ... duh! that would be a good first clue ... but I guess the $15 is more important?"

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Symantec PR Fixes Support Mess

Last week, Bill Pytlovany reported that a Symantec Support Rep had removed WinPatrol from the customer's computer and additionally charged the customer $99 in the process. As Bill explains in his follow-up report, Symantec Public Relations Specialist Noah Edwardsen contacted him after learning about the situation via Symantec contacts of @clarinette02 and @TimelessP (both of whom I follow).

Noah not only contacted Bill but also took the time to leave a comment at my original report:

Noah Edwardsen said...

Hi Corrine,

I wanted to let you know that we've been in touch with Bill Pytlovany and have reached out to the original customer who called support.

Symantec does not classify WinPatrol as a threat, and we're actively investigating this customer's experience to learn more about why the support agent provided incorrect information and to ensure it doesn't happen again.

Best,

Noah Edwardsen
Symantec

This is a win for public relations and social media. See the full story in Bits from Bill: Social Media Marketing is Great on One Condition.





Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Online-Armor Goes to the Top of the List

When recommending a free-for-personal-use software firewall in the forums, the list I previously provided was in alphabetical order. As of today, that list has been changed to place Online-Armor at the very top of the list. Why? It is simple. Mike Nash got my attention when he chose ethics over dollars.

If you are looking for a full-featured subscription firewall, I highly recommend Online-Armor (Product Features). As Bill Pytlovany asked: Would you like Toolbar with your Software Order? The answer is a resounding No! Support vendors like Mike Nash and Bill Pytlovany who choose ethics over dollars.

Note: Although since updated and better than ever, Scot Finnie named Online Armor 2.1 as the Best Firewall Software of 2008. Online-Armor has been reported as working well on Windows 7 RC.

I encourage Security Garden readers to read for yourself why Mike made the decision to forgo tens of thousands of dollars per month by declining the Ask toolbar. As you are reading Mike's article, pay particular attention to the key points that Mike observed kept getting repeated when considering the toolbar. They are some of the reasons why vendors that bundle the bar are out of favor:

• Users do not expect a security tool to install unneeded items, even if that security tool is free.
• Default opt-in is the only way people will install due to inattention, accident or trickery of wording.
• Default opt-in is wrong.
  
• Users place a lot of trust in security vendors. They are trusted to do the right thing. Do not abuse that trust.
• Is it ethical to ask your users to install a product you would not install and use yourself?

Read for yourself why Online-Armor made it to the top of the recommended list: Ask Toolbar in Online Armor Free? Nearly...


Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Another Comodo Controversey

Once again Comodo garners the attention of the security community. The latest issue came to light when Consumer Security MVP Mike Burgess reported that Comodo continues to issue certificates to known Malware.

Although Melih Abdulhayoglu, the President and CEO of Comodo, pointing a finger at Verisign and Godaddy, contends the difference is that the certificate is a DV (Domain Validation) Certificate:

"As far as I am concerned DV certs SHOULD NOT EXIST! Encrypting data for a recipient you have not verified is stupid at best!

Some people claim that DV certs has a place for just encryption for a site that has a pre-established trust, but that only happens if the user types https://www....... and goes to site... if the user types http://www... and then clicks on a link, then there is no trust as you can't trust this site in the first place cos its not validated (its just http).

So the problems that DV certs have caused has ranged from phishing sites to be secured with SSL to malware sites having a DV cert!"

he goes on to explain in a further forum reply:

"Comodo cares for their security, so when somoene gets a DV cert from Comodo, we do try to explain to them it is important that they get a higher validation certificate like OV (Organisation Validation) or EV (Extended Validation). This way at lease we can convert some of the people who whould have bought DV into a validated customers."

So, what does this indicate? According to Melih, DV Certs should not exist. Yet, Comodo still issues them to provide an opportunity to convert customers into other certificates that require validation.

Edit Note: Paragraph Break added for clarification.

I decided to take a look at Comodo's website. Yes, I see, according to the Comodo "Cost Saving & Product Comparisons Calculator", regardless of the product being purchased, it only takes one hour for Comodo to provide validation for an SSL Certificate, compared to 3-7 days for the other vendors. Note also that "Company Legitimacy" is also provided:
Check the other provider/product comparisons on that page and you will find similar results.

