How Adware Makes Companies Money

Logethica

Level 13
Thread author
Verified
Top Poster
Well-known
Jun 24, 2016
636
How Annoying Adware Makes Companies Money:
SOURCE: vocativ.com (ARTICLE DATE: 5th Aug 2016)

Researchers from New York University and Google teamed up to figure out just how adware operates on a user’s computer. They will present a paper about their work next week at the USENIX Security Symposium in Austin, Texas.

The term adware (the combination of “advertisement” and “malware”) usually refers to advertisements that are either aggressively displayed on a screen or surreptitiously downloaded to a user’s computer. Once they’re on a computer, the adware can do things like collect a user’s information to then push more targeted ads, or bombard her with pop-ups for legitimate products

Adware is shockingly common, which makes it extremely lucrative—the researchers cite reports that estimate that adware companies raked in $460 million in 2014 alone, nearly triple the income of companies that generate malware. And though for years Google has been tracking some of the sites where adware commonly lurks, they don’t know much about the companies propagating the ads...

[To read the full article please visit the link at the top of the page]

NYU, Google researchers hack business model of adware, scareware, other unwanted software:
SOURCE: eurekalert.com (ARTICLE DATE: 4th Aug 2016)

Commercial PPI is a monetization scheme wherein third-party applications -- often consisting of unwanted software such as adware, scareware, and browser hijacking programs -- are bundled with legitimate applications in exchange for payment to the legitimate software company. When users install the package, they get the desired piece of software as well as a stream of unwanted programs riding stowaway. Thomas, McCoy, and their colleagues cite reports indicating that commercial PPI is a highly lucrative global business...

"If you've ever downloaded a screen saver or other similar feature for your laptop, you've seen a 'terms and conditions' page pop up where you consent to the installation," McCoy explained. "Buried in the text that nobody reads is information about the bundle of unwanted software programs in the package you're about to download." The presence of a consent form allows businesses to operate legally, but McCoy classifies the extra applications as "treading a fine line between malware and unwanted software."

The report explains that PPI businesses operate through a network of affiliates-- brokers who forge the deals that bundle advertisements (often unwanted software) with popular software applications, then place download offers on well-trafficked sites where they're likely to be clicked on. Parties are paid separately -- meaning some legitimate developers do not know their products are being bundled with unwanted software -- and they are paid as much as two dollars per install.

When an installer runs, the user's computer is "fingerprinted" to determine which adware is available to run on that particular machine. Additionally, the downloader searches for antivirus protection, factoring in the presence or absence of such protections in its approach. "They do their best to bypass antivirus, so the program will intentionally inject those elements -- whether it's adware or scareware -- that are likeliest to evade whichever antivirus program is running," McCoy said...
[To read the full article please visit eurekalert.com]
 

DardiM

Level 26
Verified
Honorary Member
Top Poster
Malware Hunter
Well-known
May 14, 2016
1,597
Thanks for the article :)

An old specialist of legitimate developer programs, bundled with unwanted software, was :
- softonic.com (I don't know if they have changed this bad behavior :p)

A neighbor had downloaded one of these bundle several years ago (skype) :
=> 4 x 4 adware checked by default, and he has clicked each time on "next" without reading.
He called Me "I don't understand, a lot of bad things on my PC, and I've done nothing strange, apart installing skype") :D
 
Last edited:
W

Wave

Thanks for the article :)

An old specialist of legitimate developer programs, bundled with unwanted software, was :
- softonic.com (I don't know if they have changed this bad behavior :p)

A neighbor had downloaded one of these bundle several years ago (skype) :
=> 4 x 4 adware checked by default, and he has clicked each time on "next" without reading.
He called Me "I don't understand, a lot of bad things on my PC, and I've done nothing strange, apart installing skype") :D
CNET are unbelievable with their download.com service, I'm sure you know what I mean. Maybe I got mixed up with someone else, but I am sure they bundle a bunch of stuff for money in their "custom downloaders"...

edit: download.cnet.com now actually
 

Logethica

Level 13
Thread author
Verified
Top Poster
Well-known
Jun 24, 2016
636
CNET are unbelievable with their download.com service, I'm sure you know what I mean. Maybe I got mixed up with someone else, but I am sure they bundle a bunch of stuff for money in their "custom downloaders"...

edit: download.cnet.com now actually
...
Yes...they pretty much all do it..
One of my uBlock Filters -zant95/hosts contains the following...
#
# Badware
# Badware risks · gorhill/uBlock Wiki · GitHub
# Mind the PUP: Top download portals to avoid
# Yes, Every Freeware Download Site is Serving Crapware (Here’s the Proof)
#

