2006 – Page 3 – Ben Edelman

February 20, 2006December 2, 2023

Nonconsensual 180 Installations Continue, Despite 180’s "S3" Screen updated February 24, 2006

On Friday morning (February 17), I received a nonconsensual installation of 180solutions Zango software through a security exploit. I was browsing an ordinary commercial web site, when I got a popup from exitexchange.com (a major US ad network, with headquarters in Portland, Oregon) . The popup sent me to a third-party’s web site. (I’ll call that third party “X” for convenience. Details.) Then X ran a series of exploits to take control of my test PC, including using the widely-reported WMF exploit uncovered last month. Once X took control of my PC, X caused my computer to install and run 180solutions Zango software, among a dozen other programs. Notably, X fully installed 180’s Zango without me taking any action whatsoever — without me clicking “I agree,” “Yes,” “Finish,” or any other button of any kind. X installed 180’s Zango despite 180’s new “S3” protections, intended to block these nonconsensual installations.

Most aspects of this installation are remarkably standard. “Adware” installations through security exploits are all too common. And it’s not that unusual to see traffic flowing through an ad network — even a big US ad network.

But what’s newsworthy here is that 180solutions got installed, even though 180 last year told the world that these nonconsensual installations were impossible. Effective January 1, 2006, all 180solutions distributors were required to switch to 180’s “S3” installer. 180 claimed huge benefits from the new S3 system: 180’s October 2005 press release promised:

“The S3-enabled clients … mean[] 180solutions will own the entire experience from beginning to end on all installations of its products.”

180’s S3 Whitepaper (PDF) also falsely promises major benefits from S3:

“[I]nstallation cannot continue until the user gives consent.”

“Since the consent box comes directly from 180solutions, publishers are unable to turn it off.”

To the contrary, my video shows installation continuing even when a user does not consent. And my video shows a distributor faking a user’s click on the consent button.

See video of the nonconsensual installation of 180 Zango, including bypassing of the 180 S3 screen. (Note: Video has been edited to hide the identity of the installer at issue. Learn why. Within the video, yellow markup provides my comments and analysis.)

180’s S3 Technology and Its Design Flaws

180’s S3 installation system

Historically, 180’s installer programs have installed 180 software immediately, on the misguided assumption that 180’s distributors already obtained user consent. That approach is overly optimistic because 180’s distributors have no incentive to ask users’ permission: If distributors seek users’ permission, users might decline that unwanted offer, preventing distributors from getting paid by 180. So it comes as no surprise that many distributors have installed 180 without obtaining users’ consent. I have publicly posted at least five different videos showing such installations (1, 2, 3, 4, 5), and I have many more on file. Others have repeatedly found the same (1, 2, 3, 4, 5).

180’s S3 system seeks to address these nonconsensual installations by showing users a notice screen before 180solutions software installs onto their PCs. 180’s distributors are now supposed to run 180’s “stub” installer to display this notice screen; then users can choose whether or not to proceed. See example screen at right.

As a threshold matter, I don’t think 180’s S3 screen provides an accurate, truthful, complete disclosure of 180’s important effects. As I explained last month, the S3 screen oddly describes 180 only as showing “ads,” without mentioning that these ads appear in “pop-ups” — the essential characteristic reasonable users most need to know in order to decide whether they want 180’s software. The S3 screen also fails to describe the important privacy effects of installing 180’s software — that 180’s software will tell 180’s servers many of the sites users visit. The S3 screen does show a EULA — but it’s in an oddly-shaped box, and its text can’t be copied to the clipboard. Finally, the S3 screen labels its affirmative button “Finish” — even though the S3 screen is known to appear in circumstances where it is the first screen mentioning installation of 180’s software. A user cannot be asked to “finish” what he has not yet agreed to start; an “I agree” or “I accept” label would more clearly indicating the consent that the button is claimed to grant.

But beyond these important problems of wording and layout, the S3 installer also features a fundamental design flaw: Self-interested installers can easily bypass the S3 prompt. Installers can easily fake a click on the “Finish” button — just by simulating a single stroke of the “enter” key, or by simulating a click on a predictable button location. So faking a user’s consent is trivial — just a single Windows SendKeys API call.

