ie8 fix

Between the Lines

Larry Dignan, Andrew Nusca and Rachel King

Symantec accused of using 'scareware' tactics to sell full-version products

By | January 11, 2012, 6:05am PST

Summary: Anti-virus maker Symantec is charged in a lawsuit with misleading users into purchasing full versions of its software by peddling ’scareware’ tactics.

Security firm Symantec is being taken to court over claims that the company’s flagship anti-malware and performance software suites mislead consumers into buying full versions of its products.

The suit, which seeks class action status, was brought by Washington state resident James Gross. It was filed in the District Court of San Jose, California on Tuesday on behalf of his lawyers, according to Reuters.

The complaint alleges that misleading ’scare’ tactics are being used by Symantec in its Norton Utilities, PC Tools Registry Mechanic, and PC Tools Performance Toolkit products. The claims also suggest the software range always report harmful errors, privacy risks and other issues that exist, regardless of whether they actually exist.

Many ’scareware’ tactics used by online scammers intercept websites and display within the browser a simulation of an anti-virus scan, that invariably tells the user that the PC they are using is infected.

“The software is falsely informing the consumer that errors are high priority and in addition it is falsely informing the consumer that their overall system health and privacy health is low”, the complaint stated.

“The truth, however, is that the scareware does not actually perform any meaningful evaluation of the user’s computer system, or of the supposed ‘errors’ detected by the software”.

One analyst said that the claims would be difficult to prove. Andy Kellett, senior analyst at Ovum, said speaking to The Inquirer: “It’s a tricky one as there are lots of unknowns, how do you prove Symantec is in the wrong?”, adding: “It’s not something that has been done before”.

The news comes only a week after Symantec confirmed an Indian hacker group hacked a “third-party” and acquired source code relating to an enterprise anti-virus solution the company once offered.

While the lawsuit will likely go Symantec’s way, it is nevertheless been a bad month for the security firm.

A Symantec spokesperson said it was “aware” of the allegations made, but declined to offer additional comment at the time of publication.

Image source: Flickr.

Related:

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Zack Whittaker, a criminologist who studied at the University of Kent, Canterbury, is a journalist, writer and broadcaster.

Disclosure

Zack Whittaker

I worked briefly with Microsoft UK in 2006 but no longer have any connection with the company. Regardless, I remain impartial and unbiased in my views.

I don't hold any stock or shares, investments or industrial secrets in any company, but have signed confidentiality agreements with a number of UK and U.S. organisations, whose names I am not at liberty to disclose.

I was involved with Kent Union, the University of Kent's student union, undertaking voluntary, non-salaried, elected positions between early 2009 and mid-2010.

No other company, body, government department, non-governmental organisation or third sector organisation employs me or pays me a salary in any capacity whatsoever.

As a freelance journalist, whenever expenses are given and taken by a company that is not CBS Interactive, these will be disclosed in each relevant post to ensure transparency.

I currently work with a UK law enforcement unit, but this is an entirely separate position which bears no connection to other work.

(Updated: 23rd October 2011)

Biography

Zack Whittaker

Zack Whittaker, criminologist who studied at the University of Kent, UK, is a journalist, writer and broadcaster.

After studying criminology at university, though still in his early-20's, he has already had a series unconventional work and voluntary positions. He has worked with researchers studying neurological illnesses like Tourette's syndrome (which he suffers from), has given lectures on the nature of disabilities in the public community, and occasionally ends up speaking on television and radio discussing the events of the day.

He first had academic work published at the age of 22, then still an undergraduate, and has been cited by a wide range of publications: from CNN, the Huffington Post, AllThingsDigital, The Atlantic Wire and CBS News.

138
Comments

Join the conversation!

