Feeds

Fake Firefox site bundles undead adware

Zango crapware rises from the grave

Beginner's guide to SSL certificates

Adware slingers have taken advantage of the buzz around the latest version of Firefox to establish a fake browser download site.

The counterfeit Firefox download site is disguised as a kosher browser download site and might easily fool the unwary. A closer look, however, reveals the version of Firefox on offer is version 3.5 (instead of the latest 3.6 version supplied by Mozilla). In addition, terms such as "Anti-Pishing" (sic) are misspelled on the glossy counterfeit download site.

Web users taken in by the scam will wind up downloading browser software contaminated with the Hotbar toolbar from Pinball Corp, formerly Zango. The software bombards marks with irksome pop-up ads while also further slowing performance by loading the Hotbar weather application in the system tray.

Security firm eSoft, which documents the risk here, reckons that the ruse is more likely the brainchild of a rogue Pinball agent rather than the firm itself. Pinball rewards its pay-per-install affiliate with up to $1.45 per install, eSoft adds.

Users looking to get the latest version of Firefox are advised to go to Mozilla's getfirefox.com site. eSoft has blocked access to the fake site for users of its technology. Other vendors can be expected to follow suit.

Zango was repeatedly obliged to defend itself against accusations that its ad-serving software was distributed without the informed consent of users. Security firms routinely categorised Zango's software as adware, sparking unsuccessful lawsuits against Kaspersky Lab and PC Tools in 2007. Its PR staff tenaciously held the line that any problems were down to rogue affiliates, which it was in the process of culling even before it paid the FTC to settle a privacy lawsuit back in 2006.

However its chief tormentors - Ben Edelman, an assistant professor at the Harvard Business School, and Chris Boyd, former security researcher at Facetime Security - continued to document evidence of malpractice by Zango years after the FTC settlement. Zango went titsup last April, but its Hotbar technology lingers on the interwebs, as evidenced by the fake Firefox download ruse. ®

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.