Malwarebytes may not be allowed to label rival's app as 'potentially unwanted' The US Ninth Circuit Court of Appeals last week ruled that Enigma Software Group can pursue its long standing complaint against rival security firm Malwarebytes for classifying its software as "potentially unwanted programs" or PUPs. Florida-based Enigma has been trying to hold Malwarebytes accountable for blocking its …
I'd love a rule that allows any functionality that is installed without the device administrators informed consent to be called malware.
Even if it does not anything bad it should not be there if it comes as a surprise - especially (but not limited to) when it is automatically installed with some 3rd party software.
That might be true for any enterprise that has professional admins. For most users, they just blindly install almost anything even at work on a company boxen. Hell, they click through just about averything that presents a "accept" button. I'm retired IT but get a lot of phone calls from "friends" who computers have suddently crashed or doing "strange things". I've been sending to local computer shops to get their boxes wiped and fresh OS and programs installed.
This is a solved problem.
On Windows: WDAC and/or Software Restriction Policy "just works" to restrict what can be executed. For lazy sysadmins, Smart App Control with Optional/Full Telemetry enabled (and appidtel start ran on boot) will outsource decisions to Microsoft instead. Group Policy and/or MDM allows you to deploy policies to all corporate machines at once. In the case of Smart App Control, this is available even to home users.
On macOS: Google created an open-source tool called Santa which allows you to permit only approved Team IDs, certficates and hashes of binaries you wish to allow, blocking everything else. A central server can be used to share policies with large numbers of machines.
On Linux: fapolicyd deals entirely with hashes of approved binaries, which on a RHEL or Fedora system, automatically permits installed RPMs which are part of the repos but nothing else by default. For extra protection, one can have all users log in with user_r SELinux role too.
Now that would immediately affect all Microsoft programs, and especially the OS, wouldn't it[*]? (sorry... if I hadn't written that somebody else would arf)
[*] it is, for example, unexpected that MS in their infinite wisdom always set the default programs (sorry, "apps") to their own offers, even when it makes no sense (like PDF or SVG files), even (and especially when) those have been associated with other programs...
It's a bit messy but it goes back to 2016 when Enigma sued a blog for posting a negative review of Enigma's Spyhunter. Enigma then, in a lawsuit against Malwarebytes, claimed the blog was affiliated with Malwarebytes, and the classification of its Spyhunter as a PUP was in part a retaliatory move.
MB said at the time Spyhunter simply met its criteria of a PUP. Enigma says its tools aren't PUPs.
C.
Conversely, has Enigma ever *proven* that its software actually does anything and, if it does, does it do that thing completely and with total accuracy?
If not, then does it have an argument for saying its software *isn't* "potentially unwanted"?
Even if there is a totally benign bit of software (i.e. doesn't do anything bad) sitting on my system, if it doesn't do anything good either then I probably do not want it!
From Wikipedia - https://en.wikipedia.org/wiki/SpyHunter_(software)
"SpyHunter is often labeled an Potentially Unwanted Program due to its misleading results of always showing infections, including on clean computers, and injects tracking cookies into a users browser, raising concern whether it is legitimate or not."
Looks, walks and quacks like a PUP to me.
That comment has been there since Jan 29 2021. If only a reputable IT publication could perform an independent and objective review of the current version of the software. Anyone know one?
but I'm not installing THAT crap on one of my machines to test it. Wouldn't put it on the Reg staff either, but they have a masochistic streak so I'd gladly read the account if they want to suffer through a write-up. I'm guessing wasting time putting scareware from thin skinned sue happy garbage peddlers might not suit them.
I'd be inclined to listen more closely to their howls if they had made it above window defender in any of the industry testing in the last 20 years. There are plenty of other shady players in the industry too, but even some of the worst of them are ranked. Norton/Lifelocks management belongs in jail, along with McAffee (the company), but at least they at least beat Defender once or twice even if it was over a decade ago.
Also, may the mad man himself rest in peace. I can only image his take on this, after telling his own company to change it's name years later.
