Misleading advertising

Today we are going to be talking about advertising, specifically misleading advertising. Whether it’s on TV or on the internet, in magazines and newspapers, we see misleading advertising all of the time, you see it all of the time, whether you realize it or not. So how do you spot it? Well, that is one of the things we are going to cover here. Once you know what to look for, you’ll be able to spot it yourself, in most cases without having to look any further than the image in the advert.

Our first example of misleading advertising is an advert promoting a “Free Scan”, but failing to mention it is only the scan that is free. In fact, you have to pay before it will fix anything it claims needs fixing. It should also be noted that in the vast majority of cases, most “problems” found are not problems at all. Registry cleaning software are very fond of using this tactic to promote their products, as are so-called “system cleaners” such as SpeedUpMyPC.

Another example is an advert claiming a company’s service is “Only £17.50 per month”, and fails to point out the tiny print on the ad that requires a minimum of 18-24 month contracts. The advertisement companies know you are highly unlikely to see the tiny print. In addition, by employing the use of white and non-bold text, they make it as hard to see as possible.

Indeed, a current Carphone Warehouse advert on TV offered a free “Galaxy tablet”. The catch is once again in the small print, requiring a 24-month contract, and whilst it tells you it comes with 100MB data per month, it does not tell you, you’ll be highly likely to use that 100MB of data within 1-2 days if using sites like Facebook for anything more than the most basic of postings. You’ll definitely use it within 1-2 days if you try doing the usual browsing across various websites (most sites require and use, very little data, with an average of less than 100K, depending on the type of site, but they quickly add up).

You’ll also see these misleading sites and adverts online every day. Whether it’s a misleading download advert or a site pushing you to send an SMS. The advertisers know you either won’t, or likely won’t be able (without zooming in), to read the small print at the bottom of the page, that actually informs you you’re signing up to recurring billing or paying immense interest or even that your information is being sold to a third-party.

Our next target is so-called “free software”.  Don’t get me wrong, open source software that is also free is fantastic.  However, the kind of software you download from high traffic download websites like ‘Download.com’ tend to make revenue by advertising.  This advertising might come in a form you are familiar with like a pop-up or banner ad.  However what you need to watch out for is the software that have something a little more coming with them , and you’re highly likely to miss the fact it is  included with your software – those lovely and infamous toolbars.

Take this for example, an advert for iLivid has 2 basic images embedded in it – “Download”, and “Play Now”.

What this advert does not tell you is:

What you’re downloading

“Play Now”, isn’t “Play Now” – there’s a download required that isn’t required at all and what you’re actually downloading is a download manager. A download manager that comes bundled with so much rubbish that your computer is going to hate you.

It gets worse however, when you click the advert, as you’re then presented with:

This does tell you it’s an image from iLivid but what it doesn’t tell you is that the image that looks like a Windows dialog box, is actually just an image. So there’s no “click anywhere else to get rid of it”, or “cancel, I didn’t want this” and to make things  worse, you’re also going to get both a toolbar that’s completely unnecessary and your homepage is going to be changed to searchnu.com or one of their other sites (depending on the installer used). Worse still, the installer also comes with yet more rubbish bundled (tested it myself before writing this), “Torch” (which in fact, is just a re-branded Google Chrome) for example (and Google, Ask et al are guilty of this too – seen Adobe or Java installers recently?). Not only will Torch be installed, but the installer will also set Torch as your default browser. Additionally, the installer drops two icons on the desktop:

“Get the best Facebook chat messenger”

In reality, this is a link to ftalk.com with the iLivid affiliate ID – you DO NOT need this to chat in Facebook, as those of you that use Facebook chat, will already know, and you don’t want it either

“Play Free Games”

In reality, this is a link to yet another installer, for yet more bundled rubbish, this time, from Koyote Inc, for his or her “FantastiGames” (aka Free Ride Games). These “Free” games however are not free at all and you will quickly realize that  the games are 100% adware. Adware is also something you DO NOT want on your computer and neither do your ears if you have sound enabled on your computer, as they are multimedia ads with full sound and flashy images. Finally, this installer adds yet MORE icons to the desktop – 6 of them in fact, and none of them you actually want or need.