# 01net
01net.com
www.01net.com

# Baixaki
baixaki.com.br
www.baixaki.com.br

# Chip
chip.de
www.chip.de

# Cnet
descargar.cnet.com
download.cnet.com
download.com

# FileHippo
filehippo.com
www.filehippo.com

# FileHorse
filehorse.com
www.filehorse.com

# Freeware Files
freewarefiles.com
www.freewarefiles.com

# Informer
software.informer.com

# MacUpdate
macupdate.com
www.macupdate.com

# MajorGeeks
majorgeeks.com
www.majorgeeks.com

# NoNags
nonags.com
www.nonags.com

# SnapFiles
snapfiles.com
www.snapfiles.com

# Soft32
soft32.com
www.soft32.com

# Softonic
softonic.com
www.softonic.com
softonic.net
www.softonic.net
sftcdn.net
v1es.sftcdn.net
v2es.sftcdn.net
v3es.sftcdn.net
va1es.sftcdn.net
va2es.sftcdn.net
va3es.sftcdn.net
v1en.sftcdn.net
v2en.sftcdn.net
v3en.sftcdn.net
va1en.sftcdn.net
va2en.sftcdn.net
va3en.sftcdn.net
v1fr.sftcdn.net
v2fr.sftcdn.net
v3fr.sftcdn.net
va1fr.sftcdn.net
va2fr.sftcdn.net
va3fr.sftcdn.net
v1de.sftcdn.net
v2de.sftcdn.net
v3de.sftcdn.net
va1de.sftcdn.net
va2de.sftcdn.net
va3de.sftcdn.net
v1it.sftcdn.net
v2it.sftcdn.net
v3it.sftcdn.net
va1it.sftcdn.net
va2it.sftcdn.net
va3it.sftcdn.net
v1br.sftcdn.net
v2br.sftcdn.net
v3br.sftcdn.net
va1br.sftcdn.net
va2br.sftcdn.net
va3br.sftcdn.net
v1pl.sftcdn.net
v2pl.sftcdn.net
v3pl.sftcdn.net
va1pl.sftcdn.net
va2pl.sftcdn.net
va3pl.sftcdn.net
v1nl.sftcdn.net
v2nl.sftcdn.net
v3nl.sftcdn.net
va1nl.sftcdn.net
va2nl.sftcdn.net
va3nl.sftcdn.net
v1jp.sftcdn.net
v2jp.sftcdn.net
v3jp.sftcdn.net
va1jp.sftcdn.net
va2jp.sftcdn.net
va3jp.sftcdn.net
v1tr.sftcdn.net
v2tr.sftcdn.net
v3tr.sftcdn.net
va1tr.sftcdn.net
va2tr.sftcdn.net
va3tr.sftcdn.net
v1ko.sftcdn.net
v2ko.sftcdn.net
v3ko.sftcdn.net
va1ko.sftcdn.net
va2ko.sftcdn.net
va3ko.sftcdn.net
v1sv.sftcdn.net
v2sv.sftcdn.net
v3sv.sftcdn.net
va1sv.sftcdn.net
va2sv.sftcdn.net
va3sv.sftcdn.net
minis.sftcdn.net
 

ElectricSheep

Level 14
Verified
Top Poster
Well-known
Aug 31, 2014
655
CNET are unbelievable with their download.com service, I'm sure you know what I mean. Maybe I got mixed up with someone else, but I am sure they bundle a bunch of stuff for money in their "custom downloaders"...

edit: download.cnet.com now actually

They're all at it! It's all just an excuse to make extra money. Sadly in this day and age companies don't care about the customers, they just want to squeeze every last penny out of them in any way they can!

Unchecky is a VERY useful program to avoid accidentally installing any unwanted bundles as they word the download screens so sneakily that if ypu mis-read or mis-interpret the exact meaning, you end up with a load of junkware you didn't want in the first place!!

