Microsoft sues Funmobile

Microsoft sues Funmobile over spim, phishing and porn scheme

Microsoft today filed suit against Funmobile Ltd. of Hong Kong and its Foster City, Calif., subsidiary -- alleging that they used a combination of phishing and instant-messaging spam to steal login information and direct people to adult entertainment sites and bogus social networks.

The suit alleges that Funmobile used instant-messaging spam, known as "spim," to direct people to web sites that deceived them into turning over their Windows Live Messenger login information and passwords. According to the suit, Funmobile then used those logins to break into accounts and send more spim. Tim Cranton, Microsoft associate general counsel, described the case in a blog post today.

"As outlined in the complaint, Microsoft alleges that Funmobile Ltd., a Hong Kong-based company owned by brothers Christian and Henrick Heilesen, has spimmed thousands of Windows Live Messenger customers since March 2009. The scheme is alleged to target customers with IMs that appear to come from the e-mail address of a known friend or acquaintance, and invite the recipient to click on a link

"Customers who clicked on the link in the bogus instant messages sent by Funmobile were then “phished”— that is, asked for their IM username and password to log in, according to the complaint. Those who provided the log-in information were often redirected to an adult Web site or, in some cases, a site that claimed to be a social networking community for Windows Live Messenger users.

"Meanwhile, we allege, the defendants collected the wrongfully-obtained usernames and passwords and used them to access Microsoft’s proprietary systems and our customers’ accounts. They then “scraped” or “harvested” the contacts within each user’s account, and sent unsolicited bulk IMs to each of his or her contacts."

TechFlash has contacted Funmobile via email to get the company's comment on the case, and we'll update this post if it responds.

Techflash Article

Company Settles Porn Spam Charges

Adult Web site Cyberheat will pay $413,000 to settle an FTC complaint involving explicit e-mail from its affiliates.

Grant Gross, IDG News Service
Mar 4, 2008 11:50 am

An adult Web site whose affiliates sent pornography-related spam to unsuspecting recipients will pay US$413,000 to settle a complaint from the U.S. Federal Trade Commission.

Under the settlement, Cyberheat is prohibited from spam e-mail marketing and is required to monitor its affiliates to ensure they are complying with the law, the FTC said.

Cyberheat, in Tucson, Arizona, is the sixth company that has settled FTC complaints about porn spam since 2005. A complaint against a seventh company is pending. The six companies that have settled the 2005 complaints have agreed to pay more than $1.6 million in civil penalties.

The FTC had accused the companies of exposing children and others to sexual images. The spam e-mail was the equivalent of "electronic flashing," the FTC said.

The FTC alleged that Cyberheat violated the agency's FTC's Adult Labeling Rule and the Can-Spam Act, which require commercial e-mailers of sexually explicit material to use the phrase "sexually explicit" in subject lines. The rule and law also require that e-mail senders ensure that the initially viewable area of the e-mail does not contain graphic sexual images.

Cyberheat's affiliate markets also did not provide adequate opt-out mechanisms in their e-mail and did not provide a postal address for the company, the FTC said. Can-Spam requires both.

FTC filed the complaint against Cyberheat and the settlement in U.S. District Court for the District of Arizona.

Cyberheat did not send e-mail directly to consumers, but the company operated an affiliate marketing program, in which it paid others who sent spam on the company's behalf, the FTC said. Under Can-Spam, the company is liable for the illegal spam sent by its affiliates because the defendant induced them to send it by offering to pay those who successfully attracted subscriber to its Web sites, the FTC alleged.

A Cyberheat spokeswoman wasn't immediately available for comment.

porn, spam