Zero Day

New StopBadware guidelines take aim at software update bundling

Posted in:

Adobe
Anti Virus
Apple
Arbitrary Code Execution
Botnets
Browsers
Firefox
Flash
Malware
Open source
Passwords
Patch Watch
Punditocracy
Responsible disclosure
Vulnerability research
Zero-day attacks

StopBadware draft guidelines take aim at software update bundling

If the StopBadware coalition has its way, software updaters from Sun Microsystems (see screenshot above) and Apple will carry the embarrassing "badware" label. According to a draft of revamped guidelines (.pdf) from the Google-backed computer security consortium, the badware label will expand to include products that:

Install a new application through unattended automatic updates.
Introduce new potentially unwanted behaviors to an application through unattended automatic updates.

Under these new guidelines, Apple's WASU (Windows Automatic Sofware Update) utility will be considered badware because it bundles new products like Safari, iTunes and QuickTime alongside security patches without the end user's explicit consent. [ SEE: How does Apple get away with this badware behavior ] The StopBadware alliance is currently seeking feedback on the new guidelines. The non-profit group said it would not use the badware label for installation of new applications alongside updates if there is separate disclosure and consent.

posted by Ryan Naraine
August 25, 2008 @ 2:45 pm

Previous Post: Hundreds of Dutch web sites hacked by Islamic hackers
Next Post: Facebook refuses to fix obvious security flaw

Last 10 posts:

Opera patches 'extremely severe' security hole (11-23)
Exploit published for critical IE 7 zero-day flaw (11-23)
Inside the Google Chrome OS security model (11-19)
Microsoft finds security hole in Google Chrome Frame (11-19)
Mozilla locks out rogue Firefox add-ons (11-18)
Thousands of web sites compromised, redirect to scareware (11-17)
Microsoft confirms 'detailed' Windows 7 exploit (11-16)
Man-in-the-middle attacks demoed on 4 smartphones (11-13)
Microsoft bracing for malware attacks from embedded fonts (11-12)
Apple Safari exposes Windows to drive-by download attacks (11-11)