Skip To Navigation

EffectiveBrand Toolbars - Spyware?

EffectiveBrand toolbars are getting removed from addons.mozilla.org. The main reason is that they load and execute remote JavaScript, which gets around AMO's review system and is a potential security hole.

I've tried their software, in fact I even made my own toolbar (the omgwtfzingbar), but you might want to read this (and the bug above) before trying it yourself. There are certain... inconsistencies... that don't fill me with confidence.

First, the privacy page linked to from the download page. It admits that pages you visit will sometimes be sent to their servers, and says:

To ensure your anonymity, there is no unique ID that can distinguish one user from another.

After installing my toolbar, I found I had a Firefox pref called "CT254130.UserID" with the value "UN20060310144233841". It seems to only be transmitted in order to make the chat feature work, which is reasonable but undisclosed.

Our toolbar: ... DOES NOT download anything on its own. You can manually update the software, but our toolbar will not download anything without your consent.

This is just blatantly false. The initial toolbar download is 5KB - it downloads images, javascript, and, depending on the toolbar's features, HTML pages that are shown in tiny areas on the toolbar itself. Moreover, the following text from the toolbar editing interface directly contradicts the manual-update-only assertion:

Any changes that you make to your toolbar will automatically be seen in your users' toolbars. In most cases you won't need to tell them to reinstall the toolbar, they'll see your changes right away.

EffectiveBrand have a page on their website that offers a $5000 reward if you can prove the toolbar meets their own definition of spyware. Doesn't seem fair, but I'll try anyway:

  • The program does not install any component or support file that is not expressly required for it's function; including registry modifications.
  • The program does not execute any other programs without the user informed consent.
  • The program does not launch or initate network connections, unless expressly required by its function or authorised by the user; and does not transmit personal information without user informed consent.

I could nitpick and say that the about dialog isn't a necessary function, or claim that loading JavaScript counts as executing a program, but the real fun is in the third point. Every time I click on a link button or perform a search from the toolbar, that event is passed on to an effectivebrand.com server. Whilst this behaviour is vaguely referred to on a privacy page, failing to read that and installing the extension does not constitute authorisation.

  • The program removes itself entirely from the system, including the deletion of all support files and active registry keys.

This is the clearest one. After I uninstalled an EffectiveBrand toolbar, I checked my profile folder, and sure enough, it had left behind 9 files. Whilst I don't really care about the 384KB of wasted disk space, and I'm not sure this is an effective measure of spywariness, I do take pleasure in saying this: EffectiveBrand are spyware producers, by their own definition. And they owe me $5000.

⇐10 Mar 2006 - RandomTab / 08 Mar 2006 - Meh, ChatZilla Stuff again⇒

Feedback

EffectiveBrand Update

Timeline Since my last post on the subject: (April 1) EffectiveBrand updated their code so it no longer loads remote JavaScript.... / Trackback from rdmsoft.com Blog on 26 Apr 2006 at 23:16.

tanks for the important info.
can you tell me wich files are remaining after uninstalling?
tanks / Comment from qshiva on 10 Apr 2006 at 08:32.

Good post. I think they should give you $5000 out of general principle, but we both know that probably won't happen. The only way they would offer that money up is if they knew they were under no legal obligation to ever pay it. Seems like a ploy to me. / Comment from morgamic on 18 Apr 2006 at 17:19.

EffectiveBrand toolbars are now allowed back on addons.mozilla.org and AMO reviewers have been instructed to permit submissions of EffectiveBrand toolbars.
There were discussions between Mozilla and the EffectiveBrand folks who made some changes in their code.
As a result of the discussions Mozilla will be permitting EffectiveBrand-based toolbars to be listed on the site again. / Comment from Rudy on 12 May 2006 at 22:28.

i have my own toolbar @ link removed . I've installed it and it's fine. No extra files, transmissions or errors. / Comment from pcwhiz1012 on 04 Jun 2006 at 14:43.

I find nothing wrong with the toolbar i`ve had it over 12 months and so do lots of my friends with no probs at all,
Its a great service super 100% there No1 on the net for toolbars. / Comment from livefootball on 18 Jun 2006 at 02:54.

I've had an effectivebrand toolbar for over two years now, with over 400 users using it daily, and not one of them has ever complained to me that it has given them any problems.
Also, you say that it doesn't completely remove the toolbar- It does, it just doesn't remove the user information. / Comment from Mike on 08 Jul 2006 at 07:05.

Well i have to say that, all these above, could be wrong. I found effectivebrand toolbar the best tool to promote, market and maximise your traffic's sattisfaction. I had an increase of 25% on traffic returning, plus i made a lot of sales sending rss messages to my users. I find it perfect. Check it at http://www.exevior.com / Comment from Angel Exevior on 04 Aug 2006 at 17:58.

It is totally spyware, because they can remotely update the toolbar and they know it, that's why they changed their name from Effectbrand to Conduit. They are based out of Israel too, need I say more. / Comment from Michael Schwartz on 03 Sep 2006 at 20:33.

"They are based out of Israel too, need I say more."
What does that mean, Schwartz? Are you some kind of bigot? / Comment from Soup on 30 Oct 2006 at 19:58.

I don't think Michael will be back to defend himself, but for what it's worth I think any concern about overseas storage of potentially identifiable information is a perfectly valid one. / Comment from Robert Marshall / [Admin] on 30 Oct 2006 at 23:16.

get this fuc*ing thing off my computer! / Comment from T Chan on 08 Jan 2007 at 20:41.

Feedback is closed. Feel free to contact me privately.

tH