informa
/
3 min read
article

Adware Vendor In Fake YouTube Fracas

Just days after the FTC reached an agreement with adware distributor Zango that requires the company to pay a $3 million settlement, security vendor Websense reported it has spotted adult videos that require installation of Zango software from a site posing as YouTube.
Just days after the Federal Trade Commission reached an agreement with adware distributor Zango that requires the company to pay a $3 million settlement, security vendor Websense said it has spotted adult videos that require installation of Zango software from a site posing as YouTube.

Websense has identified a number of pages on the social networking site MySpace that offer up videos which appear to originate from the video-sharing site YouTube. The videos are actually hosted on a site with a similar URL -- www.youtube.info -- which Websense classified as "clearly fraudulent" based on bogus domain registration information. The site, which was available Tuesday, is hosted from a server in Amsterdam, Websense said.

"These pose as YouTube videos, but they're using the Microsoft Windows Media Player DRM [Digital Rights Management] to download an executable," said Dan Hubbard, vice president of security research at Websense. "You have to accept the Zango license agreement to install the Zango Cash Toolbar to view the videos."

"The videos in question are not 'adult,' " said Steve Stratz, a spokesman for Zango. "Maybe other people may think so, but people [in the videos] are fully clothed."

More important, said Stratz, is that the disclosure of terms and acquisition of user consent used by the affiliate "meets the FTC's requirements as laid out in the agreement." Stratz also argued that Zango has been meeting the agreement's demands since Jan. 1.

As for the affiliate using a URL similar to the real YouTube's, that's not a violation of either the agreement or Zango's own rules of conduct, Stratz said. "He's not breaking any code of conduct or rules," Stratz said. Lots of Web sites model their business based on URLs close to others, Stratz argued. "You have a change from .com to .info; that's pretty different," said Stratz.

At least two adware researchers took exception. Both Ben Edelman of Harvard and Hubbard of Websense pegged the practice as "clearly deceptive."

That pales, however, Edelman said, next to a problem that remains: Zango is still basing its business model on what he characterized as tricking the user. "The problem is that they don't give the user the right information before installation," Edelman said.

Under the agreement with the FTC, Zango must make sure all installations of its software "clearly and prominently disclose the material terms of such software program or application prior to the display of, and separate from, any final End User License Agreement."

Edelman keyed on the legal phrase material terms. "Zango hasn't disclosed what's material. Zango has only disclosed a portion of it," said Edelman. "What have they really told you? That there will be ads. But they fail to mention that these ads are much-hated pop-up ads. Then they've told you that they base those ads on keywords from your browsing. But they do not mention that your browsing patterns get sent to them. That's a big difference."

The bottom line, Edelman said, is that Zango hasn't actually changed its practices enough to comply with the FTC settlement. "Their [adware] installation fails to disclose the material facts that reasonable users need to know to make an informed decision," he said. "The settlement says all the right things, but the question is what will happen next month or next year? Does the FTC have the commitment to monitor and enforce this? The jury is still out."

The FTC did not return calls requesting comment.