180solutions responds - questions need answers
Yesterday I reported on another nonconsensual install of 180solutions that was discovered and blogged by spyware expert Ben Edelman. Some might wonder why the big deal - after all, 180solutions has a long history of illegal forced installations and problematic business practices as documented in the CDT's 91 page complaint (PDF) to the FTC just a few weeks ago. The big deal is that 180's highly self-touted S3 technology did not solve the issue of nonconsensual installs, even though 180 said on page 4 its white paper
[...] the user will see that either 180search Assistant or Zango Search Assistant is trying to be installed. Installation cannot continue until the user gives consent to continue. Since the consent box comes directly from 180solutions, publishers are unable to turn it off.
My emphasis. 180solutions issued a press release last night saying:
"No software is ever hack-proof," said Keith Smith, co-founder and CEO of 180solutions. "Thanks to our recently-developed S3 technology, we were able to identify the rogue publisher, immediately shut down the channel, and implement our re-messaging efforts in which every user involved in this exploit will be required to re-opt in to the download of our programs if they wish to keep the software."
Aside from 180's self contradiction, the press release brings up questions that demand answers. 180 says:
Despite an unprecedented effort by some industry critics to keep secret the critical information that would have led to a quicker shutdown of the fraudulent behavior, the company, through its own policing mechanisms, was able to track down the nefarious actor responsible and shut him down.
Paperghost asks those questions here.
Why the Hell have 180 always demanded this info from the security researchers, when they can (clearly) do this themselves?
If Ben Edelman had not found that site, and had not written about the install, thus not notifying 180 of this taking place....would this rogue install still be going on at this moment? I guess this can be answered by taking into account the probable number of rogue elements still active - expect them to be shut down after they've been discovered by a security researcher, too.
Exactly.
Press release originally via SunbeltBLOG.