Can you prevent this?

Of course you can. Do you always take notice of every page of an installer? My bet is you don’t, and that’s also what most participating companies are betting on, because if you don’t take notice of the small print, then you’re definitely not going to bother reading those lovely End User License Agreements.

Whilst iLivid have cleaned up their act over the past 12 months (the inclusion of the “iLivid” name on the  Download/Play Now advert was one of my requirements to remove their sites from the hpHosts blacklist) the additional installations of toolbars, browsers and rubbish software they spread are still elements of misleading behavior. I have been trying to contact them about for over 6 weeks now about these issues. It’s worth noting however, that iLivid, believe it or not, are actually one of the more responsible companies when it comes to advertising – hard to believe given they like many others, employ misleading tactics such as the above. Take for example, an advert recently found on Embed Upload:

See what’s wrong here? Well first and foremost, we’ve got the familiar “Download” and “Play” images embedded in the advert, but this one, doesn’t tell you who the advert is from, nor what you’re downloading. In actuality, you’re taken here (note: freedownloadofvideos.com is currently parked at the time of writing this):

dcb.freedownloadofvideos.com/download/video_downloader_ww/?line_item=4627373&banner=162230300&t202kw=3785570184

Via:

ad.yieldmanager.com/clk?3,eJytjd1qg0AQRp.GOwm6E3VFerFq.AFdGrAtelO22dVsqjHo0kafvhqkfYEevovhfMOMCZ7ABqotIfY1czjHhmcCc2ywDZcz3fA8D7s2NvcWOHqSBEPAMpce.eCYHciDeDIo2WhITtasPONHSz6Sa7HVQ6Vi8j9Y0b3cxnT9S5oQk9fmE.FL7.9uxelE45fv6uK3WXGwKEpVXkRtLk1J43LK3sq5CqOOzv45n8s5.7v.pOtnpW4aEA1FSxgfd6r96gSXbHfqu0WNSoPFv6vpJjQIZT2wTmjIXtQo51UB2HeEjcWN4qRkf12dBRgA.wAccGyH,

And it’s worth noting, Yield Manager features quite a lot in misleading adverts (but once again, are actually one of the better ad networks when it comes to misleading adverts – there are networks far, far worse).

I’ll not go into details, but needless to say, this comes with yet more bundled rubbish that you don’t want anywhere near your computer. Then there are these, found on sendspace.com amongst other places – see anything that tells you who the adverts are for, or what they are for?

Perhaps the link href for the advert at the top will tip you off:

hxxp://optimized.by.vitalads.net/click.php?b=1141&z=3&c=1286->hxxp://www.sq2trk2.com/click.track?CID=178129&AFID=213712&ADID=823280&SID=&AffiliateReferenceID=A%40MTozMTk0NTU2MjMxOjM6MTE0MToxMjg2OkdCOjM1NjA0NjQzODE

->->hxxp://pringotrack.com/redirector.php?r=http://lp.ilivid.com/?lpid=513&sysid=406&appid=157&subid=12_32646431_ed327937-1dd7-4053-b541-9abccfa7c1c5

->>> hxxp://lp.ilivid.com/?lpid=513&sysid=406&appid=157&subid=12_32646431_ed327937-1dd7-4053-b541-9abccfa7c1c5

Yep, these ads are for iLivid (and don’t worry, I’m already talking them another email about this).

There are also sites such as speedmaxpc.com, which have had several rather major issues as far as misleading marketing/advertising is concerned (and these are before we get to the extreme scare tactics they use in the software itself!). The following URL for example, which was routed by an advert on Cnet:

1. Misleading and unethical tactics such as the use of “*Limited time offer – Ends on [date]” – you will notice of course, the date this allegedly ends, is the day you are visiting – you noticed that, yes?
2. Misleading use of “Tested spyware free on [date]” – again you’ll notice, the date listed next to it, is the day you visited the site. Seeing a pattern yet? Of course – these dates are generated automatically, so it will always say the same day you are on the site.
3. Misleading use of “Download Malware Removal Tool” – failing miserably, to mention it is not free, but a demo.
4. Misleading and highly unethical use of images from other websites, in their profile pictures, such as the one seen in the above screenshot.