Just In

RE: Symantec accused in using 'scareware' tactics to sell full-version products
ITsecuritynoc 17th Jan
@commchf Yeah, but the important thing isn't annoying users, who are already annoyed. It's not getting ripped off by fraud or having the user do the same. I'll be watching this webinar tomorrow on the 18th cause I think they'll bring it straight. Whatever you think of Dell, I think Trend is the better security http://ow.ly/8wJLm
Symantec and McAfee, and others, have been using these tactics for years.
@zmud

Yes they have. Good for this person - hope he prevails. I am all for free enterprise, but being a sophisticated PC user and hearing others buying Norton or McAfee because they were told to by their computer 'or else' infuriates me. The buyers cannot hope to make an educated decision because the very nature of software is supposed to prevent the very scam they are perpetrating. Another good piece of news today!
their was no truth that they were using scareware tactics to increase sales. If Loverock say's its the truth, than it has to be ........ right?
@SoYouSaid Now want to buy the brooklyn bridge????
@zmud

Yep!

How do you know that any of those companies hire criminals to write malware just to sell their product?
@zmud "Symantec and McAfee, and others, have been using these tactics for years."
Fear is a Best tactic to control Americans all these years. We cannot living in fear forever. These crooks are more cunning because nobody is willing to stand up on them.
@Netteligent Indeed. Same reason we'll likely be dropping bombs on Iran before the election.
  • Flagged
Doesn't surprise me... Norton and McAfee (and some others) have always played the game of "your computer may be at risk so install our products".

I gave up using paid for security software years ago but even when I did they always told me that my computer was at risk because I didn't use their brand of firewall or other parts of their suite. I always had to laugh because as an IT professional I take the security of my personal computers and the computers/servers I manage and support at work very seriously. I know I need security software/hardware to protect myself but not one that hounds me and gives me false information just to scare money out of my wallet.
@bobiroc

Hounds you? How is warning you about something on a website (which you can then report to the website owner) that is bad 'hounding you'? Sheer insanity and stupidity here.
@Lerianis10

First of all the name calling is not necessary, but I am sure if you talk to anyone that uses those suites they are constantly popping up with alerts and information about products/features that can be added or alerting you of every little change. They may UAC look mild. Many of the things that get notified are not warnings of anything security related and not necessary. There are other security softwares that do what the need to do and protect just as well without having a notification center that hops on your screen like a monkey on crack.

So instead of covering up your lack of knowledge and understanding or insecurity by calling someone else stupid maybe you need to get a clue.
@bobiroc

Uh, bobiroc.... I USE THAT SUITE! I see MAYBE one alert a day for something like this and it's usually an alert that I wish to see, because somebody is trying to get into my PC illegitimately or there is something 'bad' on a webpage that I immediately inform the website owner about.

Norton is doing the right thing here. It is just sheer insanity and stupidity (it's not name-calling, it's what I really think about anyone who uses the argument that you used) to say that you SHOULDN'T be alerted for things like this.
  • Flagged
0 Votes
+ -
RE: I USE THAT SUITE!
bobiroc 11th Jan
@Lerianis10

Well good for you... I tend to think only stupid people pay for their security software when there are so many free ones out there that protect just as well if not better in some cases. Unless you run a business not eligible for a Free suite of utilities then you are wasting money. I prefer to use a good hardware or dedicated firewall that blocks these things and logs attempts without the notification interrupting my work. I have not used the suites myself in a long time but have clients that do and they almost always say something is not secure enough and that they should buy something extra from that company's set of tools. I have worked on several systems that behind my very strong firewall and with tight security implemented saying that they need something more. Alerts are nice but only if they are actually relevant and do not interfere with the computer operation and piss off the users. There are softwares that can offer excellent protection and do their job without being a nag.

Have a Good Day!
@Lerianis10
Did you even read the article or the discussions?
@bobiroc
Kapersky does a pretty good job of just sitting in the background and not annoying the user.
@commchf I had Kaspersky at one point. Seems alright but it didn't tolerate mis-encoded files. Tried to open a file with "%20" in it (http for a space) and Kaspersky bricked my OS. I'm assuming newer versions have fixed this, but honestly, Kaspersky is the second least annoying paid security software in my opinion.

