Mike On Ads

Goal of this page

1. Educate the online community about the scope of the problem
2. Document all instances of the problem
3. Provide methods and practices that industry players can use to prevent the problem
4. Hopefully bring enough attention to the issue that someone goes after and stop the people behind it

Updates to this page

2007-03-24: Page Created
2007-03-25: Added cannis.org “Work and live in Canada” ads, with creative that has unobfuscated actionscript.
2007-03-27: Added actionscript for Matchservice creative
2007-04-05: Get Safe Online scam
2007-04-06: Added sports betting tips fake ad
2007-04-18: Added traveltray.com, xing.com and thinkindie.com
2007-04-23: Added getfreecar.com, and web.com
2007-05-30: Added speedbit, cyberipod, how2vacation, ediets and flycell

What is the Errorsafe Scam?

At core it’s the abuse of the online advertising industry to install highly questionable desktop software — namely programs like Errorsafe, and Drivecleaner. Symantec’s thoughts on Errorsafe and Drivecleaner. More specifically, via a massive network of brokers they place Media Buys with Ad-networks, Portals and Websites with fake ads for fake services which under specific conditions use Active-X controls, Windows exploits and various other methods to to install their desktop software application — which essentially is Spyware.

The end result is the proliferation of Spyware on the internet, terrible end-user experiences and just general badness. On this page I will catalogue all instances of this scam that I have observed.

If you’re still confused, here are a couple articles that talk about impacts to specific companies:

Washingtonpost.com — Hacked Ad Seen on MySpace Served Spyware to a Million
Spyware Sucks! — Winfixer and Errorsafe being distributed via MSN Messenger banner advertisements
Spyware Sucks! — GOTCHA! Winfixer and AOL
Slashdot — Malware Installed by LiveJournal Ad

How can it be stopped?

First off — all online sellers need to audit the ads they run and deactivate any instances of the scam documented below, when possible, sellers should try to identify the responsible party and take legal action. Next, all new advertisers should be screened to ensure that creatives provided are safe and legitimate.

As an industry — someone should take ownership of solving this problem. This could be the IAB, a larger player such as AOL or MSN or perhaps an Attorney General somewhere.

How can you help?

• Campaign Managers and Salespeople:
  1. Make sure you understand what this scam is and how it works
  2. When working with a new Advertiser, check with colleagues and contacts at other companies as to the legitimacy of the broker/advertiser
  3. When unsure about the reputation of an advertiser, do not accept third party creatives
  4. If you choose to accept flash creatives, decompile and check the contents (more details below)
  5. Impose strict penalties in Insertion Orders for nonstandard behavior, money talks
  6. Do NOT continue to work with a broker once he has shown to promote this scam
• Website owners:
  1. Make sure you understand what this scam is and how it works
  2. Monitor user complaints for occurrences of the scam
  3. When you find an instance, use tools such as Tamper Data to record referring URLs to provide enough evidence for your ad networks to find and stop the scam.
  4. If your ad networks are in denial — send them to this page and then cancel the relationship
• Executives in the ad industry:
  1. Take a 1-strike approach to all partners that assist in this scam
  2. Be accountable if your organization promotes this scam
  3. Take legal action against partners that abuse you to promote the scam
• Law enforcement & Government Agencies:
  1. Realize that this is a very large issue for the industry — this has affected every single ad network in the industry and some of the largest players in the space. Millions of users have spyware installed on their machines because of this and it must be stopped.
  2. Find the responsible people and put them in jail
  3. More specifically — start a taskforce that catalogues all documentation and proof of this scam to build the case against the people behind Errorsafe

What should you look for?

There are two key things you can do. Stop existing instances and look for new methods and instances. If you find a new method or instances that is not catalogued on this page — please email me at mnolet@gmail.com. The main way to identify the scam is by looking at technical details — e.g. decompiling flash and documenting referring URLs. Please see the very bottom on how to dig through flash files and what ads and websites to look for.