Sure enough, my “X” installation reflects an installer using exactly these methods. In my video of X’s exploit-based installation of 180, the S3 notice was visible on screen for less than half a second — between 19.08 seconds and 19.57 seconds into the video. During that half-second, exploit-delivered software (installed on my test PC mere seconds before) pressed “Finish,” at which point 180 completed its installation, putting itself in my System Tray (next to the Windows clock), beginning to download its supplemental files, and beginning to monitor my web browsing.

180’s Bad Partners and 180’s Flawed Business Model

180 seems to intend its S3 installer to protect 180 and users from the untrustworthiness of 180’s distribution partners. 180 is right to think that S3 makes it somewhat harder for distributors to install 180 without getting users’ consent. But the increase in difficulty isn’t much — certainly not enough to deter any serious installer. Those who want to get paid for installing 180 will find that S3 presents at most a small speedbump; it’s hardly the airtight blockade 180’s press release claims.

For 180, the appropriate response to nonconsensual installations is not merely a small improvement in installer program design. Rather, 180 should rethink its entire distribution business model. 180 has repeatedly written about the “long tail” of distributors (1, 2, 3) — 180’s plan for thousands of different web sites installing 180’s software when users browse their materials, and thousands of different programs bundling 180. It’s an interesting vision, but in my view impractical and unwise. With so many distributors, 180 will be unable to assure that each distributor really does obtain consent — rather than cheating the system, as X did.

180’s October press release correctly describes the serious harms that occur when users receive many advertising programs. “A myriad of unwanted software … can often negatively impact system performance,” 180 admitted. But 180 then claimed that S3 would keep 180 out of such bundles. I disagree. According to my records, the installation at issue also installed Ad-w-a-r-e, Adservs, Integrated Search Technologies, Internet Optimizer, Media Tickets, New.net, Quicklinks, Surfsidekick, Tagasaurus, Targetsaver, Toolbar888, Ucmore, Webhancer, Web Nexus, WinFixer, and more. These many programs collectively bombarded my test PC with an incredible 730 registry keys, 1194 registry values, 461 files, and 43 file folders. Worse, the newly-installed programs caused 61 processes to run on my test PC, via 24 EXEs set to load each time I turned on my computer. The programs even added three different toolbars to my web browser. This overwhelming burden made it difficult even to inventory and track the programs’ additions and effects. So many co-bundled programs hardly satisfy the “prevent[ing] customers … from receiving a myriad of unwanted software” promise in 180’s press release.

Why “X” and an Obscured Video?

Long-time visitors to my web site may reasonably wonder: Why the markings in my screen-capture video? And why refer to the 180 distributor as “X,” rather than by its actual name and URL? After all, I’ve long provided video proof of my observations, and I’ve been naming names ever since my 2003 listing of advertisers using Gator (now Claria).

But I’ve run out of patience for being outside quality control staff for 180solutions. An episode last month was particularly instructive: Security company FaceTime found an AOL Instant Messenger worm that was installing 180solutions. 180’s response? After FaceTime reported the details, 180 trivialized the finding and issued a self-serving press release. Rather than admit that their software still becomes installed improperly, 180 danced around the issue and tried to use these wrongful installations to obtain a public relations benefit.

CDT‘s experience with 180 is similarly instructive. After two years of alerting 180solutions to its various bad practices, CDT recently ceased working with 180, instead electing to file a complaint with the FTC.

I too have decided no longer to share my work with 180solutions. As discussed in the preceding section, I have concluded that 180’s business model is fundamentally broken — that 180 cannot implement technology or enforcement to assure the proper installation of its software. Accordingly, just as CDT terminated its discussions with 180, I have resolved not to tell 180solutions which specific distributor was responsible for this installation.

Despite my decision not to work with 180 on resolving these installations, I will make my research available to those with a legitimate need to know. I expect to provide (and in some cases already have provided) this information to law enforcement officials considering action against 180solutions, to private attorneys in litigation against 180solutions, to members of the press seeking to verify my findings, and to other security researchers. Please contact me to request the original raw video file. As usual, I also retain full packet logs, raw screen-captures, registry change logs, filesystem change logs, HijackThis logs, Ad-Aware logs, and additional records.

Update (February 24): My Response to 180’s Press Release

180solutions has found and terminated the distributor I described above, which I’m now happy to reveal was crosskirknet.com. But what a road to get there! 180’s press release suggests 180 figured this all out within hours of my initial post. I’m convinced that that’s false. First, 180 terminated some other bad installer — only later realizing that the installer I found was someone different. Sunbelt has the details — how we figured out (and proved) that 180 hadn’t cut off this installer when 180 issued the press release saying they had. In a blog post, 180 now admits that we’re right and their press release was wrong. (Of course the right response to a false statement in a press release is a correction press release, not a mere blog post. Otherwise, many readers might get the press release, e.g. via the news wire, but never see the blog post.).