You can find it here: Unchecky - Keeps your checkboxes clear
 
W

Wave

...
Yes...they pretty much all do it..
One of my uBlock Filters -zant95/hosts contains the following...
#
# Badware
# Badware risks · gorhill/uBlock Wiki · GitHub
# Mind the PUP: Top download portals to avoid
# Yes, Every Freeware Download Site is Serving Crapware (Here’s the Proof)
#

# 01net
01net.com
www.01net.com

# Baixaki
baixaki.com.br
www.baixaki.com.br

# Chip
chip.de
www.chip.de

# Cnet
descargar.cnet.com
download.cnet.com
download.com

# FileHippo
filehippo.com
www.filehippo.com

# FileHorse
filehorse.com
www.filehorse.com

# Freeware Files
freewarefiles.com
www.freewarefiles.com

# Informer
software.informer.com

# MacUpdate
macupdate.com
www.macupdate.com

# MajorGeeks
majorgeeks.com
www.majorgeeks.com

# NoNags
nonags.com
www.nonags.com

# SnapFiles
snapfiles.com
www.snapfiles.com

# Soft32
soft32.com
www.soft32.com

# Softonic
softonic.com
www.softonic.com
softonic.net
www.softonic.net
sftcdn.net
v1es.sftcdn.net
v2es.sftcdn.net
v3es.sftcdn.net
va1es.sftcdn.net
va2es.sftcdn.net
va3es.sftcdn.net
v1en.sftcdn.net
v2en.sftcdn.net
v3en.sftcdn.net
va1en.sftcdn.net
va2en.sftcdn.net
va3en.sftcdn.net
v1fr.sftcdn.net
v2fr.sftcdn.net
v3fr.sftcdn.net
va1fr.sftcdn.net
va2fr.sftcdn.net
va3fr.sftcdn.net
v1de.sftcdn.net
v2de.sftcdn.net
v3de.sftcdn.net
va1de.sftcdn.net
va2de.sftcdn.net
va3de.sftcdn.net
v1it.sftcdn.net
v2it.sftcdn.net
v3it.sftcdn.net
va1it.sftcdn.net
va2it.sftcdn.net
va3it.sftcdn.net
v1br.sftcdn.net
v2br.sftcdn.net
v3br.sftcdn.net
va1br.sftcdn.net
va2br.sftcdn.net
va3br.sftcdn.net
v1pl.sftcdn.net
v2pl.sftcdn.net
v3pl.sftcdn.net
va1pl.sftcdn.net
va2pl.sftcdn.net
va3pl.sftcdn.net
v1nl.sftcdn.net
v2nl.sftcdn.net
v3nl.sftcdn.net
va1nl.sftcdn.net
va2nl.sftcdn.net
va3nl.sftcdn.net
v1jp.sftcdn.net
v2jp.sftcdn.net
v3jp.sftcdn.net
va1jp.sftcdn.net
va2jp.sftcdn.net
va3jp.sftcdn.net
v1tr.sftcdn.net
v2tr.sftcdn.net
v3tr.sftcdn.net
va1tr.sftcdn.net
va2tr.sftcdn.net
va3tr.sftcdn.net
v1ko.sftcdn.net
v2ko.sftcdn.net
v3ko.sftcdn.net
va1ko.sftcdn.net
va2ko.sftcdn.net
va3ko.sftcdn.net
v1sv.sftcdn.net
v2sv.sftcdn.net
v3sv.sftcdn.net
va1sv.sftcdn.net
va2sv.sftcdn.net
va3sv.sftcdn.net
minis.sftcdn.net
They're all at it! It's all just an excuse to make extra money. Sadly in this day and age companies don't care about the customers, they just want to squeeze every last penny out of them in any way they can!

Unchecky is a VERY useful program to avoid accidentally installing any unwanted bundles as they word the download screens so sneakily that if ypu mis-read or mis-interpret the exact meaning, you end up with a load of junkware you didn't want in the first place!!

You can find it here: Unchecky - Keeps your checkboxes clear
Unchecky is a very fine piece of software which is excellent at helping you prevent the installation of bundled software accidentally (e.g. you forgot to uncheck a box which would grant permission to install bundled software or even missed it by accident - and in some cases if it isn't clear for the user to uncheck the option then it can make the practise illegal for the installation of that software (but that doesn't stop them!)). I personally recommend anyone to use Unchecky, especially if they are regularly installing new software.

Regarding these custom installers, these companies are pushing themselves past a line they shouldn't be crossing and it's been this way for a very long time now. They should respect the viewers of their websites/the downloaders on their sites and help them as opposed to irritating them further and causing a potential hassle for them. A very inexperienced person who is installing a piece of software (downloaded through one of these sites, like the CNET download website) who gets one of these custom installers might just go auto-pilot and accept everything without reading the options or terms & conditions properly, thus leading to bundled software they didn't want to authorise installation for being installed - either in the short or long run, this can be a pain in the ass for the customer... Instead of these custom installers having all the options checked by default, they should be unchecked.

