Feeds

Malware lurks behind safety seal

A question of TRUSTe

Protecting against web application threats using SSL

Sites handed the TRUSTe seal of approval are twice as likely to host malware or engage in spamming as those not endorsed by any security certificate, according to a study by spyware researcher Ben Edelman.

Edelman reached this conclusion after cross-referencing a sample of 500,000 top websites, as reported by a major ISP, that are endorsed by a TRUSTe certificate with data on untrustworthy sites, as listed by McAfee's SiteAdvisor service.

Of the sites certified by TRUSTe, 5.4 per cent are linked to either spamming or spyware, according to SiteAdvisor's data. This compares to just 2.5 per cent of sites in the rest of the ISP's list that SiteAdvisor categorises as unsavoury.

TRUSTe disputes these findings and takes issue with Edelman's methodology. "Saying that our sites are more untrustworthy is a stretch," TRUSTe marketing director Carolyn Hodge told vnunet.com.

The non-profit organisation runs a well-known website privacy scheme that allows sites to display its seal of approval providing TRUSTe approves of an organisation's privacy policy.

As Edelman points out, many reputable websites have bought into the scheme as a way of assuaging the privacy concerns of net users. The problem is that TRUSTe seals also feature prominently on various sites identified as unsavoury by SiteAdvisor. Edelman acknowledges that SiteAdvisor data isn't perfect, but argues "if SiteAdvisor says a site is bad news, while TRUSTe gives it a seal, most users are likely to side with SiteAdvisor".

He singles out four sites certified by TRUSTe as of January 2006 that enjoy a dubious reputation including: Direct-revenue.com, an adware purveyor that faces litigation by the New York Attorney General; Funwebproducts.com, whose toolbar allegedly appears in ads shown by other vendors' spyware; Maxmoolah.com, which sells email addresses to spammers, according to Edelman's tests; and Webhancer.com, which installs tracking software on surfer's PCs without their informed consent.

TRUSTe said FunWebProducts was listed as a member on its site in error while Direct Revenue and Maxmoolah no longer hold TRUSTe certifications. But Edelman argues that both organisations shouldn't have been allowed a privacy seal in the first place yet enjoyed the benefits of TRUSTe endorsement for months before it pulled their right to display its certificate.

Edelman acknowledges that establishing and enforcing a compliance regime is tough, but says TRUSTe is biased against turning applications down. "Hard-hitting rules are particularly unlikely when certification authorities get paid for each certification they issue - but get nothing for rejecting an applicant," he said.

"Consumers deserve certifications that are correctly issued in the first place - not merely revoked after months or years of notorious misbehaviour, and not mistakenly listed as having been issued when in fact they were not," he concludes, adding that there are problems with TRUSTe's approach beyond those involving the four sites he highlights. ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
UK.gov lobs another fistful of change at SME infosec nightmares
Senior Lib Dem in 'trying to be relevant' shocker. It's only taxpayers' money, after all
Critical Adobe Reader and Acrobat patches FINALLY make it out
Eight vulns healed, including XSS and DoS paths
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Beginner's guide to SSL certificates
De-mystify the technology involved and give you the information you need to make the best decision when considering your online security options.