180’s press release claims that S3 “enabled the company to go back and re-message every user who received its software [from this nonconsensual installer] and provide them a one-click uninstall.” 180’s blog says the same: “We re-messaged each of [these] installs and provided … a one-click uninstall of our software.” In both documents, 180 writes in the past tense (“enabled”, “re-messaged”, “provided” ), seemingly indicating that these re-notifications have already occurred. But I have yet to receive any such prompt, despite substantial efforts to seek it out (e.g. by repeatedly restarting my test PC). I’ve also received many 180solutions ads on my infected test PC, despite 180’s claim that it “shut off all advertisements to all installs” from this distributor. So here too, I think 180’s statements are off-base. 180 may intend or aspire to provide renotifications, and 180 may intend to shut off ads. But by all indications, 180 hasn’t actually done so, at least not yet. I’ve confirmed my findings with Sunbelt; they haven’t seen this re-notification either, and they’re still getting ads too.

180’s press release quotes 180’s CEO as saying “No software is ever hack-proof.” I agree. But 180 has previously made public statements falsely indicating that its software is not susceptible to those who want to install 180 without consent. Recall 180’s S3 Whitepaper (PDF), explicitly stating “[I]nstallation cannot continue until the user gives consent” and “Publishers are unable to turn [the consent screen] off” (emphasis added). These are not claims of mere hopes or aspirations. No, 180 promised that installation “cannot” proceed without consent. But now that I’ve disproven 180’s claim, 180 tries to backpeddle and to weaken its unambiguous statement. The better approach would be to admit that 180’s prior promises went too far, and that 180’s software cannot actually deliver the benefits 180 previously described.

180’s press release concludes with a section 180 labels “a call for ‘responsible disclosure’.” Citing practice among those who find security vulnerabilities in widely-deployed software, 180 says researchers should tell 180 when they find nonconsensual installations of its software, rather than keep this information to themselves or provide it to law enforcement. I understand that 180 would like to receive this information, and I do follow responsible disclosure principles when I find software vulnerabilities. But responsible disclosure principles just don’t apply to records of nonconsensual installations.

Responsible disclosure principles seek to prevent hackers from taking advantage of newly-uncovered security vulnerabilities. If hackers learned about vulnerabilities before software vendors had time to prepare patches, users would face increased security risks, with few good options for protection. So responsible disclosure principles have a clear purpose and a clear benefit to users — which is why I followed these principles when I previously found vulnerabilities in widely-deployed software.

But what I uncovered, above, is not a security vulnerability. I didn’t find a new security hole, or a new way to take advantage of some existing hole. All I found was some bad guy who’s already using these methods — and who 180 has been prepared to pay for his efforts. There’s no heightened risk of harm to users from my reporting what’s already happening. Perhaps this particular bad actor got to continue his scheme for a few more days while 180 struggled to figure out who was responsible. But that’s the entire harm that resulted from my refusal to tell 180 what happened — that’s the usual, background, ongoing risk of harm; it’s not a heightened risk created by my disclosure itself. When I posted information about these nonconsensual 180 installs, I didn’t put users at special risk of any worm or exploit, in the way that responsible disclosure principles intend to prevent.

So where does this leave us? 180’s S3 system is still broken in all the ways I initially set out. 180’s press release made claims that can be shown to be false, as did 180’s prior statements of S3’s benefits, but 180 has not properly retracted its false statements. And 180’s analogies don’t add up. I’d still like to see 180 spend more time improving its practices, and less time on premature press releases and public relations.

Thanks to TechSmith for providing me with a complimentary license of its Camtasia Studio, the video annotation software I used to mark up my screen-capture video of this installation.

January 26, 2006December 2, 2023

Pushing Spyware through Search

This article uses data from SiteAdvisor, a company to which I serve as an advisor.

Much of the computer security industry acts like spyware is immaculately conceived. Somehow it just appears on computers, we are led to believe, and supposedly all we can do is clean up the mess after it happens, rather than prevent it in the first place. I disagree.

