Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

FTC Shuts Down Security 'Scareware' Scammers

Companies falsely claimed to find malware, vulnerabilities on users' PCs via "free security scans"

A U.S. district court has issued a temporary halt to a massive "scareware" scheme in which makers of bogus security software and services falsely claimed that their scans had detected viruses, spyware, and illegal pornography on consumers' computers.

According to the Federal Trade Commission, the scheme has tricked more than 1 million consumers into buying computer security products with names such as WinFixer, WinAntivirus, DriveCleaner, ErrorSafe, and XP Antivirus. The court also froze the assets of those responsible for the scheme to preserve the possibility of giving back some money to the scam's victims.

The FTC says the defendants used an elaborate ruse that duped Internet advertising networks and popular Web sites into carrying their advertisements. The defendants falsely claimed they were placing Internet advertisements on behalf of legitimate companies and organizations.

But thanks to hidden programming code that the defendants inserted into the advertisements, consumers who visited Websites where these ads were placed did not receive them. Instead, they received exploitive advertisements that took them to one of the defendants' Websites, the complaint states.

These redirected sites would then claim to scan the consumers' computers for security and privacy issues, the FTC says. The scans would find a host of purported problems with the consumers' computers, and then urge them to buy the defendants' computer security products for $39.95 or more. "However, the scans were entirely false," the complaint states.

The two companies charged in the case -- Innovative Marketing and ByteHosting Internet Services -- operate using a variety of aliases and maintain offices in various countries. Innovative Marketing is a company incorporated in Belize that maintains offices in Kiev, Ukraine. ByteHosting Internet Services is based in Cincinnati.

The complaint alleges that these two companies -- along with individuals Daniel Sundin, Sam Jain, Marc D'Souza, Kristy Ross, and James Reno -- violated the FTC Act by falsely claiming to have conducted scans of consumers' computers and detected a variety of security or privacy issues, including viruses, spyware, system errors, and pornography. The complaint also names a sixth individual, Maurice D'Souza, as a relief defendant who received proceeds from the scheme.

Last week, the FTC received a temporary restraining order from the U.S. District Court for the District of Maryland. Under its terms, the defendants are barred from falsely representing that they have run any type of computer analysis, or that they have detected security or privacy problems on a consumer's computer. They also are barred from using domain names obtained with false or incomplete information, placing advertisements on behalf of a third party, or otherwise attempting to conceal their own identities.

The order also mandates that companies hosting the defendants' Websites and providing domain-registration services take steps to keep consumers from accessing these Web sites.

The FTC is seeking to permanently bar the defendants from engaging in scareware marketing. The FTC also asked the court to order the defendants to compensate the consumers "or otherwise give up their ill-gotten gains."

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-20027
PUBLISHED: 2021-06-14
A buffer overflow vulnerability in SonicOS allows a remote attacker to cause a Denial of Service (DoS) by sending a specially crafted request. This vulnerability affects SonicOS Gen5, Gen6, Gen7 platforms, and SonicOSv virtual firewalls.
CVE-2021-32684
PUBLISHED: 2021-06-14
magento-scripts contains scripts and configuration used by Create Magento App, a zero-configuration tool-chain which allows one to deploy Magento 2. In versions 1.5.1 and 1.5.2, after changing the function from synchronous to asynchronous there wasn't implemented handler in the start, stop, exec, an...
CVE-2021-34693
PUBLISHED: 2021-06-14
net/can/bcm.c in the Linux kernel through 5.12.10 allows local users to obtain sensitive information from kernel stack memory because parts of a data structure are uninitialized.
CVE-2021-27887
PUBLISHED: 2021-06-14
Cross-site Scripting (XSS) vulnerability in the main dashboard of Ellipse APM versions allows an authenticated user or integrated application to inject malicious data into the application that can then be executed in a victim’s browser. This issue affects: Hitachi ABB Power Grids ...
CVE-2021-27196
PUBLISHED: 2021-06-14
Improper Input Validation vulnerability in Hitachi ABB Power Grids Relion 670 Series, Relion 670/650 Series, Relion 670/650/SAM600-IO, Relion 650, REB500, RTU500 Series, FOX615 (TEGO1), MSM, GMS600, PWC600 allows an attacker with access to the IEC 61850 network with knowledge of how to reproduce the...