OFFICIAL SECURITY BLOG
January 30, 2014 | BY Christopher Boyd
A friend of mine was given a Steam giftcard not too long ago, which is great except:
A) They haven’t used Steam before and
B) They didn’t know where to download the program.
I was curious how many common download search terms in Search engine adverts would lead an end user to downloads of their chosen programs with potentially unwanted / unrelated additions such as toolbars, advertising software, download managers, translators and the like.
As it turns out, “quite a few”.
If you’re new to the world of Steam gaming you may want to keep in mind that depending on region and paid ads displayed, you may have to dig down a little bit to get to a download which doesn’t include various additions.
Below are a couple of searches from a few weeks ago.
Here’s a search for “Steam download” in Bing:
I could have put a red box around the adverts to make them stand out from the actual search results, but that seemed to be somewhat missing the point – you should be seeing it as the end-user would, and trying to work out the difference.
There are four ads from top to bottom before you see a page from the Steam site (store.steampowered.com)
The ads will take the end user to a variety of additional installs offered up with the Steam program:
Here’s what they say they’ll offer up in addition to the Steam download:
The “more information” page says that “The common number of programs offered is 2 or 3”, and depending on location / configuration the selection pool is made up of the following:
Delta toolbar, Iminent toolbar, Whitesmoke toolbar, Addlyrics, PCspeedup, Coupondropdown, Boxore, Speedupmypc, Strongvault, Dealcabby, Infoatoms and Translategenius.
This one states that “During the download process, you will be presented with one of the following commercial offers” and that during the download process, the end-user will be presented with one of the following:
Hotspot Shield, Delta Toolbar, FreeRideGames Toolbar, AVG SafeGuard Toolbar, Pirate Storm, SweetPacks Toolbar, Zako Toolbar, PC Performer
The ad says “Download Steam Download”, but this doesn’t seem to have much to do with Steam – instead, it appears to be an extension related to collages and cards.
This one mentioned who the download was managed by (TightRope Interactive), but I couldn’t find specifics on what would be installed. Here’s what happened, starting with Findwide toolbar:
Here’s Foxydeal, which compares prices:
Next up, we have Paltalk, a live chat application:
I’ll admit, this next one confused me a little bit. Household demographics? Data brokers? “Online market research community”? What?
Now you’re filling in a survey with questions asking you how many kids you have, occupation and income built right into an installer prompt! As a sidenote, this is the first time I’ve ever seen an installer ask for information along these lines.
Remember, all the end-user wanted was a Steam download.
One final install agreement, this time for Mobogenie:
I think I need a lie down after that lot! However, we’re nowhere near done yet.
On the right side of the search page, there are two more Steam related links:
The above seems to use the same bundle deal as 1), given it lists the same selection pool of installs. Note that unlike 1), they don’t seem to have a “This is the full range of programs you could end up installing from” link in their text.
This one uses the DomaIQ download manager, and their site states the following software may be installed: Delta Toolbar, Yahoo Toolbar, Whitesmoke, PC Optimizer Pro, MixiDJ, Supreme Savings and Info Atoms.
Yahoo gives a similar set of results to the above:
Google gives me one ad result only:
Paid ads in search engines can become rather controversial, and sometimes it can be difficult for an end-user to separate the adverts from the source and bundled software is the result. Look at it this way, if sites with unnecessary add-ons are themselves telling you that you can “go get the original file from the original site”, then why not do just that?
Here’s the same search for “Steam download” in Bing from Tuesday:
As you can see, no adverts. I tried the same search across a couple of different regions and still didn’t see any ads.
Yahoo still has a bunch of ads on display:
Google looks exactly the same, with that one lonely ad minding his own business:
Always make sure you’re fully aware which are the ads and which are the organic search results before clicking those links. If you just want a straight download with no bells and whistles, it’s something you’re going to have to get into the habit of.