Now, we all love Google. I use Google’s search site all day every day, and I enjoy their downloadable applications too. So I have the greatest respect for Google’s core service. But there’s another side to their business. Indirectly, Google and other search engines make big money from spyware, through paid search advertising that infects users who don’t know any better or don’t understand what they’re getting into.

Consider a Google search for “screensavers”:

The colored icons next to search results were inserted not by Google, but by the SiteAdvisor client application, based on the results of SiteAdvisor’s automated tests for each listed site. Six of Google’s ten sponsored links get “red” or “yellow” ratings — generally indicating unwanted advertising through spyware or, in some instances, high-volume commercial email. But without SiteAdvisor (or some similar protection), users would have no idea which sites were safe; they’d be at great risk of clicking through to an unsafe site, ultimately risking installation of unwanted software.

Screensaver Advertisers’ Business Model

Google surrounds its “screensavers” search results with ten ads selected from interested Google advertisers. Whenever I see a company buying an ad (online or offline) for a “free” product, I ask myself: How do they make money? With few exceptions, companies only buy online advertising when they expect to get something directly in return. (There are exceptions — dot-com bubble “eyeball” purchases, Fortune 500 “brand building,” perhaps some free ads offered by the Google Foundation.) But in the case of these screensaver providers, they’re almost certainly making money somehow if they can afford to pay Google’s high pay-per-click prices.

So how do Google’s screensaver advertisers make money? Most of Google’s screensaver advertisers really do offer screensavers that are “free” in the sense that users need not provide a credit card number. But they’re not free in the sense of being available without substantial adverse effects. Quite the contrary: Users must put up with various forms of intrusive advertising.

Let’s look at funscreenz.com, a top-ten Google advertiser for “screensavers.”

Funscreenz.com is owned by BestOffersNetwork, which is another name for notorious “adware” company Direct Revenue. Recall Direct Revenue’s Newsweek profile – plenty of users (and multiple lawsuits) alleging that their software installs improperly and, in many cases, without consent. I’ve previously documented Direct Revenue installed in tricky popups, via false claims of purportedly-required add-ons, and through exploits without any consent at all.

Of course Funscreenz is not alone. Also in top “screensavers” Google results are ads for Claria, Ask Jeeves, and various adware bundlers (who distribute changing or multiple advertising programs). One top Google “screensaver” advertiser sends 15+ emails per week to those who provide an email address to get a screensaver. Results at Yahoo and MSN are similar.

Estimating Search Engine Revenues from Spyware Infections

Every time a user clicks through a search engine ad, the search engine gets paid. Google doesn’t ordinarily say how much advertisers pay. But Yahoo (which does) charges about $0.25 for a “screensavers” click. Let’s do some math. Of the users who click through to screensavers.com, suppose 10% actually download a screensaver – a conversion rate most web sites would celebrate. Then screensavers.com needs to earn $2.50 per download ($0.25/10%) just to break even. That’s a lot of money per download. But they’re buying the ads anyway, and they’re savvy decision-makers. So we can deduce that this site grosses at least $2.50 per download.

How much money do search engines make from these ads? Some initial back-of-the-envelope estimates: According to Yahoo’s keyword inventory tool, “screensaver” (and its hundred most common variants) received about 2.3 million searches in December 2005. Suppose 20% of those searchers clicked on paid links. (That’s conservative, since ads fill more than half of typical users’ screens.) As estimated above, suppose Yahoo collects $0.25 per paid click. Then Yahoo made about $115,000 in December 2005 from “screensaver” and variants. Throw in Google, with its bigger market share, and “screensaver” likely yields about $250,000 of revenue per month.

Of course, not all “screensaver” ads ultimately yield spyware. But from SiteAdvisor’s tests, it seems at least 60% push spyware, spam, or similar unwanted materials. So Google and Yahoo’s “dirty” revenue, from dubious screensavers ads, is probably about $150,000 per month.

But “screensaver” is only one of many terms that commonly leads to spyware and adware. I’ll look at other risky keywords in future articles, as I try to measure the prevalence of this problem in greater detail. Reviewing traffic data from Yahoo’s inventory tool, I’m confident that similarly-affected keywords total at least fifteen times the traffic to “screensavers.” Then Google and Yahoo make about $2.2 million per month, or $26 million per year, through this spyware-pushing advertising. That may not be big money to them, but to my eye it’s a lot.

Clearly there are quite a few estimates here. Send email for methodological improvements and alternative data sources.