Should also add that the free version apparently cannot remove anything. So you run SpyHunter, it claims to find malware, then pushes you to buy a copy - even if the computer may be clean in reality.
I should add that these are the claims floating around, what we really need is some independent verification of them - something that seems to be lacking from what I've seen. Either way, SpyHunter does currently have a decidedly fishy reputation, so it is understandable why it may be flagged as a PUP.
@Phones Sheridan "That comment has been there since Jan 29 2021."
It's Wikipedia, so the comment must be true. After all we can rely on what user EndangeredPootisBird posted to be accurate and true, They have never posted misinformation before or since, as this is their one and only ever edit.
I like @JessicaRabbit would like to know Malwarebytes' justification for labelling Enigma's software as a PUP. If they can justify labelling Enigma's software as a pup then Enigma have no case. But hiding behind Section 230(c)(2)(B) looks like they have no just reason to, they are just blocking a rivals software.
Both companies have free and subscription versions of their software for download on the internet, meaning users may choose to install both companies apps.
But hiding behind Section 230(c)(2)(B) looks like they have no just reason to, they are just blocking a rivals software.
Or they're looking for a blanket ruling so they don't end up in court every single time they label a product as harmful. That would make it pretty well impossible for them to operate.
Think you'll that many things - e.g. the likes of NMap and Wireshark - also get classified as PUPs (by Malwarebytes and others) - and that's fine because if you have installed them yourself, all you do is tick the relevant tick-box to add them to the safe list. Of course, if you haven't installed them, then you need to be alerted to their presence and probably want to worry.
Most vendors of "dual use" software aps don't get fussed - so what's Enigma trying to hide?
Absolutely agreed! I recall reading warnings from antivirus software prior to running a scan which explicitly stated that any other anti-virus/malware tool(s) installed on the system *might* be labeled as a PUP just due to the nature of the software. (I'm guessing primarily due to the presence of internal databases containing numerous definitions/hashes of various trackers, viruses, and other malware - but that is just a guess and likely a poor one at that).
and most companies don't want to risk the brand damage of losing a case like this in court.
Of course of the assertion holds that Enigma's customers/victims were tricked they may also end up proving themselves liable for further legal action, and giving up evidence showing that their users weren't aware of the companies practices.
This has all the hallmarks of a suit that gets dropped a day before the court date.
The security industry should set up an open source, openly documented encyclopaedia of malware, PUMs and PUPs, regulated by chartered institutions like the BCS. Any company blocking anything listed there can point to it as a resource and confidently state "this is what the foremost experts across the security industry, academia and IT in general have to say about this software". This would also allow people to make fully informed decisions too, as some detection signatures exist to "protect" home user systems against legitimate tools which are commonly abused as part of payloads, such as NirSoft password recovery tools and produkey.
That's not only not essential, it's not even relevant. The question for the court is whether one vendor needs to justify what its product says about another product in the first place, not the individual merits (or lack thereof) of Malwarebytes or Spyhunger.
If, in general, a vendor can be compelled to provide such justification, then the court has effectively killed most anti-malware software.
This is a terrible decision by the Ninth Circuit panel. I agree with Goldman; we need an en banc hearing, and if we get one, I certainly hope the majority are more sensible than the two who decided to return this case to the district court.
Maybe the judge can determine the answers to the following three questions:
1. Does the program perform a useful and accurate service, or is it's primary reason to create fear and extract payment?
2. Is any payment system reasonable and transparent, or does it use deceptive practices such as auto-renewal?
3. Can the program be removed from the machine easily, or does it require specially software to eradicate it?
I was thinking totally barefaced newspeak might be the thing if 'potentially unwanted'/pup isn't already weasel enough..
"Malwarebytes has found something. Look! it's a totally adorable kitten answering to the name of Enigma. Would you like to give it a soft ball of wool to play with and put it safely in it's playpen so it won't be accidentally trodden on by any of your potentially wanted programs?"
