7 ms·

Adware Is Malicious, and It Uses Advanced Techniques to Infect

93 points by koin0r 7y ago

arboghast 7y ago
I reverse malware from time to time for fun and for work and I can guarantee you that many adware are malware in disguise. They often have the same functionalities and persistence mechanisms. We're far from the AskToolbar that was showing up in your Internet Explorer over a decade ago. Two variants in particular, known as DealPly and DealAlpha use advanced persistence mechanisms that you'd find in APTs to make themselves nearly impossible to catch and remove. The other risk is the advertising network itself that delivers the advertisement. Exploit kits have been using comprised advertising servers to deliver the exploit and compromise hosts since adware exists. These servers rarely have good security and the companies owning them generally don't care much. I even suspect that some willingly participate in the distribution for financial gain. While doing forensics for a client a few weeks ago, I found what appeared to be a state-sponsored APT being delivered by a program bundled with adware. I'm really upset with open source projects like FileZilla willingly serving bundled crap to its user downloading from the official website to finance itself. They're putting millions of computers at risk.
- SCHiM 7y ago
  There is a malware family out there that managed to outwit a couple of security researchers. Multiple layers of VM/debugger detection layers were present in a malware sample. If a debugger or VM was detected it would drop a generic adware sample to disguise the true intent. Additionally, telemetry designed to look adwareish would sent to the CnC servers, blacklisting your IP so that you'd only ever receive the adware from that point on even if you managed to bypass the additional layers of protection that were previously missed. https://foxitsecurity.files.wordpress.com/2015/12/foxit-whitepaper_ponmocup_1_1.pdf https://foxitsecurity.files.wordpress.com/2015/12/foxit-whit...
ducttape12 7y ago
Remember back when everyone's computers were infected with this crap because everyone installed p2p crap like Kazaa? Do non-tech savvy people still have a reason to install software? Don't most people just need a web browser?
- elorant 7y ago
  They don't, but in the same time they also have no way of distinguishing between crapware and legitimate software. So they visit some site from a phishing email supposedly sent by one of their friends, which is easily guessed these days with the prevalence of social media, then the site prompts them to download this or that, they press "yes" and then all hell breaks loose.
- MagicPropmaker 7y ago
  I still see non-tech savvy friends have computers with "adware" installed in their browser. It's usually because they tried to "fix" something themselves, googled, and installed something that was purported to fix the problem. There are a bunch of well SEO'd sites that will come up if you google nearly any computer issue that will appear to have a solution, but step 3 is usually to try installing some software. (For example, if you google "can't delete file windows" this site will come up. I don't recommend installing the software https://www.easeus.com/partition-manager-software/delete-files-that-cannot-be-deleted.html https://www.easeus.com/partition-manager-software/delete-fil... ) Here's a discussion on MalwareBytes forum about it: https://forums.malwarebytes.com/topic/166526-easeus-partition-master/ https://forums.malwarebytes.com/topic/166526-easeus-partitio... No matter how many times I yell and scream at friends not to just blindly google for "Device Drivers" and install them, they do. Even sites that look a lot like a legit Epson or Canon site (for scanner or printer drivers, etc) are fake. (And they're searching for device drivers because they have a printer problem and they don't realize that the need to install a custom driver for a name-brand current printer on Windows or MacOS is very very rare)
  - jolmg 7y ago
    > For example, if you google "can't delete file windows" this site will come up. I don't recommend installing the software https://www.easeus.com/partition-manager-software/delete-fil.. https://www.easeus.com/partition-manager-software/delete-fil.... ) That's interesting. It starts talking about different ways to try to delete a file, and at the end it recommends that software and gives instructions to wipe partitions with it. Did I misunderstood that? > No matter how many times I yell and scream at friends not to just blindly google for "Device Drivers" and install them, they do. Even sites that look a lot like a legit Epson or Canon site (for scanner or printer drivers, etc) are fake. Does Windows still not have package repositories like Linux distros do? Installing software from anywhere other than official repos should be an obvious no-no if repos simply existed.
herodotus 7y ago
Paper here: https://madiba.encs.concordia.ca/~x_decarn/papers/vdm-tifs2019.pdf https://madiba.encs.concordia.ca/~x_decarn/papers/vdm-tifs20...
- Dotnaught 7y ago
  Wrong paper linked. See: https://www.theregister.co.uk/2019/05/20/wajam_malware_claims/ https://www.theregister.co.uk/2019/05/20/wajam_malware_claim... and https://arxiv.org/pdf/1905.05224.pdf https://arxiv.org/pdf/1905.05224.pdf
- MaysonL 7y ago
  Why did I read that username as hero.us?
jstarfish 7y ago
One of the more frustrating things about infosec is that more and more practices that were once considered bad or malicious later become mainstream. Used to be, don't publish information about yourself that could be used to impersonate you. Then we got Facebook. Installing random binaries used to be a bad thing, now it's outright encouraged. "Thanks for using our toilet. Download our app to unlock the door!" Telemetry/analytics/arbitrary callbacks used to be shady/questionable and require user consent, now it's standard practice to exfiltrate whatever you want from user devices. You've got root/elevated privilege, encryption is easy and your traffic can easily blend into the haystack, so why not. Opt-in billing used to be the domain of sleazy porn sites, but now you can't buy anything from Amazon without them trying to surreptitiously slip a Prime subscription into your cart during checkout. Seeing traffic from anonymous VPNs logging into financial accounts used to be an obvious giveaway of something suspicious going on. Devices are now shipping with easy-to-enable "anonymous mode" apps that average users have no legitimate need for and route all of your device's traffic through god knows where, which has the effect of making your traffic indistinguishable from a fraudster's. Popular email clients, budget analysis and social media platforms will solicit and cache third-party credentials for your employer, your bank, or your life if you provide them. This despite a decade of trying to beat "never give your password to anyone!" into the popular mindset. Same with algorithmically-generated domains/subdomains, etc.
- deleted 7y ago
  [deleted]
- heresie-dabord 7y ago
  > infosec It isn't the rise of fascism -- it's the rise of hyper-profiteering. There is too much money to be made from the ignorance of well-conditioned consumers for principle to prevail.
- dontbenebby 7y ago
  >Installing random binaries used to be a bad thing, now it's outright encouraged. "Thanks for using our toilet. Download our app to unlock the door!" It's surprising to me how rarely even reputable companies provide hashes/signatures. I just downloaded a Windows virtual machine that MS offers for free[1]. No sha256 sum, no pgp signature. I ended up deciding that since it it served over HTTPS from an MS controlled domain that I'd accept the risk, but I wish more vendors would allow advanced users to verify downloads. (MS is not alone in this, many, many open source projects offer up pre-compiled binaries with zero checksum info, which especially sucks since so often they rely on an assortment of mirrors for the binaries rather than a central location) I understand that telling users to fire up the CLI may be a pain point, but offering the information as an optional step for the experienced user should be a best practice IMHO. [1]For the interested, seems to last "only" 30 days but you can roll back to a snapshot if you're just testing compatibility of sites with Edge: https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/ https://developer.microsoft.com/en-us/microsoft-edge/tools/v...
Animats 7y ago
So why no prosecutions under the Computer Fraud and Abuse Act for "exceeding authorized access"? Adware doesn't have consent. There's no contract of adhesion. Has anyone filed a criminal complaint?

