Spyware Snags Blogger Users

Weblogs are spreading more than opinions and observations across the Internet. Some are beginning to propagate malicious software downloads that can alter browser settings, track users and serve pop-up ads.

Dozens of blogs hosted by Google Inc.s Blogger service can install programs that are widely considered to be spyware and adware onto visitors computers, warn users and spyware researchers. In many cases, users are discovering the offending sites as they browse among blogs through Bloggers navigation bar.

The offending blogs typically prompt visitors to accept downloads through misleading pop-up windows, said Ben Edelman, a vocal spyware critic and Harvard University researcher. While a user typically must accept the download before the software installs, the prompts often attempt to trick users by disguising the download as a necessary Windows or Internet Explorer upgrade.

Edelman, who on Tuesday posted the results of his tests, discovered dozens of Blogger-hosted blogs spreading spyware and adware programs such as Elitetoolbar, Crazywinnings and DirectRevenue. For example, security vendors such as Symantec Corp. classify Elitetoolbar, or EliteBar, as adware because it installs an Internet Explorer tool bar, redirects search queries and initiates pop-up ads.

Resource Library:

A Google spokesperson Tuesday confirmed that Blogger was aware of the spyware issue but declined to provide details about how the company plans to address it.

"We are aware of this issue, and we are looking into it," the spokesperson said.

What about blog spam? Click here to read about leading search and blog vendors collaborating to fight comment spam.

One victim of spyware from a Blogger-hosted blog was attorney Alvin Borromeo of Columbus, Ohio. He first wrote about the problem in a post in January on the blog of his law firm, Mallory & Tsibouris Co. LPA. Last week, he posted an update with details of Bloggers reply to his inquiries.

Borromeo reached a blog that installed spyware on his Windows computer after clicking the "Next Blog" link in the Blogger navigation bar, he said. He then noticed pop-up ads appearing and that his Internet Explorer home page was changed.

Blogger in August had introduced the navigation bar atop blogs that it hosts. The bar is optional for Blogger users with their own Web hosting.

"It was very surprising," Borromeo said. "Its something that youd expect that Google would be up on, and it came as a shock to me that I would get [spyware] through this avenue."

Borromeo added a warning to the law firms blog about the potential for spyware downloads when navigating blogs and later moved his blog to the firms own host in order to remove the Blogger navigation bar.

"I dont want my users going onto my blog and then clicking that next link and getting spyware downloaded onto their system," Borromeo said.

In his investigation, Edelman found that many of the affected blogs on Blogger had included JavaScript code in their templates that pointed to a service called iWebTunes. The iWebTunes Web site provides few details about the service and no contact information, but Edelman said the service appears to promise blogs the ability to play music while it also serves up downloads for spyware and adware.

A Google search on iWebTunes and Blogspot, the name of Bloggers hosting service, yields pages of blog results. When eWEEK.com visited about five of the blogs, they displayed pop-ups in Internet Explorer with misleading prompts to accept downloads.

When one download was accepted, it installed the EliteBar, which disabled other IE tool bars, including the Google Toolbar; changed the browser home page to SearchMiracle.com and began displaying pop-up ads even when IE was closed.

Click here to read an eWEEK Labs review of enterprise anti-spyware software.

To fix the problem, Edelman suggested that Blogger disable or limit the ability of bloggers to add JavaScript into blog templates. Blogger already blocks users from including JavaScript in their blog posts or in blog comment sections, Edelman said.

"Googles fault here is the fault of allowing the JavaScript, and the blog administrators fault is bad judgment of doing business with iWebTunes," Edelman said.

Both Edelman and Borromeo were critical of Blogger for being slow to deal with the spyware and adware issues. Both said they have contacted Blogger with the addresses of specific blogs with spyware and adware downloads, but so far none of those blogs has been fixed or removed.

Check out eWEEK.coms for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzers Weblog.