Kazaa Slammed As 'Badware' By Report

by Glen Shapiro, LawAndTax-News.com, New York

27 March 2006

The watchdog group StopBadware.org has taken aim at file-sharing service Kazaa, it emerged last week.

The group, which is sponsored by such computing industry giants as Google and Sun Microsystems, argues that Kazaa creates various vulnerabilities on user computers, despite its claims that it does not.

"To determine whether these applications constituted badware, we downloaded and installed each application into a controlled environment. During the installation process, we analyzed and recorded the disclosures the program made to the user and the files it installed. We then tested the program's effect on our computer's performance, noting anything it did that fell under our badware guidelines," the watchdog explained.

Under the heading 'Bad or Undisclosed Behavior', StopBadware.org argued that Kazaa's problems are that:

• It claims "no spyware", but bundled software is considered spyware. Sharman Networks claims that Kazaa has "NO SPYWARE", based on a highly restricted definition of spyware (namely, that no personally identifiable information is sent by the program). However, Kazaa's installation includes several bundled programs that are considered spyware under the common definition of spyware as software that subverts the computer's operation for the benefit of a third party.
• A bundled application cannot be closed. The Best Offers Network, one of the bundled applications included with Kazaa, cannot be closed at all by a typical user. It must be closed by killing the process from within the Windows Task Manager.
• It fails to uninstall executables and system components. The uninstallation process does not eliminate all components related to Kazaa and its bundled programs. Executables and system components still remain, including the Kazaa Plus Installer.
• It adds links to Windows Desktop. Kazaa and its bundled applications add two new links to the Windows Desktop: "Your Free Casino Chips!" and "Play Poker Now!". The addition of these links is not disclosed to the user during the installation process.
• It changes default 404 and DNS error pages in Internet Explorer. InstaFinder, one of the applications bundled with Kazaa, changes the default 404 page and DNS error pages in Internet Explorer. This modification is not disclosed to the user during the installation process.

Under 'Disclosed Behavior', the group explained that Kazaa:

• Installs adware. Kazaa requires the installation of various adware programs, including TopSearch, AltNet Peer Points Manager, Cydoor, and The Best Offers. The bundling of these applications is disclosed to the user during the installation process, and the user has the option of proceeding with the installation or canceling it.
• Installs file-sharing anti-virus software. Kazaa requires the installation of file-sharing anti-virus software (BullGuard P2P). The bundling of this application is disclosed to the user during the installation process, and the user has the option of proceeding with the installation or canceling it.
• Installs programs that modify Internet Explorer. Kazaa requires the installation of programs that modify Internet Explorer, including AltNet's Need2Find Bar, InstaFinder, and RXToolbar. These programs add several new toolbars to Internet Explorer. The bundling of these applications and the addition of these toolbars is disclosed to the user during the installation process, and the user has the option of proceeding with the installation or canceling it.

In a statement, StopBadware.org announced that:

"We recommend that Sharman Networks, the producer of Kazaa, do the following:

• Stop claiming that Kazaa is spyware-free.
• Ensure that Kazaa is not bundled with programs that cannot be closed by the user.
• Remove all executables, system components, and registry keys during the uninstall process.
• Disclose to the user during installation that links that will be added to the Windows Desktop.
• Disclose to the user during installation that the bundled software will change the default 404 and DNS error pages in Internet Explorer."

Recommended