93 points by koin0r 7y ago

I reverse malware from time to time for fun and for work and I can guarantee you that many adware are malware in disguise. They often have the same functionalities and persistence mechanisms. We're far from the AskToolbar that was showing up in your Internet Explorer over a decade ago. Two variants in particular, known as DealPly and DealAlpha use advanced persistence mechanisms that you'd find in APTs to make themselves nearly impossible to catch and remove. The other risk is the advertising network itself that delivers the advertisement. Exploit kits have been using comprised advertising servers to deliver the exploit and compromise hosts since adware exists. These servers rarely have good security and the companies owning them generally don't care much. I even suspect that some willingly participate in the distribution for financial gain. While doing forensics for a client a few weeks ago, I found what appeared to be a state-sponsored APT being delivered by a program bundled with adware. I'm really upset with open source projects like FileZilla willingly serving bundled crap to its user downloading from the official website to finance itself. They're putting millions of computers at risk.

SCHiM 7y ago
There is a malware family out there that managed to outwit a couple of security researchers. Multiple layers of VM/debugger detection layers were present in a malware sample. If a debugger or VM was detected it would drop a generic adware sample to disguise the true intent. Additionally, telemetry designed to look adwareish would sent to the CnC servers, blacklisting your IP so that you'd only ever receive the adware from that point on even if you managed to bypass the additional layers of protection that were previously missed. https://foxitsecurity.files.wordpress.com/2015/12/foxit-whitepaper_ponmocup_1_1.pdf https://foxitsecurity.files.wordpress.com/2015/12/foxit-whit...

ducttape12 7y ago

Remember back when everyone's computers were infected with this crap because everyone installed p2p crap like Kazaa? Do non-tech savvy people still have a reason to install software? Don't most people just need a web browser?

