Cornell Home Page Computing at Cornell Security

Security Alert: Update on Marketscore intercepting web traffic (1/4/05)

This message is an update to how Cornell's IT Security Office is responding to the Marketscore software that intercepts web traffic. Additional information about Cornell's experience with Marketscore is provided in two papers:

A company called ComScore promotes use of their Marketscore software on computers with Microsoft Windows, claiming it will speed up internet access. If this software is installed on your computer, all of your web traffic passes through their "proxy" servers, where it is analyzed to generate marketing data. This includes any information that would normally be protected during an HTTPS session using SSL (Secure Sockets Layer) encryption.

Due to the risk this poses to critical university and personal information, Cornell's IT Security Office blocked connections from our networks to the Marketscore servers in October 2004. Other higher educational institutions have taken a similar approach to this situation.

On December 10, 2004, we implemented a different mechanism that redirects any web traffic to or from the Marketscore servers to a Cornell web page. This warning page will appear under the following circumstances:

  1. Your Windows computer has the Marketscore software installed.
    • If you are on campus or using EZ-Remote/Express Lane, you will see the warning page no matter where you try to go on the web.
    • If you are off-campus and not using EZ-Remote/Express Lane, you will see the warning page whenever you try to connect to a Cornell web site, but not when you visit external sites.

  2. When you go directly to marketscore.com or an associated web site. This will happen on any computer, whether or not it's running Windows. It does not mean that the Marketscore software is installed.

  3. You visit a web site with banner ads hosted by certain companies. We believe we have now tuned our mechanisms so this will no longer happen. If you see "Cornell Information Technologies Security Office" appearing in a banner, please write security@cornell.edu and tell us what site you were viewing when this happened.
The warning web page, located at http://132.236.69.201:9980, includes instructions for detecting and removing the Marketscore software. Some software utilities for combatting spyware can also be used to find and uninstall it. Spybot S&D (http://www.safer-networking.org/) is one freeware package that recognizes the Marketscore software. If you are on a departmental network, you should contact your local technical support staff before attempting to remove or install any software.

Thank you for your attention to this message. We hope it has proven useful.

Cornell Information Technologies
IT Security Office

More recent messages concerning Marketscore (5/10/05)

Past messages concerning Marketscore (10/12/04)

If you need help and don't have access to local technical support personnel for assistance, please contact the CIT Contact Center (HelpDesk) by calling 255-8990, by sending e-mail to helpdesk@cornell.edu, or by visiting 119 CCC. The Contact Center is open Monday-Friday from 8:00 a.m. to 5:00 p.m., with extended phone hours Monday-Thursday from 5:00 p.m. to 8:00 p.m. during the academic year. If the Contact Center is closed and your problem is urgent, contact the Network Operations Center at 255-9900.

You can receive messages like this via e-mail by subscribing to the CIT-Alert-L mailing list, which is used to distribute announcements about significant disruptions or threats to the campus computing and telecommunications environment. Visit the CIT-Alert-L subscription page


Computing at Cornell Homepage CUinfo CIT Contact List Send Us Feedback

Last modified: June 04, 2007