There are however, even worse players, and these do not just use traditional advertising, but also send lots and lots of spam that impersonate other businesses/sites or push links to fraudulent sites or those that go one-step further and compromise other websites. The following site for example, was compromised (I dropped a note at the time of detection, to the host and registrar, who had it cleaned up, and the owner was notified to get it secured) and had hundreds of folders placed onto it:

– swoffordenterprises.com

It also had a ton of files placed onto it, most just a redirect to the criminals’ websites, but one particular file was a shell that allowed the criminal to upload/delete/modify files on the site. Thanks to the host (HostGator), the site has had the malicious content removed and they are trying to contact the customer to get the domain secured.

In the case of this site, all roads led to one particular campaign known as “Online Consumer Tips” (aka “Daily Consumer Tips”, “Online Income Now”). This campaign employs thousands of sites, all involved in a work from home fraud. The campaign has connections to Russia, Ukraine and courtesy of the primary registrar, China (though this connection is purely due to the registrar, BIZCN, being a known “bulletproof” or criminal friendly registrar, and not because any anyone involved is actually based in China).

Whilst we’re on the subject of SMS fraud, a friend in the US recently sent me a copy of an SMS she’d received, which reads;

“Antaun, I was in the news because I made $4785 last week online. Check it out: hxxp://www.thenews9report.com”

The site this points you to, redirects to workinghome5.com (this domain is also valid as workinghome[1-30].com), which looks like this: Everything on this site, including the “Windows Live” button you see in the top right of the sites header, leads to;

hxxp://workinghome5.com/go.php    ->hxxp://tracking.pctrck.com/aff_c?offer_id=20&aff_id=66->->hxxp://onlineincnow.com/2/?aff_sub=66

Recognize the domain you’re being led to? You should, I’ve just talked about it (look further up, I’ll wait for you).

So after this, ask yourself – can you now spot a misleading site/advert? No? Well okay then, how about we look at another scam doing the round for well over a year, this time, it’s those lovely “you’ve won [product]”, otherwise known as “You [are/have been selected as] [todays/this minutes] winner”. These are highly popular with the rogue survey chaps and come in a variety of flavors. We will focus on just one however and see if you can identify the misleading and malicious intent:

This leads when you click “Continue”, to:

What can you do to protect yourself against these tactics? Well, the first is to install an ad block utility or a HOSTS file such as hpHosts that blocks such sites so you will never see them in the first place. This however, will only protect you from those the blacklists and ad blockers know about and are able to block – the best protection is your ability to identify a scam from a mile away, before you even get to the second page in the above example.

The first site you land on, in this case, ipad4u2use.com, is a dead giveaway – there is no way anyone is going to give you an iPad, or anything else, for free. There is always a catch, and in this case, the catch is that you’ve got to fill in your email and other details (which results in you receiving more spam) and fill in surveys, just to find out that you are not going to get the iPad. All of this activity ultimately leads to, yes you’ve guessed – your inbox wanting to kill you.

Similar to these, are file download sites such as fileice.net, filefire.org and cleanfiles.net etc, that require filling in surveys before you can download whatever is supposed to be there (sites such as these, are popular with black hats). As before, not only is the catch the same as above, but the chances of either your being able to download the file slim to none, or if you’re lucky and able to download it, the chances of it’s not infecting your computer, is slim to none (and this includes files they share with other black hats!).

If you ever need help identifying whether or not something is a scam, you can of course, ask. Whether it is a friend, relative, any one of the number of forums out there (security or otherwise, depending on what it is you need verifying), or me, I am always here to help.

* iLivid are also known as iMesh (iLivid is a product, rather than company), Bearshare, Bandoo amongst others