elorant 7y ago
They don't, but in the same time they also have no way of distinguishing between crapware and legitimate software. So they visit some site from a phishing email supposedly sent by one of their friends, which is easily guessed these days with the prevalence of social media, then the site prompts them to download this or that, they press "yes" and then all hell breaks loose.
MagicPropmaker 7y ago
I still see non-tech savvy friends have computers with "adware" installed in their browser. It's usually because they tried to "fix" something themselves, googled, and installed something that was purported to fix the problem. There are a bunch of well SEO'd sites that will come up if you google nearly any computer issue that will appear to have a solution, but step 3 is usually to try installing some software. (For example, if you google "can't delete file windows" this site will come up. I don't recommend installing the software https://www.easeus.com/partition-manager-software/delete-files-that-cannot-be-deleted.html https://www.easeus.com/partition-manager-software/delete-fil... ) Here's a discussion on MalwareBytes forum about it: https://forums.malwarebytes.com/topic/166526-easeus-partition-master/ https://forums.malwarebytes.com/topic/166526-easeus-partitio... No matter how many times I yell and scream at friends not to just blindly google for "Device Drivers" and install them, they do. Even sites that look a lot like a legit Epson or Canon site (for scanner or printer drivers, etc) are fake. (And they're searching for device drivers because they have a printer problem and they don't realize that the need to install a custom driver for a name-brand current printer on Windows or MacOS is very very rare)
- jolmg 7y ago
  > For example, if you google "can't delete file windows" this site will come up. I don't recommend installing the software https://www.easeus.com/partition-manager-software/delete-fil.. https://www.easeus.com/partition-manager-software/delete-fil.... ) That's interesting. It starts talking about different ways to try to delete a file, and at the end it recommends that software and gives instructions to wipe partitions with it. Did I misunderstood that? > No matter how many times I yell and scream at friends not to just blindly google for "Device Drivers" and install them, they do. Even sites that look a lot like a legit Epson or Canon site (for scanner or printer drivers, etc) are fake. Does Windows still not have package repositories like Linux distros do? Installing software from anywhere other than official repos should be an obvious no-no if repos simply existed.

herodotus 7y ago

Paper here: https://madiba.encs.concordia.ca/~x_decarn/papers/vdm-tifs2019.pdf https://madiba.encs.concordia.ca/~x_decarn/papers/vdm-tifs20...

Dotnaught 7y ago
Wrong paper linked. See: https://www.theregister.co.uk/2019/05/20/wajam_malware_claims/ https://www.theregister.co.uk/2019/05/20/wajam_malware_claim... and https://arxiv.org/pdf/1905.05224.pdf https://arxiv.org/pdf/1905.05224.pdf
MaysonL 7y ago
Why did I read that username as hero.us?

jstarfish 7y ago

One of the more frustrating things about infosec is that more and more practices that were once considered bad or malicious later become mainstream. Used to be, don't publish information about yourself that could be used to impersonate you. Then we got Facebook. Installing random binaries used to be a bad thing, now it's outright encouraged. "Thanks for using our toilet. Download our app to unlock the door!" Telemetry/analytics/arbitrary callbacks used to be shady/questionable and require user consent, now it's standard practice to exfiltrate whatever you want from user devices. You've got root/elevated privilege, encryption is easy and your traffic can easily blend into the haystack, so why not. Opt-in billing used to be the domain of sleazy porn sites, but now you can't buy anything from Amazon without them trying to surreptitiously slip a Prime subscription into your cart during checkout. Seeing traffic from anonymous VPNs logging into financial accounts used to be an obvious giveaway of something suspicious going on. Devices are now shipping with easy-to-enable "anonymous mode" apps that average users have no legitimate need for and route all of your device's traffic through god knows where, which has the effect of making your traffic indistinguishable from a fraudster's. Popular email clients, budget analysis and social media platforms will solicit and cache third-party credentials for your employer, your bank, or your life if you provide them. This despite a decade of trying to beat "never give your password to anyone!" into the popular mindset. Same with algorithmically-generated domains/subdomains, etc.

deleted 7y ago
[deleted]
heresie-dabord 7y ago
> infosec It isn't the rise of fascism -- it's the rise of hyper-profiteering. There is too much money to be made from the ignorance of well-conditioned consumers for principle to prevail.
dontbenebby 7y ago
>Installing random binaries used to be a bad thing, now it's outright encouraged. "Thanks for using our toilet. Download our app to unlock the door!" It's surprising to me how rarely even reputable companies provide hashes/signatures. I just downloaded a Windows virtual machine that MS offers for free[1]. No sha256 sum, no pgp signature. I ended up deciding that since it it served over HTTPS from an MS controlled domain that I'd accept the risk, but I wish more vendors would allow advanced users to verify downloads. (MS is not alone in this, many, many open source projects offer up pre-compiled binaries with zero checksum info, which especially sucks since so often they rely on an assortment of mirrors for the binaries rather than a central location) I understand that telling users to fire up the CLI may be a pain point, but offering the information as an optional step for the experienced user should be a best practice IMHO. [1]For the interested, seems to last "only" 30 days but you can roll back to a snapshot if you're just testing compatibility of sites with Edge: https://developer.microsoft.com/en-us/microsoft-edge/tools/vms/ https://developer.microsoft.com/en-us/microsoft-edge/tools/v...

Animats 7y ago

So why no prosecutions under the Computer Fraud and Abuse Act for "exceeding authorized access"? Adware doesn't have consent. There's no contract of adhesion. Has anyone filed a criminal complaint?