CNET Accused of Bundling Software Downloads with Trojans

A software wrapper used by CNET supposedly tricks users into installing toolbars and Trojans instead of the actual hosted program.

Gordon "Fyodor" Lyon is the creator and maintainer of the widely-used network auditing and penetration-testing tool called Nmap. It's a handy tool for administrators that can spot services that shouldn't be running, locate rogue PCs and servers, identify firewalls on the network and more. You would think that having a download mirror like CNET would bring a significant load of traffic to Lyon's software.

Well it has, just not in a good way.

According to the developer, CNET's Download.com repository has bundled his free software with Trojans and shady toolbars without his consent. Security firm Sophos backs up the claims and explains that it's encased in a software wrapper -- aka the Download.com Installer which was introduced back in July -- that tricks the potential customer into installing the Babylon Toolbar. To do this, the wrapper pops up a dialog headlined "Nmap" with a bright green default "Accept" button. But accepting only means CNET visitors accept the "special offer" of the toolbar instead... accepting the installation of Nmap comes later.

"The problem is that users often just click through installer screens, trusting that download.com gave them the real installer and knowing that the Nmap project wouldn't put malicious code in our installer," Lyon reports. " Then the next time the user opens their browser, they find that their computer is hosed with crappy toolbars, Bing searches, Microsoft as their home page, and whatever other shenanigans the software performs! The worst thing is that users will think we (Nmap Project) did this to them!"

"Taking someone else's work, even if it is open source and free, and using it as a drawcard for your own unrelated commercial purposes, is just plain unfair," Sophos added in a blog. "Getting people into the habit of installing software in an unofficial way from an unofficial source is poor security practice."

According to CNET, visitors can actually opt-out of the Download.com Installer by submitting a request to this email address. All opt-out requests are supposedly "carefully reviewed on a case-by-case basis."

The good news is that CNET's proprietary software is only available on some downloads -- customers who don't want to use the downloader can use the target software’s HTTP download URL to bypass it. The bad news is that security companies McAfee, Panda, F-Secure and seven others have determined the executable to be malware. Eight went so far as to label it as an actual Trojan.

"We've long known that malicious parties might try to distribute a trojan Nmap installer, but we never thought it would be CNET's Download.com, which is owned by CBS!" Lyon said. "And we never thought Microsoft would be sponsoring this activity!"

CNET has reportedly offered Lyon to opt out of the Download.com Installer program, but Fyodor doesn't plan to stop there. Because CNET's software uses Nmap's trademark and copy text, he may choose to take legal action over a possible trademark violation.

"In addition to the deception and trademark violation, and potential violation of the Computer Fraud and Abuse Act, this clearly violates Nmap's copyright," he added. "This is exactly why Nmap isn't under the plain GPL. Our license specifically adds a clause forbidding software which "integrates/includes/aggregates Nmap into a proprietary executable installer" unless that software itself conforms to various GPL requirements."

As of this writing, CNET and parent company CBS has not commented on the malware and copyright allegations.