Malwarebytes Scores Legal Win Over Enigma Software
 12.11.2017 securityweek Cyber
Enigma Software, supplier of software known as SpyHunter, has a notice on its website: "Malwarebytes Inc., the maker of Malwarebytes Anti-Malware ("MBAM") and AdwCleaner, is intentionally blocking SpyHunter and RegHunter for what we believe are competitive reasons... We have taken legal action against Malwarebytes and are seeking remedies for this unfair conduct."

Those legal remedies were dismissed by the District Court, Northern District of California, San Jose Division on November 7, 2017.

The heart of the issue has been Malwarebytes' determination that SpyHunter is effectively a PUP; that is, a potentially unwanted program. PUPs tend to be nuisances rather than specifically malware. They are often adware apps that are easy to install and difficult to remove, offering little practical value to the consumer. Malwarebytes has been one of the more aggressive endpoint protection vendors in its classification and removal of PUPs.

It does so with SpyHunter -- and Enigma Software objected. Enigma's legal complaint claimed that Malwarebyte's actions were competitively motivated, and it asked the court for "Preliminarily and permanently enjoining Malwarebytes from programming MBAM to prevent the download and installation of SpyHunter or RegHunter;" adding a request for "punitive damages".

In response, Malwarebytes requested the court to dismiss Enigma's action, citing immunity under the Communications Decency Act -- which states, "No provider or user of an interactive computer service shall be held liable on account of... any action voluntarily taken in good faith to restrict access to or availability of material that the provider or user considers to be obscene, lewd, lascivious, filthy, excessively violent, harassing, or otherwise objectionable, whether or not such material is constitutionally protected..."

The court agreed, confirmed Malwarebytes' immunity, and dismissed Enigma's case.

This doesn't mean that SpyHunter is legally a PUP, only that Enigma cannot stop Malwarebytes from offering users the option to remove it under its PUP program.

F-Secure's Sean Sullivan commented, "We at F-Secure have our own PUP criteria in our efforts to do what's best and right for our customers -- and I'm comfortable that's exactly the intentions of the folks at Malwarebytes. Fighting for their customers -- good for them!"

Malwarebytes is delighted. "This is not only a critical win for Malwarebytes, but for all security providers who will continue to have legal protection to do what is right for their users," blogged CEO Marcin Kleczynski yesterday. "This decision affirms our right to enable users by giving them a choice on what belongs on their machines and what doesn't."

It's too early to tell whether this is the beginning of the end of the PUP problem. "I'm not sure how much difference isolated instances of case law will make in the short term," comments ESET senior research fellow, David Harley, "but anything that tends to make monetization firms more answerable to the needs of the population as a whole -- or at least that sector of the population whose interests the security industry aims to protect -- is positive. It might be better in the long term, though, if the software distribution and monetization industries and the security vendors work out their differences in the context of the Clean Software Alliance. Well, we can but hope," he added.

Luis Corrons, technical director at PandaLabs, is not sure that the battle can be won in the courts. "All PUP fights in court, win or lose," he told SecurityWeek, "are a waste of time and resources for all of us. We could fight in court for ages and that won't help anyone."

Instead, he hopes for a solution via a relatively new organization, AppEsteem. "It is time to take a different approach in this field," he continued. Here what AppEsteem is doing has the potential to be a game-changer that helps everyone: users not being bothered by software that does not behave properly, security vendors focusing only on protecting their users and software vendors making money by being transparent and offering real value to end users."

AppEsteem's president, Dennis Batchelder, is clear, however. The result from the courts is "great for security companies, but more importantly, this dismissal is a big win for consumers. Security companies can truly put protection first. This strengthens AppEsteem's resolve to call out every deceptive app and drive a world where consumers are safe from fraud."