I recall a time, when dinosuars still ruled Earth (or maybe just as recent as the Pleistocene?) and the windows security components were all too happy to try to disable your virus scanner and other security related programs, locking up the machine in the process. Is that a desirable outcome? What if MS would use its market position to bring this behaviour back (only this time doing it right, i.e. without locking up the whole machine) and squeeze out any other security suite, because they are free to flag it as a PUP?
It would not be pleasant, to say the least.
If, as I might surmise, you are not 100% positive in your feelings about members of the said august profession, then that is possibly the last activity you would want them to perform!
And while people might feel aggrieved at lawyers doing their best for their clients, the people to be angry with are the ones who make the poorly drafted and illogical laws in the first place - the politicians, ably assisted by the lobbyists. Direct your ire to the cause of the disease, not the symptoms.
(Posting as anon as I used to work for a (respected) company that does anti-virus n stuff but I don't want anyone to think I speak for them.)
Most apps classed as PUPs really are unwanted, and doing low-grade dodgy stuff like home page redirections or back door analytics tracking. Dubious, let's say (as the current phase has it, "unwise but not illegal"). The really bad stuff like installing trojans or stealing credentials are not graded as PUPs. Most of the people pushing PUPs get them installed by by taking advantage of naive users, stuffing them them into installation packages for otherwise useful stuff. In short most of the PUP farmers know they are being slightly dodgy but don't want to attract attention. If you're smart enough to have installed some endpoint virus detector, and remove their stuff from your PC, you're no longer their target market.
Working at $ANTIVIRUSCOMPANY for eight years, I was only aware of a handful of cases where a PUP categorization had a strong objection from the PUP vendor. Errors do happen from time to time, so the $ANTIVIRUSCOMPANY updates its database, and does what it can to correct the record if it considers an error of fact has been made. I got involved a couple of times ensuring that long-archived webpages were properly updated.
What I'm saying is that this specific case, regardless of its merits, feels very much like an outlier. I would hope that we don't get into a "hard cases make bad law" situation... <sigh>
Memories...
Long ago I worked for a document-editing and -management company. We were not the only such company (just the best:), so we had competitors. All the competing products featured spelling checkers, and one competitor's checker flagged $OURPRODUCT as a misspelling and suggested $THEIRPRODUCT as the correction.
Should we have sued?
On the one hand, from the descriptions above, Enigma really is an unwanted program - falsely claims infections to try to get you to buy it. Ugh. So in reality, I'd really appreciate REAL antivirus/antimalware programs detecting and removing it.
On the other hand, being able to label something *legitimate* as unwanted and remove it with no legal recourse seems like a really bad idea. For instance, imagine Windows on a dual-boot machine suddenly saying "Windows detected the 'Linux' malware on another partition, and erased it. You're welcome." Using this to be anticompetitive really should be prohibited.
So it boils down to the definition of malware and "potentially unwanted programs". How exactly do we codify that in law?
(Amusing anecdote: Back when I ran Windows, I had a program that was routinely marked as a PUP. It was a small executable that, when run, would pop up a screen with Coca-Cola logos on it, thank you for being such a great customer, and had a button to receive a free cupholder. When pressed, the CD drive would open. Strictly a lark, but my AV definitely didn't like it.)
> For instance, imagine Windows on a dual-boot machine suddenly saying "Windows detected the 'Linux' malware on another partition, and erased it. You're welcome." Using this to be anticompetitive really should be prohibited.
Funny you should mention that as an example, because Windows already does something fairly similar. Who here has installed a Windows update, then booted to the desktop and had a popup along the lines of “$APPLICATION is not compatible with this version of Windows and has been uninstalled”?
Which drives me mad. Firstly, it’s the unearned smugness of it. “We did you a favour and messed up your workflow!”
Secondly though, define “not compatible”. That could be anything from “immediately crashes and takes down the whole system” to “works perfectly unless you try to print to a hard copy” (in which case, a perfectly reasonable response by the user might be: “I know, I don’t even have a printer anyway, and I need this old app to (access old financial records, photos, whatever)”. Or it might be that the app in question is installed on C: but is only ever run under WINE from the dual-boot Linux partition.