In fact, the options for the bundled software should not even be present on the main installer interface where the customer has the option to continue. There should be an additional option which presents a popup window or animates into a new tab on the installer interface which presents options to available bundled software which is recommended by the vendor providing the custom installers, however these additional software options being bundled should all be unchecked (disabled) by default to prevent potential hassle for the customer. As for Terms and Conditions which states the installation of additional software can be installed, this should be eliminated as being legal (if there was no checkbox options but if it was only stated in the T&C), since it's such a risky and unfair practise (since not everyone reads these documents, not to the fullest at least).

Companies which provide bundled software within their downloaded installers should make sure that any software being bundled has a clean result on online scanners such as: VirusTotal; Metascan; VirSCAN. I acknowledge that there can be false positives however if there are any for the company trying to make a deal with another for their software being bundled, then they should deal with this by contacting the vendor/s flagging their software (themselves) and get the issue resolved. This would help prevent bundled software which is really containing malicious activity within it getting through as much and onto these installers (which would also affect the reputation of the service providing these installers in the first place - although it still wouldn't fully eliminate the issue as it can't fully be resolved due to how stealthy malware can be, especially when it comes to evasion of detection on virus scanners). Maybe as an additional precaution, dedicated analysts could perform manual analysis on the bundled software regularly (every 1-4 weeks) to make sure it's staying clean and no sign of malicious activity can be seen before it's allowed to stay bundled with the installers being provided (which would be a much stronger solution to the online muti-engine scanners). All bundled software should also be manually tested on a real machine (not a virtual machine - due to methods of altering behaviour depending on the environment) to make sure that the software can actually provide a useful function to the user (should they decide to allow it to be installed) (away from the malicious analysis testing).

As an extra security measure, if any bundled software has been authorised installation, before it actually becomes installed after the user clicks the accept/agree button, it should give a complete warning outlining clearly that bundled software will be installed (and the name of he software & the vendor/publisher of this bundled software, etc).

I think these requirements should be passed as a law for these "custom installers" (or any installers of any kind) to help push the advantage to the customer (especially for the favour of inexperienced/unknowledgeable users). The advantage should NOT be favoured towards the people trying to grab money through advertisements (generally speaking - including but not limited to bundled software within installers). Although I doubt this will ever happen and even if it did, I doubt it'd happen for multiple countries since laws depend on where you are (I'm sure there are existing law guidelines out there for software bundling but if so, they definitely need improvements and to be a bit stricter).

As we are all aware, browsers have a lot of built-in security when it comes to malicious websites/downloads protection (e.g. Chrome, Firefox, IE/Edge and many others). This is all nice and great and really does help protect people a bit better...

However, they also tend to have pop-up blockers and maybe even ad-blockers... Which is great too, but I've noticed that these definitely aren't as good as using third-party external extensions/software such as uBlock/Adguard. Maybe the tables should turn - maybe uBlock/Adguard should make some sort of deal with companies like Google to have their block lists being embedded within the browsers rule-sets for pop-ups/ads (on top of the existing list the vendors have for their browser features) to provide additional protection against pop-ups/ads by default (and of course a setting to remove these engines from the rulings via settings).

E.g. so you go onto Chrome settings and find a tab dedicated to ads/pop-ups where you can enable/disable usage of lists from uBlock/Adguard (like uBlock does on it's hosts settings where you can add more from other third-parties away from it's own lists).

This would really mess over people pushing advertisements/pop-ups a bit more because the people who don't bother getting extensions or software to prevent ads/popups would be better protected and thus stay less vulnerable to falling into the arms of having their browsing ruined by the look of all the ads/popups, which also helps prevent them becoming victims of malvertising (which is the practise of malicious ads being displayed - which can lead to malicious websites or even contain malicious code within itself which then becomes executed via the viewing of the host site, which can include but is not limited to "exploits" (e.g. attacking specific viewers based on location via IP address and then using a exploit depending on the browser being used) which can escalate to something like malware being silently downloaded in the background to the victims system).

Another idea for browsers is to contain built-in features to push the usage of protocols like HTTPS (like extensions like HTTPS Everywhere do) to help protect the customers data on websites which don't have it themselves - to prevent an attacker stealing credentials who is performing work related to "sniffing" on the internet traffic).

Apologies if I worded this all badly and someone misunderstands me, let me know if you don't understand me and I'll re-word it all.

