After a security researcher said Monday that MySpace users were spreading adware through the social networking service to ring up ad fees from Zango, the Bellevue, Wash. marketing company admitted one of its own developers had set up the MySpace profiles.
Zango, however, said the developer was acting without approval and in ignorance of the company's "hands-off" policy regarding MySpace.
Chris Boyd, the director of malware research for security vendor FaceTime, said he found a pair of MySpace profiles tagged "Zango," the new name for the controversial adware maker 180solutions. And each profile pushed adware. One of the profiles used video to entice MySpace visitors to download Zango Assistant and Search Toolbar, which users had to accept if they wanted to view the clips.
"Just who is pimping these things?" Boyd asked, then pointed out Myspace Graphics Help, a site that included copy-and-paste code to add Zango-distributed videos; the code, says the Myspace Graphics site, can be added to MySpace profiles or comments. Anyone who clicks on a MySpace-placed video created by such code, of course, must download Zango's adware to watch the clip.
The profiles were a mistake, countered a Zango spokesman Monday. According to Zango's Steve Stratz, the two spotted by Boyd were created by a company developer based in its Montreal office. (In April 2005, Zango, formerly 180solutions, acquired Montreal-based CDT, at that time one of its largest adware-distributing partners.)
"Those two test accounts were actually created by one of our developers who was exploring possible opportunities, but he didn't realize it was Zango business practice not to target MySpace," said Stratz. "He should not have been doing this, and we want to tell MySpace that we didn't mean to target them." The developer, said Stratz, would soon be deleting the profiles.
Boyd took Zango to task nonetheless.
"This is a relatively new viral approach," said Boyd. "We've seen spam and porn bots on MySpace before, but not adware from a quote-legitimate-unquote adware company," he said.
Boyd's contention was that unscrupulous Zango partners are getting MySpace users -- many of whom are teenagers -- to do their dirty work by spreading the necessary ad-tracking and ad-displaying software.
"Pasting the code for the [video] into the MySpace profile and having it autoplay when you visit the page is enough to have the [Zango] license prompt appear," said Boyd. "Easy as pie."
But although a Zango EULA (end-users license agreement) pops up on coded MySpace profiles, it's too easy for users to assume the dialog's from MySpace, not an adware vendor, argued Boyd. He found more than two dozen sites similar to Myspace Graphics and "I didn't see one actually mention the fact that in return for these [video clips], you'd be pimping Zango."
Zango, however, countered that its license agreement "could not be any clearer" and that it would be obvious to anyone that the download was not originating with MySpace.
Zango, which until early June was called 180solutions, has spent months cleaning up its distribution network -- in the past it blamed "rogue" distributors for installing its software without users' permission -- and to be a better Internet citizen.
Then Zango's vice president of business development, York Baur, said that "we've fixed [those] problems to the extent they can be fixed. This [business] model works, and we're very proud of the model we've built."
Stan Monlux, senior director of business development, weighed in Monday on the MySpace issue by denying that the network's accounts were allowed to register as partners -- and thus receive payments -- and arguing that it wasn't up to Zango to police the sharing of its content.
"We get applications from MySpace account holders all the time," said Monlux, "but MySpace has a policy of not allowing any third-party advertising. Partners need to own a top-level domain, as well, and obviously MySpace profiles don't meet that requirement. Those two rules basically say that we're not going to be contracting with anyone on MySpace."
But, Monlux went on, Zango's "invested significant financial resources creating content for people to share. We certainly don't discourage sharing it."
In other words, if someone on MySpace decides to insert video clips or games (which Zango also produces) on his or her profile, that's okay with Zango.
"A partner can't place Zango content on a MySpace site," said Monlux, "but if someone goes to a partner's site, takes Zango content, and puts it on his MySpace profile, that's not a violation of our terms of agreement."
In instances like that, Monlux said, the partner would be compensated for any downloads made of Zango adware from the MySpace sites. And the Myspace Graphics Help site named by Boyd is a Zango partner, Monlux acknowledged.
MySpace, however, bans advertising on members' profiles, and specifies that "prohibited activity includes but is not limited to accepting payment or anything of value from a third person in exchange for your performing any commercial activity on or through the MySpace Services on behalf of that person."
MySpace was not immediately available for comment on whether adware downloads violate its terms of service.
Zango denied it was targets MySpace as a distribution resource. "Are we targeting MySpace?" asked Stratz. "No. Does our content show up on MySpace? Yes."
"Why go to all the trouble of pimping your own vids when you can have random teenagers on MySpace do it for you?" Boyd responded. "Talk about an all time low."
The two sides -- adware provider and security researcher -- couldn't be farther apart, and Zango's Stratz made it sound as if that would always be the case.
"We know where Boyd and other like him stand, and they know where we stand," Stratz said.
UKFast is not responsible for the content of external Internet sites.