Closing Thoughts

As with so many great Internet inventions, the bad guys have stormed the gates of search engines. Now is the time to start fighting back. That doesn’t mean search engines should blacklist every company I ever criticize, but some “adware” vendors are so shady that search engines could proudly refuse their money. Responsibility starts at home. More on search engines’ possible strategies in a future article.

Past work on search engines funding spyware: Yahoo ads syndicated into spyware, Google ads shown through spyware-delivered popups and other vendors’ improperly-installed toolbars.

January 16, 2006December 2, 2023

Affiliate Hall of Shame updated February 19, 2006

I’ve always had high hopes for affiliate marketing — a great way for small web sites to cover their costs and make a reasonable return, by promoting well-known merchants relevant to their visitors. I stand by this optimism, in general. But after several years of watching this space, my expectations have fallen significantly. I’ve seen countless examples of “rogue” affiliates cheating their “partner” merchants. And I’ve seen plenty of underhanded practices from merchants too.

Popular wisdom says most “rogue” affiliates are small. The big guys have too much to lose by getting caught. So we can trust them to behave. Or can we?

Intro to Affiliate Marketing and Small-Time Rule Breakers

In principle there’s nothing unique about affiliate marketing: As in other marketing channels, merchants pay third parties to promote their products. And as in other marketing channels, sometimes this advertising goes terribly wrong — showing merchants’ ads in ways that don’t reflect well on the merchant or the ad channel, cheating merchants by claiming payments not fairly earned, and siphoning payments from other ad channels.

What’s notable about affiliates is the relative prevalence of bad practices. Through affiliate networks, merchants sign up to advertise with hundreds of small companies (and individuals) they don’t really know and haven’t reasonably investigated. Worse, when an affiliate gets caught breaking the rules, the affiliate often just signs up under a new name: Having earned little reputation, the affiliate has little to lose, so there’s little penalty for starting fresh under a new name. With such limited accountability, enforcement is tougher than in other channels. Hence my sense that there are more bad actors in affiliate marketing than in other kinds of marketing.

I show examples of these problems in my September piece on affiliates funding spyware and simultaneously defrauding merchants. See also my Affiliate Summit slides showing new examples of similar practices.

Of course not all affiliate fraud uses spyware. There’s affiliate cookie-stuffing, whereby affiliates claim commissions without users actually clicking through a link to merchants’ sites. (This violates networks’ rules, which say a merchant only has to pay a commission if a user clicks a link.) See also my index of additional affiliate research and testing.

In calling these rule-breakers “small,” I don’t mean to say they don’t make real money by cheating merchants. Quite the contrary! But these “small” affiliates earn fees without developing brand names for themselves. They’re “small” in the sense of appearing and disappearing willy-nilly, without anyone much caring or, in many cases, even noticing.

Big Affiliates Breaking the Rules: CoolSavings and MyPoints

With slim to nonexistent reputations, small affiliates are often tempted to flout the rules. But major affiliates also compromise ethics in order to increase profits.

Notorious among affiliates gone bad is ShopAtHomeSelect, whose software has been widely installed without consent and has been widely observed to “force clicks” without an affirmative end user action. These practices got SAHS kicked out of CJ in fall 2005. But oddly SAHS remains in LinkShare.

Turning to fresh research: Consider well-known affiliates CoolSavings and MyPoints. CoolSavings is a $16.7+ million company, featured in various LinkShare promotional materials, even touted in Wall Street Journal coverage of affiliate marketing. MyPoints is featured in a CJ case study, and LinkShare lists MyPoints with just five other premium “partners” on a special page. So CoolSavings and MyPoints are big, well-respected affiliates. If they don’t follow the rules, no one will.

As it turns out, CoolSavings and MyPoints are widely violating applicable rules. Despite clear prohibitions from affiliate networks, both CoolSavings and MyPoints recently began using “adware” (“spyware,” most users would say) to recruit new users, at the expense of their targeted “partner” merchants. See screenshots below, showing CoolSavings and MyPoints receiving traffic from Direct Revenue. When users visit targeted merchants, Direct Revenue shows CoolSavings or MyPoints pop-ups, which encourage users to register and ultimately to click through to merchants’ sites. Then merchants end up paying CoolSavings or MyPoints for users they already had — expenses they need not have paid, but for CoolSavings’ and MyPoints’ intervention.


