Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

FTC Shuts Down Security 'Scareware' Scammers

Companies falsely claimed to find malware, vulnerabilities on users' PCs via "free security scans"

A U.S. district court has issued a temporary halt to a massive "scareware" scheme in which makers of bogus security software and services falsely claimed that their scans had detected viruses, spyware, and illegal pornography on consumers' computers.

According to the Federal Trade Commission, the scheme has tricked more than 1 million consumers into buying computer security products with names such as WinFixer, WinAntivirus, DriveCleaner, ErrorSafe, and XP Antivirus. The court also froze the assets of those responsible for the scheme to preserve the possibility of giving back some money to the scam's victims.

The FTC says the defendants used an elaborate ruse that duped Internet advertising networks and popular Web sites into carrying their advertisements. The defendants falsely claimed they were placing Internet advertisements on behalf of legitimate companies and organizations.

But thanks to hidden programming code that the defendants inserted into the advertisements, consumers who visited Websites where these ads were placed did not receive them. Instead, they received exploitive advertisements that took them to one of the defendants' Websites, the complaint states.

These redirected sites would then claim to scan the consumers' computers for security and privacy issues, the FTC says. The scans would find a host of purported problems with the consumers' computers, and then urge them to buy the defendants' computer security products for $39.95 or more. "However, the scans were entirely false," the complaint states.

The two companies charged in the case -- Innovative Marketing and ByteHosting Internet Services -- operate using a variety of aliases and maintain offices in various countries. Innovative Marketing is a company incorporated in Belize that maintains offices in Kiev, Ukraine. ByteHosting Internet Services is based in Cincinnati.

The complaint alleges that these two companies -- along with individuals Daniel Sundin, Sam Jain, Marc D'Souza, Kristy Ross, and James Reno -- violated the FTC Act by falsely claiming to have conducted scans of consumers' computers and detected a variety of security or privacy issues, including viruses, spyware, system errors, and pornography. The complaint also names a sixth individual, Maurice D'Souza, as a relief defendant who received proceeds from the scheme.

Last week, the FTC received a temporary restraining order from the U.S. District Court for the District of Maryland. Under its terms, the defendants are barred from falsely representing that they have run any type of computer analysis, or that they have detected security or privacy problems on a consumer's computer. They also are barred from using domain names obtained with false or incomplete information, placing advertisements on behalf of a third party, or otherwise attempting to conceal their own identities.

The order also mandates that companies hosting the defendants' Websites and providing domain-registration services take steps to keep consumers from accessing these Web sites.

The FTC is seeking to permanently bar the defendants from engaging in scareware marketing. The FTC also asked the court to order the defendants to compensate the consumers "or otherwise give up their ill-gotten gains."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "I feel safe, but I can't understand a word he's saying."
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-11111
PUBLISHED: 2020-03-31
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).
CVE-2020-11112
PUBLISHED: 2020-03-31
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).
CVE-2020-11113
PUBLISHED: 2020-03-31
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).
CVE-2020-10374
PUBLISHED: 2020-03-30
A webserver component in Paessler PRTG Network Monitor 19.2.50 to PRTG 20.1.56 allows unauthenticated remote command execution via a crafted POST request or the what parameter of the screenshot function in the Contact Support form.
CVE-2020-11104
PUBLISHED: 2020-03-30
An issue was discovered in USC iLab cereal through 1.3.0. Serialization of an (initialized) C/C++ long double variable into a BinaryArchive or PortableBinaryArchive leaks several bytes of stack or heap memory, from which sensitive information (such as memory layout or private keys) can be gleaned if...