But, I think I'll stick with Malwarebytes, PeerBlock and SpyBot. I've been spotless for 4 years now.
Then again, I also pay close attention to websites I view, e-mails I read, and files I download. The very few infections I've download the past four years Malwarebytes and SpyBot have picked up. Also, Chrome deletes all data (though synced) when closed.
Double post...
Kaspersky is even worse. Alerts come at almost every installation of a software(happened with my friend, every time he tried to install something, kaspersky popped up), plus if you're using a trial version, get ready for a nag every time you log in.
@commchf Yeah, but the important thing isn't annoying users, who are already annoyed. It's not getting ripped off by fraud or having the user do the same. I'll be watching this webinar tomorrow on the 18th cause I think they'll bring it straight. Whatever you think of Dell, I think Trend is the better security http://ow.ly/8wJLm
@bobiroc
It's about time Symantec is cut down to size. They, like Kaspersky, are run-of-the-mill security programs, leaves registry entries, after an uninstall, that cannot be removed & Scott Cooper of Kaspersky plays games when requesting removal instructions... run away from these companies and their inferior products.
oh yeah. i knew about their scheme a while back and never used their products again. it happened when i installed one of their programs, (don't remember which one) but i think it was the a.v. w/firewall support. in any case, after i did so the program was telling me that someone from china was trying to hack into my pc. it even showed me a little map of the location in china. anyways, this was ridiculous to me. however, i kept getting constant messages about virus's on my system. which was also ridiculous and annoying. when the year was up and time to renew, i cancelled. never had a virus since then nor threats of someone from china trying to tap into my pc.
@databaseben@...

Those warnings are usually accurate. I got them as well and, lo and behold, someone from China was actually trying to connect to my system illegitimately.

I.E. not for one of the torrent/filesharing clients I use.

I'm glad Norton informed me of that so I could permanently block the IP address in question.
@Lerianis10

"I'm glad Norton informed me of that so I could permanently block the IP address in question."

Sounds like you need a good hardware firewall.
@bobiroc

Bob, I have a router with a 'hardware firewall'..... I don't use it because it has a habit of not letting the filesharing applications I use through it properly.

Until they fix UPnP, the hardware firewall is going off immediately when I buy any router.
@Lerianis10

Then you truly do not have clue 1 about network security. I suggest get a nice router and flash it with DDWRT or something where you can control what it does. The stock flash is weak I will admit but it is insane to turn it off completely. And you have the audacity to call me stupid.

Have a Good Day!
I use to be a hacker, never did anything destructive though, but if you are being hacked by a real hacker from China most likely the IP address is bogus. So blocking it would be useless. If you don't believe me then try blocking IP addresses for spam mail and you'll get the same spam with a different IP Address, again and again. As far as Norton's goes, I would never use them after spending over 8 hours talking to tech. from India who I could not understand and I made the big no-no by giving them remote access to my computer. Took weeks to undo what they did. And then they wanted to charge me $90 bucks. I think not. lol
@databaseben@... Children please...control yourselves.
0 Votes
+ -
AVG did this too around 2003
Martmarty 11th Jan
I remember AVG antivirus did this also.
I have a trial version and after around 6 months auto-updating itself, it creates Balloon Tips at the system tray claiming I have malware in my system and I need to upgrade my version of AVG. When I click the balloon it opens my browser and brings me to AVG secure site to use my credit card for a full version. So, this trick from AV companies is not new. I never touched that AV again up to this time, and I never will.
@Martmarty I have been running AVG on all the systems I care for (4), for 3-4 years, and have never had a problem with bogus warnings. Yes, it asks if you would like to upgrade to pro, but it never threatens you.
0 Votes
+ -
AVG
Martmarty 11th Jan
@trybble1
I agree, not anymore. But, as mentioned in my subject line, I experienced that around 2003. My system that time was XP Home. I won't forget that experience.
In fact our IT in office experienced it too. And that was around 2006 and the system in our office that time is XP Pro SP2.
I don't know about the trial version, But I've been using the free version when it first came out 10 years ago. I have never had a problem with it. Now with the free version when it tells me to upgrade it send me to a page that lets you upgrade the free version in small print. lol, and the full version in big print, so if you don't read the small print you may think your only choice is to pay. But for a short period I tried Nortons then my problems started, so I went back to AVG and have not had a problem with it. And after I unistalled Nortons, I found a few viruses on my computer that Nortons had not removed and were running with Nortons. Now I do also use other software to maintain my computer like IOBit software which I pay for but it is cheap and works good. IOBit has a free version also but I liked it so much I payed for a copy.
@jcorzine_5
I use AVG too.
It seems OK.
Their installer is utter crap though.
0 Votes
+ -
In Symantec's defense ...
Rabid Howler Monkey 11th Jan
They did not use an Adobe or Oracle (Java) exploit in an email or web page to get one to install their product to begin with. This is, simply, overly-aggressive marketing for follow-on sales. Similar to, but more onerous than, receiving emails from an ISV for upgrades or additional products after a purchase.