CoolSavings Targeting Buy.Com via Direct Revenue (January 12, 2006)		MyPoints Targeting a CJ Merchant via Direct Revenue (January 2, 2006)

CoolSavings and MyPoints’ ads violate applicable affiliate network rules. Commission Junction prohibits affiliates from buying media from “ad services that download and install software on an end user’s computer” — so traffic from Direct Revenue is clearly off-limits. But that’s not the only rule these pop-ups violate. Recall CJ’s rule against “in any manner … modif[ying]” others’ sites. And LinkShare forbids (PDF) “alter[ing] in any manner the Web user’s … view … of … any network affiliate webpage” (rule 1.(a)(i)).

In my view, these Direct Revenue-delivered pop-ups are serious offenses against the targeted merchants. CoolSavings’ and MyPoints’ pop-ups appear as users browse affiliate merchants’ web sites. For example, a CoolSavings pop-up (shown above, at left) appeared as I browsed Buy.com, a CoolSavings partner: Buy.com pays CoolSavings for sending it customers. But despite this alliance and despite applicable affiliate network rules, CoolSavings still uses use Direct Revenue to grab Buy.com customers.

When MyPoints performs similar targeting of its merchant partners, MyPoints explicitly attempts to capitalize on its partners’ goodwill. In the areas blocked out in green (in the right screenshot above), MyPoints specifically names the company a user was visiting before MyPoints interrupted. These references give MyPoints’ ads a further appearance of legitimacy. But the references simultaneously tarnish MyPoints’ partners’ good names — by putting their names into Direct Revenue pop-ups.

Earlier this month, I brought MyPoints’ use of Direct Revenue to the attention of a targeted CJ merchant. Since that report, I haven’t seen many MyPoints pop-ups appearing through Direct Revenue. But affiliates ought to comply with applicable rules from the get-go, without me first identifying or reporting infractions. Merchants should demand no less.

I will update this piece with any material statements I receive from merchants, networks, or CoolSavings or MyPoints. I will be particularly interested in penalties, if any, assessed against these affiliates for their violations of networks’ rules.

Update (January 31): I have received no response from CoolSavings, MyPoints, or any affiliate network. But despite my public documentation of CoolSavings’s practices, CoolSavings’s “adware”-delivered ads continue. See screenshot below, showing a CoolSavings FreeStyleRewards popup delivered by 180solutions (“Zango”), as users browse Circuit City’s web site.

CoolSavings’ FreeStyleRewards Continues to Target Circuitcity.com via 180solutions (January 28, 2006)

FreeStyleRewards’ merchant list (registration required) confirms that Circuit City is a FreeStyleRewards advertiser. So not only is CoolSavings FreeStyleRewards buying adware-delivered traffic (in specific violation of an applicable Commission Junction rule), but FreeStyleRewards is also targeting its business partner’s traffic.

CoolSavings FreeStyleRewards cannot claim ignorance of its traffic sources. For one, these practices have been publicly-documented for two weeks, since my initial January 16 article. Furthermore, 180 sends traffic to a FreeStyleRewards URL that specifically confirms CoolSavings FreeStyleRewards’s knowledge of the traffic’s origin: http://www.freestylerewards.com?ref=metricsdirect&bn=www_circuitcity_com&bl=lp-ce . Notice the highlighted reference to MetricsDirect, the advertising sales division of 180solutions.

Update (February 17): I have received a statement from MyPoints. I quote it here in its entirety:

“MyPoints is a leader in permission-based marketing and is firmly committed to marketing ourselves through channels and with products that respect the privacy and experience of consumers and deepen our productive relationships with our advertisers.

From November 2005 through the middle of January 2006, MyPoints ran a small-scale campaign with an “adware” firm.

When we became aware that the campaign might be in conflict with the best interests of our advertisers, we immediately pulled the advertisements and terminated our relationship with the company.

MyPoints will continue to be extra diligent with regard to selection of acquisition partners. We maintain extremely strong relationships with the affiliate networks and their merchant partners. MyPoints continues to be a leader in opt-in marketing and sets the highest bar possible with respect to privacy, permission and choice.”

CoolSavings Targeting Buy.Com via Direct Revenue CoolSavings Continues to Target Its Merchants via Hotbar
(February 19, 2006)

Update (February 19): I have continued to observe CoolSavings ads appearing through advertising software, still in violation of applicable CJ rules and stil targeting CoolSavings merchants. See screenshot at right, observed last week on a PC running Hotbar, as I browsed the web site of a CoolSavings merchant.