‘Shell’ websites that serve solely to propagate ErrorSafe

WorkHomeCenter.com
The site: An online service that proclaims to help individuals ‘work from home’.
Whois Registration:

    Administrative Contact:
    Hostmaster, IntellectualDecisions, Inc.  hostmaster@workhomecenter.com
    Cnr of Granby & Sharpe St, Suite K2135
    Kingstown, NA
    VC
    +1.5551231234    Fax: +1.5551231234

Sample ad:

Actual flash file: WorkHomeCenter SWF
Sample Bad redirect: http://pcturbopro.com/.storage/index.php?p=5&ax=1&ex=1&ed=2&h=10&j=1&[...]
Sample install: http://cdn.downloadcontrol.com/files/installers/cab/PCTurboProInstallerFree.cab

Matchservice.com
The site: A dating site. The first time I saw this site you couldn’t even ‘signup’. The site seems to have expanded a bit but still several pages have errors on them. E.g. when trying to look at a profile I get an error “view error: Question `p_gender`: Function `print_radio($param_name, $value, $sources, $style, ‘ ‘);` doesn’t exists, Session halted.”
Whois Registration:

 Administrative Contact:
    web, hostmaster  hostmaster@matchservice.com
    65 Queen's Gate
    London, SW7 5JS SW7 5JS
    GB
    0870 770 4581

Sample ad:

Actual flash file: Matchservice SWF
Sample Bad redirect: http://www.errorsafe.com/pages/scanner/index.php?aid=oflikely&lid=[...]
Sample install: http://download.errorsafe.com/files/installers/ErrorSafeNewReleaseInstall.exe
Actual actionscript (obfuscated): Matchservice Actionscript

MySurvey4U.com
The site: Relax at home and get paid to do nothing. You give them a name and email… and that’s it, nothing else on the page.
Whois Registration:

   ::Registrant::
        Name      : MARKUS MCCOY
        Email     : mysurvey_4u@yahoo.com
        Address   : 5th Hancock Ave, Murrieta CA
        Zipcode   : 25405
        Nation    : US
        Tel       : 951-461-2785
        Fax       :

Sample ad:

Actual flash file: mysurvey4u.swf
Sample redirect: http://www.errorsafe.com/pages/scanner/index.php?aid=tocattle&lid=intl&ax=1&ex=1&ed=2
Sample install: http://cdn.downloadcontrol.com/files/installers/cab/PCTurboProInstallerFree.cab

Sexbuddies.com
The site: A ‘casual sex’ dating site. The signup form for this site is exactly the same as the one on matchservice.com. Note, this might actually be a legitimate site, but what makes me think it’s associated with errorsafe is the fact that google searches show that it runs full page ads on spyware and the flash file below clearly has the code to run active-x installs embedded in it.
Whois Registration:

 Administrative Contact:
    Brune, Henry  sergei_brovkina@yahoo.com
    254  Amesbury Avenue
    Streatham
    LONDON, NA SW2 3BL
    FR
    555-123-1234    Fax: 555-123-1234

Sample ad:

Actual flash file: Sexbuddies SWF
Sample redirect: http://www.errorsafe.com/pages/scanner/index.php?aid=downrace&lid=sw4&ax=1&ex=1&ed=2
Sample install: http://cdn.drivecleaner.com/installdrivecleanerstart_tbn.exe

Cannis.org
The site: A site that claims to help you find work permits in Canada (similar theme to WorkHomeCenter here?). Google search reveals no legitimate links to cannis.org and only postings related to spyware, unexpected popups, and links to other sketchy things.
Whois Registration:

Registrant Name:Giorgio Vierra
Registrant Organization:Cannis
Registrant Street1:Rua Joaquim
Registrant City:Tavora
Registrant State/Province:Sao Paulo
Registrant Postal Code:1066
Registrant Country:ES
Registrant Phone:+34.04015015
Registrant Phone Ext.:
Registrant Email:hostmaster@cannis.org

Sample ad:
Actual flash file: Canada SWF
Sample redirect: http://www.errorsafe.com/pages/scanner/index.php?aid=cast&lid=468&ax=1&ex=1&ed=2
Sample install: http://download.cdn.errorsafe.com/files/installers/cab/ErrorSafeNewReleaseInstall.cab
Actionscript Code: Canada Actionscript

Traveltray.com
The site: An airfare search site. All searches went to vipfares.com which seems to be shut down. 800 # associated with whois doesn’t seem to go anywhere nor is it registered to a legit business as far as I can tell.
Whois Registration:

 Administrative Contact:
    Hostmaster, Traveltray Inc.  traveltray@yahoo.com
    158 West Av
    Talmage, OH 67482
    US
    +1800-453-7728

Sample ad:
Actual flash file: Traveltray SWF
Actionscript Code: Traveltray Actionscript

Getfreecar.com
The site: Get paid to drive, free car, blah blah blah… (this is getting old)
Whois Registration:

 Administrative Contact:
    Hostmaster, GetFreeCar  hostmaster@getfreecar.com
    P.O. box 145
    Zaporozhye,  69006
    UA
    +3 8044 5170437    Fax: +3 8044 5170437

Sample ad:
Actual flash file: GetFreeCar SWF
Actionscript Code:GetFreeCar Actionscript

Fake ads for legitimate sites:

The scam has moved beyond the shell sites and I have observed multiple instances of flash ads for legitimate websites that have embedded within them code to launch popups and do Errorsafe Active-x installs. I’ve catalogued the ones I’ve found below. Each one if you decompile it has highly similar encrypted Actionscript embedded that triggers Active-x installs. Note, for all I know, some of the less reputable/well known companies below could very well be associated with Errorsafe. If you have evidence/documentation for that, please email it to me at mnolet@gmail.com or post a comment!

Victim: Travelocity
Sample creative:
Actual flash file: Travelocity SWF
Actionscript: travelocity.txt

Victim: Priceline
Sample creative:
Actual flash file: Priceline SWF
Actionscript: pricelines.txt

Victim: 10Bet.com
Sample creative:
Actual flash file: 10 Bet SWF
Actionscript: 10bet.txt

Victim: LowerMyBills.com
Sample creative:
Actual flash file: LowerMyBills SWF
Actionscript: Actionscript stored in 3rd party file here — http://www.easytocharge.com/click/gettrackingswf.php?swf=addyn1.swf — which I downloaded before but isn’t working right now.

Victim: UFO Afterlight
Sample creative:
Actual flash file: UFO Afterlight SWF
Actionscript: ufoafterlight.txt

Victim:Shopathometv.com
Sample creative:
Actual flash file: ShopAtHomeTV SWF
Actionscript: shopathome.txt

Victim: Casino Ace King
Sample creative:
Actual flash file: Casino Ace King SWF
Actionscript: aceking.txt

Victim: GetSafeOnline.org
Sample creative:
Actual flash file: Get Safe Online SWF
Actionscript: Get Safe Online Actionscript

Victim: Sportsbettingtips.info
Sample creative:
Actual flash file: Sports Betting Tips SWF
Actionscript: sportsbettingtips.txt

Victim: Xing.com
Sample creative:
Actual flash file: Xing SWF
Actionscript: Xing SWF

Victim: Thinkindie.com
Sample creative:
Actual flash file: Thinkindie SWF
Actionscript: Thinkindie Actionscript

Victim: Web.com
Sample creative:
Actual flash file: Web.com SWF
Actionscript: — breaks decompiler —

Victim: Flycell.com
Sample creative:
Actual flash file: flycell.swf
Actionscript: Flycell Actionscript

Victim: Cyber iPod
Sample creative:
Actual flash file: CyberiPod SWF
Actionscript: CyberIpod Actionscript

Victim: eDiets
Sample creative:
Actual flash file: eDiets Actionscript
Actionscript: eDiets Actionscript

Victim: How2Vacation.com
Sample creative:
Actual flash file: How2vacation SWF
Actionscript: How2vacation Actionscript

Victim: Speedbit.com
Sample creative:
Actual flash file: Speedbit SWF
Actionscript: Speedbit Actionscript

Gamefly:

Weightwatchers

How to analyze flash files

1. Open the file in Firefox with the Tamper Data extension enabled. If it loads content from third party servers it should be considered as suspicious.
2. Open the flash file with Action Script Viewer. Look into the actionscript for certain patterns. Specifically:
   • Encryption. If you look at the actionscript posted above you see some common patterns — namely that the code is encrypted and unreadable. You should never run a flash creative that has encrypted code.
   • Links and/or references to third party servers such as errorsafe.com, drivecleaner.com, etc.
3. Use common sense. A pixelated ad for travelocity is most likely not legitimate. Any large online advertiser uses an adserver — so if you are asked to host a creative for a larger marketer — think twice before uploading it.

Final Thoughts

Please send me feedback on this page. If you think I’m incorrect on any of the information it’s critical that you let me know! I will try to update this page regularly. Once updates start I’ll make sure to note at the top what changes I’ve made to the page. Why did I spend so much time documenting all this? I want to bring awareness. The last thing I want is a crusade against AOL, MSN, or any ad-network for running these ads. EVERYBODY is running them — and EVERYBODY needs to work together to stop them.