Feeds

Malware lurks behind safety seal

A question of TRUSTe

Secure remote control for conventional and virtual desktops

Sites handed the TRUSTe seal of approval are twice as likely to host malware or engage in spamming as those not endorsed by any security certificate, according to a study by spyware researcher Ben Edelman.

Edelman reached this conclusion after cross-referencing a sample of 500,000 top websites, as reported by a major ISP, that are endorsed by a TRUSTe certificate with data on untrustworthy sites, as listed by McAfee's SiteAdvisor service.

Of the sites certified by TRUSTe, 5.4 per cent are linked to either spamming or spyware, according to SiteAdvisor's data. This compares to just 2.5 per cent of sites in the rest of the ISP's list that SiteAdvisor categorises as unsavoury.

TRUSTe disputes these findings and takes issue with Edelman's methodology. "Saying that our sites are more untrustworthy is a stretch," TRUSTe marketing director Carolyn Hodge told vnunet.com.

The non-profit organisation runs a well-known website privacy scheme that allows sites to display its seal of approval providing TRUSTe approves of an organisation's privacy policy.

As Edelman points out, many reputable websites have bought into the scheme as a way of assuaging the privacy concerns of net users. The problem is that TRUSTe seals also feature prominently on various sites identified as unsavoury by SiteAdvisor. Edelman acknowledges that SiteAdvisor data isn't perfect, but argues "if SiteAdvisor says a site is bad news, while TRUSTe gives it a seal, most users are likely to side with SiteAdvisor".

He singles out four sites certified by TRUSTe as of January 2006 that enjoy a dubious reputation including: Direct-revenue.com, an adware purveyor that faces litigation by the New York Attorney General; Funwebproducts.com, whose toolbar allegedly appears in ads shown by other vendors' spyware; Maxmoolah.com, which sells email addresses to spammers, according to Edelman's tests; and Webhancer.com, which installs tracking software on surfer's PCs without their informed consent.

TRUSTe said FunWebProducts was listed as a member on its site in error while Direct Revenue and Maxmoolah no longer hold TRUSTe certifications. But Edelman argues that both organisations shouldn't have been allowed a privacy seal in the first place yet enjoyed the benefits of TRUSTe endorsement for months before it pulled their right to display its certificate.

Edelman acknowledges that establishing and enforcing a compliance regime is tough, but says TRUSTe is biased against turning applications down. "Hard-hitting rules are particularly unlikely when certification authorities get paid for each certification they issue - but get nothing for rejecting an applicant," he said.

"Consumers deserve certifications that are correctly issued in the first place - not merely revoked after months or years of notorious misbehaviour, and not mistakenly listed as having been issued when in fact they were not," he concludes, adding that there are problems with TRUSTe's approach beyond those involving the four sites he highlights. ®

New hybrid storage solutions

More from The Register

next story
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
THREE QUARTERS of Android mobes open to web page spy bug
Metasploit module gobbles KitKat SOP slop
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Snowden, Dotcom, throw bombs into NZ election campaign
Claim of tapped undersea cable refuted by Kiwi PM as Kim claims extradition plot
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.