Spyware Snags Blogger Users

By Matthew Hicks  |  Posted 2005-02-23 Print this article Print

Users and researchers warn of unwanted software downloads spreading through Weblogs hosted on Google's blog service.

Weblogs are spreading more than opinions and observations across the Internet. Some are beginning to propagate malicious software downloads that can alter browser settings, track users and serve pop-up ads. Dozens of blogs hosted by Google Inc.s Blogger service can install programs that are widely considered to be spyware and adware onto visitors computers, warn users and spyware researchers. In many cases, users are discovering the offending sites as they browse among blogs through Bloggers navigation bar.
The offending blogs typically prompt visitors to accept downloads through misleading pop-up windows, said Ben Edelman, a vocal spyware critic and Harvard University researcher. While a user typically must accept the download before the software installs, the prompts often attempt to trick users by disguising the download as a necessary Windows or Internet Explorer upgrade.
Edelman, who on Tuesday posted the results of his tests, discovered dozens of Blogger-hosted blogs spreading spyware and adware programs such as Elitetoolbar, Crazywinnings and DirectRevenue. For example, security vendors such as Symantec Corp. classify Elitetoolbar, or EliteBar, as adware because it installs an Internet Explorer tool bar, redirects search queries and initiates pop-up ads. A Google spokesperson Tuesday confirmed that Blogger was aware of the spyware issue but declined to provide details about how the company plans to address it. "We are aware of this issue, and we are looking into it," the spokesperson said. What about blog spam? Click here to read about leading search and blog vendors collaborating to fight comment spam. One victim of spyware from a Blogger-hosted blog was attorney Alvin Borromeo of Columbus, Ohio. He first wrote about the problem in a post in January on the blog of his law firm, Mallory & Tsibouris Co. LPA. Last week, he posted an update with details of Bloggers reply to his inquiries. Borromeo reached a blog that installed spyware on his Windows computer after clicking the "Next Blog" link in the Blogger navigation bar, he said. He then noticed pop-up ads appearing and that his Internet Explorer home page was changed. Blogger in August had introduced the navigation bar atop blogs that it hosts. The bar is optional for Blogger users with their own Web hosting. "It was very surprising," Borromeo said. "Its something that youd expect that Google would be up on, and it came as a shock to me that I would get [spyware] through this avenue." Borromeo added a warning to the law firms blog about the potential for spyware downloads when navigating blogs and later moved his blog to the firms own host in order to remove the Blogger navigation bar. "I dont want my users going onto my blog and then clicking that next link and getting spyware downloaded onto their system," Borromeo said. In his investigation, Edelman found that many of the affected blogs on Blogger had included JavaScript code in their templates that pointed to a service called iWebTunes. The iWebTunes Web site provides few details about the service and no contact information, but Edelman said the service appears to promise blogs the ability to play music while it also serves up downloads for spyware and adware. A Google search on iWebTunes and Blogspot, the name of Bloggers hosting service, yields pages of blog results. When eWEEK.com visited about five of the blogs, they displayed pop-ups in Internet Explorer with misleading prompts to accept downloads. When one download was accepted, it installed the EliteBar, which disabled other IE tool bars, including the Google Toolbar; changed the browser home page to SearchMiracle.com and began displaying pop-up ads even when IE was closed. Click here to read an eWEEK Labs review of enterprise anti-spyware software. To fix the problem, Edelman suggested that Blogger disable or limit the ability of bloggers to add JavaScript into blog templates. Blogger already blocks users from including JavaScript in their blog posts or in blog comment sections, Edelman said. "Googles fault here is the fault of allowing the JavaScript, and the blog administrators fault is bad judgment of doing business with iWebTunes," Edelman said. Both Edelman and Borromeo were critical of Blogger for being slow to deal with the spyware and adware issues. Both said they have contacted Blogger with the addresses of specific blogs with spyware and adware downloads, but so far none of those blogs has been fixed or removed. Check out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.
Matthew Hicks As an online reporter for eWEEK.com, Matt Hicks covers the fast-changing developments in Internet technologies. His coverage includes the growing field of Web conferencing software and services. With eight years as a business and technology journalist, Matt has gained insight into the market strategies of IT vendors as well as the needs of enterprise IT managers. He joined Ziff Davis in 1999 as a staff writer for the former Strategies section of eWEEK, where he wrote in-depth features about corporate strategies for e-business and enterprise software. In 2002, he moved to the News department at the magazine as a senior writer specializing in coverage of database software and enterprise networking. Later that year Matt started a yearlong fellowship in Washington, DC, after being awarded an American Political Science Association Congressional Fellowship for Journalist. As a fellow, he spent nine months working on policy issues, including technology policy, in for a Member of the U.S. House of Representatives. He rejoined Ziff Davis in August 2003 as a reporter dedicated to online coverage for eWEEK.com. Along with Web conferencing, he follows search engines, Web browsers, speech technology and the Internet domain-naming system.

Submit a Comment

Loading Comments...
Manage your Newsletters: Login   Register My Newsletters

Rocket Fuel