Zango, the FTC, MySpace and You Tube
This past Friday, the FTC announced a $3 million dollar settlement with Zango, formerly named 180solutions, in a lawsuit charging Zango with unfair and deceptive business practices, among other things. See ZDNet story here with more details. FTC announcement here. Case documents can be downloaded here.
As usual Zango refuses to take responsibility for anything, again blaming it on their naughty affiliates. From the ZDNet article:
Zango's executives pointed a finger elsewhere, claiming that the federal violations were due to third-party distributors rather than the software manufacturer itself. "We relied too heavily on our affiliates to enforce our customer notice and consent policies," said CEO Keith Smith. "Unfortunately, this allowed deceptive third parties to exploit our system to the detriment of consumers, our advertisers, and our publishing partners." Smith went on to say that Zango would "embrace the new standards" required by the FTC.
Er, cough.. cough. SOS, different day. How long have the anti-spyware bloggers been writing about this now? Ben Edelman wrote about 180solutions installation methods in July 2004. Eric Howes summed up 180solutions' activities in 2005 with links to over 60 news stories and blogs.
I spoke with Ben Edelman about the FTC's settlement with Zango. Ben states he has proof that Zango is currently not in compliance with the FTC agreement.
180 continues plenty of bad practices, including some unlabeled ads, materially misleading installations that fail to disclose key aspects of 180's effects, and installation attempts predicated on security exploits. I have the proof, and I expect to post this on my web site in the coming weeks, subject only to my busy travel schedule.
I commend the FTC's efforts here, but serious diligence will be required to assure that 180 actually complies with its many obligations under the settlement. At this instant, I am confident that 180 is not in compliance.
Are we surprised? Paperghost of Vitalsecurity blogged on Saturday, after the FTC announcement, that Zango download prompts are appearing along side the Licat IM worm. Another rogue affiliate, I suppose.
Today Websense released an alert titled Fraudulent You Tube video on MySpace installing Zango Cash.
There are screenshots and a video. It must be the naughty affiliates again. What next guys?Websense® Security LabsTM has discovered a number of user pages on the MySpace domain which have videos that look like they are from You Tube. The videos have an installer embedded within them for the Zango Cash Toolbar. When users click on the video, they are directed to a copy of the video, which is hosted on a site called "Yootube.info."