180Solutions Still Allowing Nonconsensual Installs

By Jimmy Daniels
Contributing Writer, RealTechNews

If you’ve read any of my previous articles on 180solutions, you know I’m not a fan, same as most of you, we can all see thru the bull, in the past someone catches them with some nonconsensual installs, and they try to turn it into PR, kicking the naughty affiliate to the curb. Well, this was all supposed to stop as of January 1 2006 when they started using the new S3 screen, and I quote,

The company will no longer allow third parties to distribute its software via ActiveX except when using a 180solutions-controlled ActiveX installer. This will allow the company to ensure that every step of the ActiveX installation experience is controlled by 180solutions rather than third parties. Source: 180Solutions

Well, Ben Edelman has already caught their software being installed without consent on his own test machine…

On Friday morning (February 17), I received a nonconsensual installation of 180solutions Zango software through a security exploit. I was browsing an ordinary commercial web site, when I got a popup from exitexchange.com (a major US ad network, with headquarters in Portland, Oregon). The popup sent me to a third-party’s web site. (I’ll call that third party “X” for convenience. Details.) Then X ran a series of exploits to take control of my test PC, including using the widely-reported WMF exploit uncovered last month. Once X took control of my PC, X caused my computer to install and run 180solutions Zango software, among a dozen other programs. Notably, X fully installed 180’s Zango without me taking any action whatsoever — without me clicking “I agree,” “Yes,” “Finish,” or any other button of any kind. X installed 180’s Zango despite 180’s new “S3″ protections, intended to block these nonconsensual installations.

Self-interested installers can easily bypass the S3 prompt. Installers can easily fake a click on the “Finish” button — just by simulating a single stroke of the “enter” key, or by simulating a click on a predictable button location. So faking a user’s consent is trivial — just a single Windows SendKeys API call.

Sure enough, my “X” installation reflects an installer using exactly these methods. In my video of X’s exploit-based installation of 180, the S3 notice was visible on screen for less than half a second — between 19.08 seconds and 19.57 seconds into the video. During that half-second, exploit-delivered software (installed on my test PC mere seconds before) pressed “Finish,” at which point 180 completed its installation, putting itself in my System Tray (next to the Windows clock), beginning to download its supplemental files, and beginning to monitor my web browsing.

180’s October press release correctly describes the serious harms that occur when users receive many advertising programs. “A myriad of unwanted software … can often negatively impact system performance,” 180 admitted. But 180 then claimed that S3 would keep 180 out of such bundles. I disagree. According to my records, the installation at issue also installed Ad-w-a-r-e, Adservs, Integrated Search Technologies, Internet Optimizer, Media Tickets, New.net, Quicklinks, Surfsidekick, Tagasaurus, Targetsaver, Toolbar888, Ucmore, Webhancer, Web Nexus, WinFixer, and more. These many programs collectively bombarded my test PC with an incredible 730 registry keys, 1194 registry values, 461 files, and 43 file folders. Worse, the newly-installed programs caused 61 processes to run on my test PC, via 24 EXEs set to load each time I turned on my computer. The programs even added three different toolbars to my web browser. This overwhelming burden made it difficult even to inventory and track the programs’ additions and effects. So many co-bundled programs hardly satisfy the “prevent[ing] customers … from receiving a myriad of unwanted software” promise in 180’s press release.Source: Ben Edelman.org

We Say: I can’t wait to see what kind of spin Sean Sundwall tries to put on this one, everyone should read this page on Ben’s site as well, as Sean tries to defend their software and installs on msndollz.com. 180Solutions is about as useful as a turd flavored lollipop.