About Me

Seth Purdy

Seth Purdy

Read More

Feeds & Podcasts

Blogs

Meet the Bloggers

Archive

Tags

#SecChat $1 million guarantee 12 Scams of Christmas access to live fraud resolution agents Acquisition Alex Thurber Android antivirus Apple botnet Channel Partners cloud security Compliance Consumer counter identity theft credit card fraud and protection credit fraud alerts credit monitoring credit monitoring and resolution critical infrastructure Cyber Security Mom cyberbullying Cybercrime cybermom data breach data center data center security Data Protection Dave DeWalt DLP Email & Web Security embedded encryption Endpoint Protection enterprise facebook fake anti-virus software Family Safety Friday Security Highlights global threat intelligence google government Hacktivism how to talk to kids how to talk to teens identity fraud identity fraud scams identity protection identity protection $1 million guarantee identity protection fraud identity protection surveillance identity surveillance identity theft identity theft expert identity theft fraud identity theft protection identity theft protection product Identity thieves and cybercriminals intel iphone kids online behavior lost wallet protection malware McAfee McAfee Channel McAfee Family Protection McAfee Identity Protection McAfee Initiative to Fight Cybercrime McAfee Labs McAfee security products Mid-Market Mobile mobile malware mobile security monitor credit and personal information Network Security online personal data protection online safety Operation Aurora PCI personal identity theft fraud personal information loss personal information protection phishing privacy proactive identity protection proactive identity surveillance Public Sector restore credit and personal identity Risk and Compliance scam scams scareware security smartphones social media social networking social networks spam Stuxnet twitter vulnerability Web 2.0 work with victim restore identity

When Is WhenU MeMe?

Thursday, June 14, 2007 at 1:33pm by Seth Purdy
Seth Purdy

Following up on a tip from my colleagues at McAfee’s SiteAdvisor, I examined an interesting piece of software recently from a provider I’d not heard of before, a product called “MeMe,” made by MeMedia, Inc.

The installation was immediate upon launching the installer, with no EULA or other notification displayed until the software was running. The MeMedia Web site suggests the software is intended to supplement a user’s browsing and general use of the Internet by tracking usage (locally, the software assures) and then proactively searching out and alerting the user to additional content that matches the interest categories that MeMe has identified. The term “meocentrism” is cutely coined on the product’s web site to describe this. I also read a notice that the software may be used “in support of free software,” suggesting potential bundling. Oddly, visiting MeMedia’s home page results only in a page with a logo and “coming soon,” though several subpages are accessible and the software appears to be available and functioning. The interface is designed to resemble a three-dimensional cube, and uses many shadow and animation effects:

Peeking under the hood, I grabbed some of the network traffic to verify that no user-browsing data was in fact being transmitted. I was surprised to find communication with servers in the whenu.com domain, and even parameters being passed in HTTP transmissions such as “&app=whenusave.” Save! (also incarnated as “SaveNow”) is an advertising client product made by WhenU. I did not note any personally identifiable data being transferred to remote systems during a few limited tests, but the indications point to a mechanism similar to what WhenU uses in its advertisment products (running search terms against a local database to preclude the need for sending user data from the local system). It appears that the MeMe software is somehow leveraging WhenU’s infrastructure. Along with many overlapping IP addresses and DNS records, we have indications that MeMedia is in partnership with or wholly owned by WhenU.

Crossing into speculation, I find interesting the apparent repurposing of adware infrastructure as a “usage assistant”; something to help a user find content on general topics of interest rather than simply pushing comparative product offers. The vendor achieves the same goal of connecting a user with specific content; MeMedia could easily define and control the data set that the client software could search to find the user’s identified interests. Vendors could feasibly monetize additions to such a content repository as well as more direct targeted advertising. If my speculation is correct, such a scenario–though not far removed from traditional push-advertising models–might at least be better accepted by users. Although the field of data such a “meocentric” digital helper could sift through might really be a walled garden of sponsored content, the idea seems less intrusive than a pop-up hawking a widget.

On my test environment, which is essentially clean of any usage data, MeMe “found” an article on Michael Vick for me after running for several minutes. This occured even without my doing any browsing or other activity. I later found that several terms were apparently hard coded into the installer package (ExecuteParameters=”/i\”rock;Chicago Bears;Serena Williams;Michael Vick\”"), ensuring that the recipient would at least have some “interests” about which content could be “found” right off the bat.

It’s awfully kind of them to look out for us boring folk.  ;-)

Bookmark and Share

Submit your own comments / message for this post

Your email is never published nor shared. Required fields are marked *

 

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>

Comments (2)

  • Xetheare July 13, 2008 2:33PM

    I have a similar problem with the same nomenclature. Memedia tactfully named their spyware “AdVantage”, so it is very difficult to find ANY info on this UNREMOVABLE addon to Firefox.

    I even did a complete uninstall of FF. It was still there. I have it disabled but I want it gone. Pronto!

  • TeMerc June 14, 2007 2:02PM

    Ok..so the install completes WITHOUT a visible EULA to opt out of the install? How is it that you’re not screaming about this?

    And of course, I am not too surprised at who we find behind this install. Even tho they have kept their noses clean the last several years, coming from an adware vendor, it can’t be exactly a shock.

    And the fact that it ‘found’ something with no actual participation by the end user is another red flag. I wonder what SiteAdvisor has to say about the Memedia?

    I think it warrants a much closer look into exactly what this new form of adware, ‘Meocentricity’ is really going to do to end users. Based on what you have posted here, I do not expect it to be good at all.