The above are just some ideas I thought of on-the-spot and there are bound to be many flaws in the development of these ideas. That doesn't change the fact that I think that all these companies care about is money and nothing else & that they should treat customers better and be more respectful as opposed to trying to grab as much money in their pockets as possible and potentially messing over their customers who are a bit more lousy by pushing a ton of crap onto their systems (e.g. they forgot or missed a checkbox and now end up with a bunch of rubbish they don't want). Sometimes I wonder if companies pushing bundled software are intentionally trying to ruin their own reputation or not (their logic must be like this: "let's bundle some software for a big juicy check and leave the checkbox enabled and hope more people forget to uncheck it or even ignore it accidentally" & then they expect to be respected as a company and want everyone to be happy about it all... No).

I don't know about you, but these services pushing bundled software are really irritating me. I get that they may really need the extra revenue, but they could approach it all much more ethically than their current practises.
 

Logethica

Level 13
Thread author
Verified
Top Poster
Well-known
Jun 24, 2016
636
I agree with all that you have written @Wave ..
"maybe uBlock/Adguard should make some sort of deal with companies like Google to have their block lists being embedded within the browsers rule-sets for pop-ups/ads"
This is a good idea but I cannot see this ever happening for a number of reasons..
Many of the uBlock filters for example block "Google Analytics" "Googletagservices" and others..
In fact the uBlock experimental filters contain the following text..
# googletagservices.com not blocked by EasyPrivacy (I don't know why).
# This is a redirection-based filter being developed in order to be able
# to safely block `googletagservices.com` everywhere by default. ||googletagservices.com/tag/js/gpt.js$script,redirect=googletagservices.com/gpt.js,important
# www.google-analytics.com
# The goal is to be able to block `www.google-analytics.com` while preventing
# web page breakage.
# Replacement for `www.google-analytics.com/ga.js`
||google-analytics.com/ga.js$script,redirect=google-analytics.com/ga.js,important
# Replacement for `www.google-analytics.com/analytics.js`
||google-analytics.com/analytics.js$script,redirect=google-analytics.com/analytics.js,important


I cannot speak for Adguard and ABP, but I am pretty sure that Gorhill of uBlock Origin would never consider allowing the removal of such filters as they would compromise his principles...and Google certainly would not allow such filters through their own browser.This is without mentioning the filters that block Youtube ads.
The fact that 3rd party filters can be added means also that Facebook,Microsoft and many more would lose out.
I agree 100% with the sentiments that you propose...but I cannot visualise a "middle ground" that would allow it to happen.
 

DardiM

Level 26
Verified
Honorary Member
Top Poster
Malware Hunter
Well-known
May 14, 2016
1,597
It already occured, several years ago, that after unchecked all, it was trying to install all adware bundled with the main app :D :
as soon as MBAM in Real Time warned me for the first => directly stopped the installation and delete the bundle :p
 
W

Wave

It already occured, several years ago, that after unchecked all, it was trying to install all adware bundled with the main app :D :
as soon as MBAM in Real Time warned me for the first => directly stopped the installation and delete the bundle :p
:D :D :D Totally ridiculous... isn't it?

These download companies need to put a leash on their guidelines and make sure they are set out properly to put the customer in advantageous favour and not think about themselves all the time.
 

DardiM

Level 26
Verified
Honorary Member
Top Poster
Malware Hunter
Well-known
May 14, 2016
1,597
I already explained to some friends with bad behavior, how to WELL use search engines and choose the real company, by looking the entire url and the good domain name, not by looking only the first part of the URL.

=> download.cnet.com/skype/windows/ => "reapeat after me : BaaAD BaaAD BAD"
=> http://vlc-media-player.en.softonic.com/ => "reapeat after me : BaaAD BaaAD BAD"
=> http://www.skype.com/fr/ => => "reapeat after me : GooOD GoOoD GOOD"

I took this example because one of them downloaded Skype on a bad site, no adware seen by him (...), but a the end, was asking him to send a sms to finalize .... on a overtaxed phone number :D
 
Last edited:

About us

  • MalwareTips is a community-driven platform providing the latest information and resources on malware and cyber threats. Our team of experienced professionals and passionate volunteers work to keep the internet safe and secure. We provide accurate, up-to-date information and strive to build a strong and supportive community dedicated to cybersecurity.

User Menu

Follow us

Follow us on Facebook or Twitter to know first about the latest cybersecurity incidents and malware threats.

Top