Moving forward, Melih has now reported that the certificates relating to the site have been revoked. The discussion topic continues, however, with Comodo supporters questioning why there are not similar complaints about Verisign and Godaddy. As Consumer Security MVP Donna Buenaventura wrote about Comodo in her article, Making a boo boo, Can't beat them, Join them?:

"do you think it's a two-faced security vendor (for offering security service/product and at the same time, certifying a malicious site/service to be noticed/make money)"

The question still remains as to why Comodo has chosen to ignore Mike Burgess' notification of malware being served by a Comodo issued cert to rapid-antivirus2009. com and subsequently reissued a new certificate. As Mike went on to say:

"Comodo is supposed to be one of the good-guys ... and they even describe themselves as "Internet security software products including SSL certificates and Free Firewall Antivirus software among others from Comodo, a leading global trust provider" ... however I have been reporting on them since the WinFixer days and it seems it just falls on deaf ears ... and now that they bundle the Ask Toolbar it really makes you wonder ...?

References:

• Comodo continue to issue certificates to known Malware (Calendar Of Updates)
• Comodo continues to issue certificates to known Malware (Comodo Forum)
• Comodo continues to issue certificates to known Malware (Hosts News)
• Comodo continues to issue certificates to known Malware (Wilders Security Forums)
• How Does an SSL Certificate Provide Website Security? (Network Solutions)
• Making a boo boo, Can't beat them, Join them? (Calendar Of Updates)
• REMOVE Comodo Certificates from FireFox, Opera!!! (dslreports.com)
  
• What are the types of SSL Certificate available (Global Sign)

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Google currently falls short

In a carefully documented report, Ben Edelman, a well known and respected security expert, reveals how Google and its partners

• intercede to divert traffic that would have reached advertisers' sites directly -- without advertisers incurring any advertising expense.
• pass the traffic back to the advertisers users were trying to reach -- but only after collecting pay-per-click advertising fees.

Also demonstrated is what appears to be conveniently overlooking Google's "Software Principles" requirements for their WhenU and IAC partners.

See how

• WhenU Covers Advertisers' Sites with Advertisers' Own Google Ads
• IAC's SmileyCentral Grab Advertisers' Organic Traffic to Show Google Ads
• Typosquatting: Cmcast.com, MediaLogik, and Thousands More Intercept Users' Misspellings to Show Google Ads
• Google Chrome Suggestions Divert Users from Direct Navigation to Search

in How Google and Its Partners Inflate Measured Conversion Rates and Inflate Advertisers' Costs.




Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

LandzDown Forum Stops Updates for Security Products with IAC/Ask

Update information for security software products including/bundling and/or having default (pre-checked) opt-out installation of the Ask Toolbar and Search Assistant is discontinued at LandzDown Forum.

1. BitDefender
2. Comodo Firewall Pro
3. StopZilla
4. Symantec
5. Webroot
6. ZoneAlarm (Check Point)

Further information on products including the "pay-per-install" IAC product is available at Calendar of Updates, Products with Ask Toolbar.

For background information about IAC/Ask practices, see the topics below.

• Ask.com's Privacy Tool Tracks Users, Groups Tell Feds
• Ask.com Will Keep Your Secrets (Although Its Advertisers Won't)
• Current Practices of IAC/Ask Toolbars
• Edelman on 'Deceptive Door Openers' and Ask toolbars

LandzDown Forum Members' attention is also directed to Calendar Of Updates Installers Hall of Shame which include toolbars and other potentially unwanted add-ons. Please be alert to the installation process any time you are installing a new software.

Announcement: Security Products Including IAC/Ask

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

BitDefender Joins the Dark Side

To quote my friend and one of the most ethical people I know, Bill Pytlovany, the developer of WinPatrol:

BitDefender has joined the dark side. By end of year, @WinPatrol may be alone in not having an Ask Toolbar. http://bit.ly/NcP3C

The link from the Twitter quote leads to a thread at Wilders Security where member EsoxLucius confirms with a screen capture the inclusion of Ask in the BitDefender product:

- This is not a masked ask toolbar, it is a BitDefender toolbar with and added search box (in this case ask)

- No search, browsing habits, browsing history is captured and sent anywhere.

- The ask.com search box is mentioned in the first step of the installation.

- The choice regarding what toolbar to use is not mine to make and I can't really say why IAC.

As a result of the inclusion of the Ask search engine in the BitDefender Anti-Phising product, Calendar of Updates (CoU) has discontinued providing update information on BitDefender. (See the CoU list of products with the Ask Toolbar.)

Granted, it is stated in the installation of the BitDefender Anti-Phishing toolbar that Ask is included. The problem is how many people read beyond seeing the buttons to click Next > Next > Finish?