Allow users to disable these offers during the initial install. Or, better yet, allow users to opt-in to these offers via a setting after install.

The real story, however, is that AV effectiveness pales in comparison to application whitelisting and sandboxing solutions:

https://zeustracker.abuse.ch/

Note the average binary executable AV detection rate for the ZeuS trojan. It's currently just below 37%.

When will these companies provide application whitelisting and sandboxing solutions to their consumer and small business customers? The solutions exist for their enterprise customers. Am not saying that there is no place for AV software, but it offers a lower tier of protection.
@Rabid Howler Monkey

The problem is that 'application whitelisting' and 'sandboxing' doesn't work correctly on Windows where there are MILLIONS of applications that people might want to use, both free and paid.

We simply need programs to STOP installing crap to the Windows directory, stop installing to the Program Files and Program Files (x86) directories (I
install everything to C:\Applications) and move on.

If anything except a Windows Update installer tries to touch/alter C:\Windows or those other two directories? A big warning message is flashed saying "DO YOU REALLY WANT TO ALLOW THIS! THIS IS MALWARE TYPE BEHAVIOR!" that has a check box that has to be clicked and an OK box.
@Lerianis10 wrote:
"We simply need programs to STOP installing crap to the Windows directory, stop installing to the Program Files and Program Files (x86) directories (I
install everything to C:\Applications) and move on.

Wrong answer. Mark Russinovich of Microsoft does not refer to UAC as a security boundary because his expectations are that the malware miscreants will simply do their dirty work in standard user accounts. Like the ZeuS trojan does:

http://www.symantec.com/security_response/writeup.jsp?docid=2010-011016-3514-99&tabid=2

Read the write-up, access to C:\Windows or C:\Program Files is unnecessary.
@Lerianis10 Actually Windows 7/Vista is already doing that. New applications is now written into C:\Users\%username%\AppData instead of C:\Program Files. For old Applications if they use Application Data path variable will also get redirect to AppData, only writing into %ProgramFiles% or %ProgramFiles(x86)% would (and always) trigger UAC dialog.
If an Application trying to write into Windows or system dir it's either forbidden or trigger a red UAC dialog.

As for not installing into C:\Program Files... how would it make a different if you install everything to C:\Applications? You've just turned C:\Applications into another c:\program files.
@Lerianis10
That's why Google Chrome and possibly others install from the users directory. They will always find a way.
@Rabid Howler Monkey
The problem isn't that they are trying to upsell people on their own product, it's that they mislead people into believing that there is a security problem on their computer which isn't really a problem. And then they try to upsell based on the misleading evidence of a problem.

I don't use commercial AV software for exactly this reason. Their best business model does not include one piece of software that solves all of my problems and that never needs to be upgraded.

@Rabid Howler Monkey
No argument here about ads in ISV, I just don't think that is the same problem as "legitimate" companies using scareware techniques to trick unsuspecting (and mostly computer illiterate) people into buying other products.
@jaker8 wrote:
"The problem isn't that they are trying to upsell people on their own product, it's that they mislead people into believing that there is a security problem on their computer which isn't really a problem.