Either way, my point - if I have one? - is that applications shouldn’t be uninstalled without the clear consent of the user.
I’m NOT siding with Enigma here. What I have read here and elsewhere makes me inclined to never, ever let their software anywhere near my systems. And Malwarebytes aren’t automatically uninstalling it; they’re just flagging it as a PUP. To return to my analogy, if Windows simply popped up with “hey, $APPLICATION might not be fully compatible with this version of Windows, click here for details” - that would be a lot more acceptable.
From a Social Security Administration publication:
"Until 1972, the area number indicated the location (State, territory, or possession) of the Social Security of- fice that issued the number. When the Social Security numbering system was developed, one or more area numbers were allocated to each State based on the anticipated number of issuances in the State (table 1). Because an individual could apply for an SSN at any Social Security office, the area code did not necessarily indicate where the person lived or worked. Since 1972, the Social Security Administration has been issuing SSN’s centrally from its headquarters in Baltimore. The area code now indicates the person’s State of residence as shown on the SSN application."
That would be consistent with my experience; my SS number is within the range for New Jersey, my residence when I applied, and my daughter reflects Massachusetts our residence when I applied on her behalf.
A university I went to had to explain to profs that listing partial social security numbers as student IDs was a bad idea, for this very reason. Under the old system, if you knew the last four digits of an SSN, and you knew where the person was from, guessing the whole thing was not hard; you already had seven of the nine digits.
If I'm using Malwarebytes, it is a choice. The choice of using their opinion on what is or isn't undesirable software on my computer. If their classification was more vindictive than accurate, I would simply stop using the software. Their expertise is what I, in this scenario, have voluntarily bought. Go ahead and classify away!
What has the court have to do with anything here? Malwarebytes role to protect brands on my computer is non-existent. I really want them not to care about brands.
What a world we live in. Please, technologically illiterate judges, tell me what is good for my PC...
It seems like every antivirus app could now be regarded as a PUP for adding extra features without making it completely clear and/or to sell extra features (even though the program was initially touted as complete protection).
Even Malwarebytes does this (despite being one of my preferred cleanup tools). It tries to add browser add-ins and a VPN service.
The Avast/AVG/CCleaner group have a particularly harmful business model. What starts as a free AV ends up selling 5 or 6 services and a browser that pops up on startup. I've even seen clients with several copies of apps doing the same thing, just branded as CCleaner or AVG instead. £200+ a year! That is a PUP I would not install.
TotalAV - £149 a year and difficulty getting refunds.
Even Norton and McAfee hijack your search results and replace your preferred SE with 'Secure Search' - full of junk results, plus a whole page of sponsored spam and scams. Definitely not as safe as Google or DDG.
"It tries to add browser add-ins and a VPN service."
No, it doesn't. It offers you those extra features, with only the VPN costing more, which is perfectly reasonable. You don't have to install the extra features. I use Malwarebytes on all my devices. It most defintely doesn't meet the criteria for being a PUP.
In Living Off the Land attacks hackers use legitimate apps and tools to access, control and destroy your PC and it's data. Alternate data streams is a legitimate way for programs to load data into memory but hiding and not showing obvious evidence of this to the user. A valid program included in Windows 10/11 is BITSadmin, Microsoft's freely available System Internals Suite has a program called stream that offers the same functionality. Among many others easily downloaded through an alternate data stream, hiding the activity from the user.
Taskmgr, taskscd, BCDedit, format, msconfig, regedit, gpedit, rundll32, eventvwr...etc are all legitimate Windows 10/11 system tools and commands that can be used to subvert and damage your PC. Hackers are hiding malicious code in .ini files, storing scripts and programs as data to be translated and run in memory or through PowerShell. Javascript is standard and essential across the Internet and scripts can be hidden or encapsulated to run from seemingly innocuous sources. The NSA hacked most of the popular antivirus products to help spy on people after 9/11 (may still be doing so), so the very program(s) you depend on to protect you can be turned into a PUB and blocked or disabled. Windows 10/11 itself is full of PUBs. Where do you draw the line and who decides that line?
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
