Best of the ISP-Lists

Beware of Gifts Bearing Trojans

Members of the ISP-Tech list unearth strange happenings at the fringe of the business world. One ISP reports an outsourced signup CD contained a Trojan horse that would have sent out a subscriber's data to an advertising agency.

[August 17, 2001]

On the ISP-Tech list in August, RO observed,

"We've been working with a company that creates signup CDs. During the last test install, our senior technician noticed a strange file called tsadbot.exe being loaded with the system. It's a Trojan horse type file that sends information back to a different company for data mining. Has anyone else noticed this kind of file on signup CDs?"

VB contended the file really isn't that scary:

"TSAdBot downloads ads from its home site, stores them on your computer, and displays them when an associated program is running. It may be annoying, but it's not a 'Trojan horse.' It doesn't get on your computer unless you install a piece of software that has chosen to use it. If you don't want it, don't use shareware."

A number of respondents were a little more disturbed by the idea:

[RR asserted] "It is indeed a Trojan horse. It sneaks into a user's computer and infects it. The user has noknowledge that this is happening, and for a signup CD company to secretly distribute it is inexcusable."

[PF agreed] "If you buy a software package and they don't tell you about ad-ware, then what would you call it? A benefit? A feature?"

[JW added] "If all it does is pop up ads, that's one thing; but this is apparently a 'file that sends information back to a different company for data mining.' I don't want any software (shareware, freeware, anything) sending my info to some company without telling me about it."

VB again argued that the file doesn't do anything dangerous:

"Well, it sends your IP address, which is required for ad delivery; a code that identifies the piece of shareware you're using; what ads you've seen; and what ads you've clicked on. Boy, that's some terrible piece of software, isn't it? I rate this right up there with the 'cookies are evil' hysteria."

Others maintained that it is worth worrying about:

[RR suggested] "Refer to www.cexx.org/tsadkill.htm for a complete description of this software. It's something that cannot be easily uninstalled, even if you uninstall the software that introduced it to your system.

The issue is that ISPs are responsible for the software that they distribute to their users. If the ISP doesn't know about it, they can't prevent it or tell their users about it. The problem here is not that the software exists and runs ads, but that the vendor did not tell their customer about it.

There are privacy issues involved here, whether or not the data sent is innocuous. When a vendor does this something like this, it hurts everyone."

[PF added] "With all the hysteria about privacy out there, the best you can do is to keep that stuff off the end user's system. Remember that any software installed is now your responsibility, and any lag or degradation in the online experience due to this ad-ware is going to reflect poorly on your service. Unless you get a cut of the ad revenue, you should protect your investment (the customer) as much as possible."

[JW agreed] "The issue isn't privacy; it's violation of trust. If this program was slipped in without your knowing about it, and if it's designed to be extremely difficult to remove, then you have the right to be angry."

— End

 

Related articles:
	[Jul. 17, 2001]	The Secret To Online Privacy
	[Apr. 26, 2001]	Wireless Privacy: An Oxymoron?
	[Jun. 13, 2001]	Best of the Best of the ISP-Lists: Advertising Options