Am not condoning Symantec's behavior. However, the core issue is that when I purchase software from an ISV, I don't want to see *ANY* ads from that ISV unless I have explicitly agreed to allow them to present ads to me. And email-based ads, via an opt-in mechanism during the product install, is MUCH preferable to any ads built into the app. Advertising has no place inside of a paid app IMO, misleading or otherwise.
Symantec customer service refused to help me install my 360 deg Symantec software. They wanted me to pay $39.99, installation help. The first thing customer service rep says is " your computer may be infected".
Symantec customer service refused to help me install my 360 deg Symantec software. They wanted me to pay $39.99, installation help. I bought this new software from Newegg.com. I have similar software from Symantec installed last year. After I removed my older symantec software from last year, my DVD/CD driver stopped functioning.
It's bad enough they do that but since its been bloatware for so long now I know many users/companies including myself that have gone away from it. Glad I did
As much as Symantec Norton irritates me. (Bad opinion due to not being able to locate my past purchases due to their new order system!) Please read the following in Defense of Symantec. For actually scare tactics or not they have some good programs not everything is about hype. (AND NO I DO NOT WORK FOR THEM!)
Being one of the stupid people that pays for all their software..I am new to this realm. However, reading each and every post here. Since it seems you all are computer literates to my illiteracy, why not help the av companies and help track down all these so called hackers that damage our computers? Why fight about scare tactics? I had a horrible person send me the windows virus with an e-mail. Not sure how it was done for I had an av on my system. Did not know until it had damaged everything. So Okay.. scare tactics? Maybe, but I prefer to think of it as warning of what can happen. Regards, Swedenmom
@anna6161

Welcome to the forums. Don't feed the trolls, of which there are plenty.

I too pay for all of my software (or use freeware/open source alternatives). Here is the problem: The most common forms of infection I see these days are fake antivirus programs that warn of imminent danger, inform the user that they have been infected with 'ch1ldpr0npr0xy' or similar, and that it can (conveniently) remove it for the low, low price of $39.95.

When Vista Super Duper Security XP 2017 and Norton Antivirus start mimicking each other, it becomes a game of "who can spot the counterfeit". Us technical people can generally figure them out, but consider the following slide show: (http://multiply.com/slideshow/rcsservices:photos:3/1). Plenty of them look rather legit and would fool the overwhelming majority of users. If Symantec mimics them, then all they do is dilute their own brand to being written off as just another one of the scams.

Having Symantec do a "simulated infection" doesn't necessarily come across as educational, since it's impractical for the antivirus to simulate exactly WHY it's happening. Also, if you just paid for an antivirus and it simulates an infection, that sounds to me like a LOT of support calls saying "why is my machine infected when I just paid for this software?!?". It's a can of worms that Symantec is foolish to open.

As for why we don't help them, there are two answers to that. First, we *do* actually help them. Most antivirus applications will send back samples of heiurestic-based malware detections to the company for further analysis (in varying permutations of consent/opt-in/opt-out). Second, if you think home user protection software is expensive, you'd probably fall of your chair at the cost of the enterprise-grade detection suite costs. It can easily cost tens of thousands of dollars annually to protect a corporate LAN. Symantec has plenty of people on their payroll whose job it is to track down new infections and generate new definition updates to protect customers. I'm not one of them - on the contrary, I pay that payroll (ESET in my case, not Symantec, but the point holds). If I'm paying for a company to provide protection against viruses and malware, then by all accounts the onus is on them to actually provide that service. I already have a job, and being free labor to my antivirus company isn't in my job description.

Joey
Do people on Windows still use this bull? Install Microsoft Security Essentials and be done with it.
What's to stop companies from making malware, viruses etc. so that way they a never ending source of selling their product?
Kind of like what the US Military does.......if they don't have an enemy to fight they manufacture one. This keeps military contractors in business and round and round we go.
@rocketman67
Are you really that naive? The military serves at the pleasure of the JCS who then eventually rolls up through the politicians to the CinC. It is they who place us on the pointy end of the spear and send us forward to represent the government and by extension the will of the people. Take a civics class. We don't live in a 'Stan, or anyplace in Africa. Least I don't. USAF, 1966-1991.
@ExEC135CrewDog do you know that the companies producing weaponry in USA are private? Technically if those companies want to maintain their economy they need someone to sell their products to. I doubt they want world peace or can you imagine Lockheed (now Lockheed Martin) asking for world peace ?

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix