Adware Maker Says Facebook Security Warning False and Reprehensible -- UPDATED

A report from security firm Fortinet that a Facebook application was attempting to sneakily install adware on user's computers is "completely false," according to Zango, the company which makes the adware.

Zango's associate corporate counsel Kevin Osborne called the report "reprehensible" in a phone interview Friday, saying Fortinet had just piled together the hot buzzwords "Facebook," "Widgets" and "Spyware" to make a splash.

Fortinet warned Wednesday in an advisory entitled "Facebook Widget Installing Spyware" that a "Secret Crush" app was virally spreading through Facebook and had more than a million installs.

"All of our installs are trackable to individual partners," Osborne said. "We have not seen any spike close to those numbers."

Fortinet, which makes consumer anti-virus software, warned Thursday that a "Secret Crush" Facebook add-on that promised to tell you who of your friends harbored secret longings for you didn't deliver anything but a pop-up trying to install Zango.

Instead, what Fortinet likely saw was that after an install, the Secret
Crush application served up a legitimate ad, according to Osborne.

Secret Crush, created by a firm called Mobile Marketing that makes its money off by sending horoscopes to cell phones at $1.35 a day seems to have been renamed overnight, to "My Admirers."

In a blog post , Zango says it was unable to reproduce the pop-up ad for Zango, instead getting an ad for Mobile Marketing's own services.

At no point in adding the Secret Crush widget to a Facebook profile does the widget install either spyware or Zango software, or even attempt to do so. Any suggestion that Zango software is being “secretly installed” is simply not true. Moreover, our general security monitoring of the Zango network has shown no abnormal increase in installations – something we would have seen based on the reported usage numbers of the Secret Crush widget.

Zango, formerly known as 180solutions, creates software that shows ads to users in return for allowing them to view its proprietary games and videos. Federal regulators fined Zango $3 million in 2006 for profiting from rogue affiliates who forced installation of Zango software without consent.

Zango has since said it has purged the rogue affiliates, prevents installs without consent and monitors its install base for abnormal patterns.

Fortinet did not have an immediate reply to a request for comment.

UPDATE 1/8/08:

Fortinet is not backing down:

After additional investigation, Fortinet confirms that our research related to the 'Secret Crush' (Facebook Widget) was accurate as of posting our advisory on January 2, 2008. The behavior shown in our screen shots simply showcases the observations the FortiGuard Global Security Research Team made on that date. We stand behind our original research.

They also point to a Red Herring article, which indicates that Facebook agrees that Secret Crush was using adware.

Zango says, however, that Facebook is on its side in this one, so Threat Level reached out to Facebook to clear up the confusion.

And Zango remains furious about the security notice and in a press release, busts out Microsoft's first chief privacy officer, Richard Purcell to bolster its case.

“Fortinet’s ‘Facebook Widget Installing Spyware’ advisory is blatantly untrue,” said Keith Smith, CEO of Zango. “The falsification of a security report is absolutely irresponsible and reprehensible. Fortinet should do the right thing and correct its advisory.”

The Secret Crush widget is neither a Zango application nor is it affiliated with Zango in any way. Zango does not own it, did not manufacture it, and did not bundle software with it.

“I’ve read the Fortinet advisory and have worked with the Zango security team reviewing the report’s claims,” said Richard Purcell, CEO of the Corporate Privacy Group (and former Microsoft chief privacy officer). “After reviewing the evidence, it is clear that Zango was not involved with the 'Secret Crush' widget. Reports of silent or surreptitious installations of Zango software in connection with that widget – or otherwise – are just not true.”

Mike Murray at Episteme calls the back and froth the 'stupidest fight he's ever seen.'

UPDATE 2 1/08:

Facebook spokeswoman Vrandee Barker says the ads were not Facebook ads.

Facebook is committed to user safety and security and, to that end, its Terms of Service for developers explicitly state that applications should not use adware and spyware. Users should employ the same precautions while downloading software from Facebook applications that they use when downloading software on their desktop. We have contacted the developers and have disabled the Secret Crush application for violating Facebook Platform Terms of Service.

The ads being served through the Secret Crush application were not approved by Facebook. Developers control content within the canvas pages.

See Also:

• Secret Crush Facebook App Installing Adware, Security Firm Charges
• Sanctioned Adware Firm Still Rogue, Critics Say: Updated
• In Message to Industry, Government Fines Adware Purveyor $3 million