Feeds

Malware lurks behind safety seal

A question of TRUSTe

Choosing a cloud hosting partner with confidence

Sites handed the TRUSTe seal of approval are twice as likely to host malware or engage in spamming as those not endorsed by any security certificate, according to a study by spyware researcher Ben Edelman.

Edelman reached this conclusion after cross-referencing a sample of 500,000 top websites, as reported by a major ISP, that are endorsed by a TRUSTe certificate with data on untrustworthy sites, as listed by McAfee's SiteAdvisor service.

Of the sites certified by TRUSTe, 5.4 per cent are linked to either spamming or spyware, according to SiteAdvisor's data. This compares to just 2.5 per cent of sites in the rest of the ISP's list that SiteAdvisor categorises as unsavoury.

TRUSTe disputes these findings and takes issue with Edelman's methodology. "Saying that our sites are more untrustworthy is a stretch," TRUSTe marketing director Carolyn Hodge told vnunet.com.

The non-profit organisation runs a well-known website privacy scheme that allows sites to display its seal of approval providing TRUSTe approves of an organisation's privacy policy.

As Edelman points out, many reputable websites have bought into the scheme as a way of assuaging the privacy concerns of net users. The problem is that TRUSTe seals also feature prominently on various sites identified as unsavoury by SiteAdvisor. Edelman acknowledges that SiteAdvisor data isn't perfect, but argues "if SiteAdvisor says a site is bad news, while TRUSTe gives it a seal, most users are likely to side with SiteAdvisor".

He singles out four sites certified by TRUSTe as of January 2006 that enjoy a dubious reputation including: Direct-revenue.com, an adware purveyor that faces litigation by the New York Attorney General; Funwebproducts.com, whose toolbar allegedly appears in ads shown by other vendors' spyware; Maxmoolah.com, which sells email addresses to spammers, according to Edelman's tests; and Webhancer.com, which installs tracking software on surfer's PCs without their informed consent.

TRUSTe said FunWebProducts was listed as a member on its site in error while Direct Revenue and Maxmoolah no longer hold TRUSTe certifications. But Edelman argues that both organisations shouldn't have been allowed a privacy seal in the first place yet enjoyed the benefits of TRUSTe endorsement for months before it pulled their right to display its certificate.

Edelman acknowledges that establishing and enforcing a compliance regime is tough, but says TRUSTe is biased against turning applications down. "Hard-hitting rules are particularly unlikely when certification authorities get paid for each certification they issue - but get nothing for rejecting an applicant," he said.

"Consumers deserve certifications that are correctly issued in the first place - not merely revoked after months or years of notorious misbehaviour, and not mistakenly listed as having been issued when in fact they were not," he concludes, adding that there are problems with TRUSTe's approach beyond those involving the four sites he highlights. ®

Top 5 reasons to deploy VMware with Tegile

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Astro-boffins start opening universe simulation data
Got a supercomputer? Want to simulate a universe? Here you go
prev story

Whitepapers

Driving business with continuous operational intelligence
Introducing an innovative approach offered by ExtraHop for producing continuous operational intelligence.
Why CIOs should rethink endpoint data protection in the age of mobility
Assessing trends in data protection, specifically with respect to mobile devices, BYOD, and remote employees.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Protecting against web application threats using SSL
SSL encryption can protect server‐to‐server communications, client devices, cloud resources, and other endpoints in order to help prevent the risk of data loss and losing customer trust.