4 ms·
Good writeup on the reverse engineering. I'm still a little confused as to what the code was doing, though. It gathers statistics about your user machine (none
by hiram112 9y ago
Good writeup on the reverse engineering.
I'm still a little confused as to what the code was doing, though. It gathers statistics about your user machine (none of which seemed too personal - basically IP, OS, country, etc).
But then what is it doing? Opening a virtual browser or simulating clicks to some ad network?
- jjjensen90 9y agoSeems to me that it is indeed running a hidden browser on a background thread, loading ads, and simulating views/clicks. That is in addition to collecting and sending user and system information (possibly also for ad-serving or information sales or some other nefarious skulduggery).
- lsaferite 9y agoA simple thing would be to trigger a visit to a site using a JS coin miner if it's running JS in the hidden browser.
- slig 9y agoIt would be more efficient and simple to just run a miner in Java.
- nerdponx 9y agoI wonder if this was actually an attempt to scam the advertisers into thinking they were receiving genuine add traffic, in order to get affiliate revenue. Using actual customer data might have prevented the advertisers from getting suspicious.
- 0xfeba 9y agoBy and large, that's exactly what it was doing, getting ad revenue. The second part also sounds plausible, but it would need to use this as the user agent during the actual clicks.
- lvoudour 9y agoI'm surprised he wasn't mining bitcoins on the side :)