Based on the history of IAC/Ask, one can only guess that BitDefender also succumbed to the pay-per-install offer by IAC. The popular browsers (IE 7, IE 8, Firefox, Opera and Safari) all include anti-phishing. A separate anti-phishing toolbar certainly appears redundant to me, particularly one that forces the use of a pay-per install search engine.




Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Comodo Software Removed from Softpedia

Softpedia has long followed a strict code of ethics, defining adware as a software that falls into at least one of the following categories:

(1) Displays ad banners or other types of advertising material during its runtime
(2) Attempts to change the homepage for web browsers installed on the system
(3) Attempts to change the default search engine for web browsers installed on the system
(4) Offers to download or install software or components (such as browser toolbars) that the program does not require to fully function
(5) At program startup/shutdown , opens web pages featuring advertising or similar income generating content
(6) Creates desktop or start menu shortcuts for items unrelated to the program's functionality

Softpedia reports that Comodo Internet Security strikes out on numbers 2, 3 and 4. Number 4, is the reason I stopped recommending Comodo firewall a year ago when the Comodo SafeSurf toolbar included the Ask Toolbar. Stefan Fintea, the Softpedia Software News Editor, explains:

"Aside from the fact that SafeSurf is a component that the program (CIS) does not require to fully function, therefore it alone would be a good reason to mark CIS as adware, this utility also installs Ask Toolbar without asking for the user’s permission. This type of behavior is clearly not the one described in the Comodo email and could be easily classified as spyware (since adware would imply prior user consent)."

For background on Ask toolbar issues see Edelman on 'Deceptive Door Openers' and Ask toolbars.

Via BillP

References

• Comodo Software Removed from Softpedia
• Edelman on 'Deceptive Door Openers' and Ask toolbars
• SoftPedia -> Adware in CIS ?!
• Security Garden Posts on Ask/IAC
  
• Software licensing models explained - adware

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Symantec Ask/IAC "Safe Search" Update

After reading the Safe Search update by Rowan Trollope, Symantec Senior Vice President, and the eloquent response by Don Hanson my response to Safe Search update, I was prepared to write an explanation about why I still cannot recommend Symantec products. However, I could not have explained it half as well as my friend Donna Buenaventura did in the discussion thread at Calendar Of Updates.

You too will have a better understanding of why I feel as I do about Symantec products after reading the references. There are other excellent vendors who do not need to resort to relationships with third-parties in order to sell their product. I encourage Symantec customers to consider a different vendor for their security software. In fact, Avira has launched its new Version. See http://www.avira.com/en/promotion/new_av9.html for information.

I suggest you start with the first article and follow through the list, being absolutely certain not to miss Donna's posts.


References:

1. Rowan Trollope: Safe Search update
2. Don Hanson: my response to Safe Search update
3. Calendar of Updates: Safe Search update

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...

Was BBC Use of Botnet Against UK Law?

With the reported assistance of PrevX, the BBC program "Click" obtained a "low-value botnet" via chatrooms on the internet. This botnet was used to hack into 22,000 PCs in a special investigation the program was conducting of the kind of damage that can result from a network of compromised computers.

As evidence of their presence on the computers, the BBC apparently changed the desktop wallpaper of affected computers to display a message from BBC Click. As Graham Cluley of Sophos described, other steps in this "investigation" included:

"BBC reporter Spencer Kelly and security company PrevX took over an existing botnet of approximately 22,000 computers, and used them for their spam experiment - ordering the innocent third-party computers to send 500 spam messages each to Hotmail and Gmail accounts under the control of the BBC."

As someone who helps in the security forums helping people clean their computers of malware, I am of the strong opinion that this so-called investigation by BBC Click was, if not against the Computer Misuse Act, at the very least highly in appropriate. I am surprised there is not more censure of PrevX for their participation.

You can follow the comments in Twitter using the hash code #bbcbot


References:

• BBC News: Is your PC doing a hacker's dirty work?
  
• BBC Program Click: BBC team exposes cyber crime risk
• OPSI: Computer Misuse Act 1990 (c. 18)
  
• Computerworlduk: Did BBC break computer misuse act with botnet?
  
• OUT-LAW.COM: BBC programme broke law with botnets, says lawyer
  
• Sophos: Did BBC break the law by using a botnet to send spam?

Remember - "A day without laughter is a day wasted."
May the wind sing to you and the sun rise in your heart...