The not so cute PUPs…

Posted on March 1, 2015 by BITS

Most people know and adore pups like these:

The not so cute PUPs are Potentially Unwanted Programs that may come preloaded on your brand new computers, or installed alongside of programs that you add later. Just how prevalent these PUPs are? For example, 62% of the top 50 download @download(dot)com website includes PUPs.

So, what are these PUPs why are they pushed to you? They can be anything, such as adware, browser toolbars, homepage hijackers, nagging scare-ware, etc.

Adware is pretty much self explanatory; it’ll monitor your internet access and pops up ads related to you activities. While the popup ad can be annoying, like during your power point presentation (ugh!), this puppy will also collects your personal information and sends it “home”.

Browser toolbars install themselves into your browser to make your internet “browsing easier”. In exchange, this puppy will collect and send your personal information “home”, may popup ads, or redirects your search results to its paying customers’ websites based on your internet activities.

The homepage hijacker changes your current home page and acts as the browser toolbar afterward.

Nagging scare-ware is the trial version of security software. This software promises to clean up and secure your computer. The trial version will allow scanning your system, presents a scary results, but it does not allow you to fix them until you actually purchase a licensed version. The scary results have nothing to do with the state of your computer, they are auto-generated by the software to entice you to purchase the program. This puppy may have any of the other puppies integrated that will install as well.

Ok… They are not breaking my computer, so what’s the harm?

Other than changing the behavior and performance of your computer, they also collects information about you. This information can be extensive and correlated to offline data to tailor the popup ads to you and redirect your search result based on this information. The collected information about you also sold/traded to data brokers.

Ok… But I have nothing to hide and they probably have everything about me anyway.

That’s seemingly a fair point, but… Your computer performance will degrade and your search result isn’t what you are looking for. Some people like popup ads and that’s fine, can’t argue with that. How you view your privacy is also a personal preference.

Except that data brokers want current information about the person, since that is what valuable for them. Old data is pretty much useless as far as popping up ads is concerned. They are more than willing to pay for it and that is the main reason why these PUPs exist. If you don’t mind being a product created by these PUPs, there’s one more thing you should consider.

Malicious malware had started to utilize these PUPs to do their dirty work for them. They tie into these programs to collect your information, redirect your browser to download their malware and take over the control of your computer. Once they do, they will make you pay a ransom to have your computer back. You don’t have to believe me, just read this blog from Malwarebytes.

So, what can I do about these PUPs?

Prevention is the best proactive measure that you can take for PUPs free computer. Pay attention to the installation routine of the program that you want. Most of the PUPs are included as a recommended “additional program” that is selected by default to be installed. In most cases, you can deselect the recommended program and it won’t be installed. The more aggressive installation routines don’t allow you to deselect the PUP and some of them installs it hidden from you.

Ok, what do I do then?

Once you settled down and stopped swearing, my recommendation is installing programs that removes PUPs. There are two of them on my computers that used on a weekly basis:

No, they do not install PUPs, don’t be silly, and they are free…

Preferably, download and install both of them, update the engine if needed to, and run them one by one. While they are very good at removing PUPs, each software has its limitation. Just do it at least once and you’ll see how many PUPs you had on your computer. You can select to keep them, if you don’t mind the privacy and security risk that these PUPs pose to your computer, or delete them. You should also run these anti-malware programs on a weekly basis, if you want to have a PUPs free computer.

The cost of malvertisement…

Posted on February 8, 2015 by BITS

In the previous blog, we’ve looked at how malvertisement may affect you and what you can do to protect your system(s) against this threat vector. In today’s blog, we’ll look at the actual distribution channels and the cost for displaying malvertisement.

Beyond the advertisement shown in your browser, there’s a well established business model that isn’t that much different from any other business models.

The picture on the left shows the typical business model. Basically the products are created (including malvertisement), sold to distributers, who in return make them available to consumers.

The difference is how other distribution channels are regulated and the requirements are enforced by various government agencies. You’d had hard time in the U.S. purchasing food at your supermarket, without FDA approval, buy a car without NHTSA approval, etc.

Unfortunately, the online advertisements are loosely regulated, with minimal, or no enforcement whatsoever. There’s no need for approval by the website or the advertisement network. They will pretty much blindly refer your browser to the site, where the actual ad is hosted. The actual site could be hacked websites, hosted servers, etc.

Hackers had discovered that they can just bid to display their ads at various sites. Since anyone can bid to display their ads, including the maximum price per displaying the ad, this is an easy way to have the malware distributed by reputable websites. The hackers’ malware incorporated in an ad (we call malvertisement), they bid to display their ad at targeted websites, and the advertiser network kicks in. When you visit the targeted websites, the ad becomes part of the website’s content, any script in the ad executed by your browser without you clicking on it. You probably recall a few websites that had some music and/or video already playing just by visiting their home page. This is the type of ad delivery that hackers use to load malware on to your system.

The process described is automated to the level that the chances are no humans evaluate the actual ad during this process. As such, malware is distributed without any warning. The sole exception might be your system protection that should stop the malware execution.

So, what is the actual cost for the hackers to display their ads? That depends on the website, where the ads are displayed. Malwarebytes blog states $0.927 per displayed ad with current malvertisement at the following websites:

dailymotion.com
theblaze.com
nydailynews.com
tagged.com
webmail.earthlink.net
mail.twc.com
my.juno.com

Why neither the advertisement network, nor the websites are responsible for delivering malware in the ad, is beyond me. Holding the hackers responsible for the ad, but taking their money nonetheless, should be illegal.

Since your system protection should stop the malware, it raises a question. Why don’t the advertisement companies and websites test the ad for malware, prior to presenting it to the end users? It’s really not that hard to do:

Advertiser receives the bid for the ad
Client sends the ad to the advertiser
Advertiser scans the ad for malware
Advertiser approves the ad, if no malware found, and hosts it on their server
Websites receive the ad from the advertiser, if they opt into their program

It’s harder to test the ad for malware by the website, but not impossible; real-time scanning for malware had been in existence for decades. The chances are that implementing such system would offset some or large part of the financial gains of displaying ads..

If security software on the client side can stop the malware, there should be no reason why advertisers and websites cannot scan the ad for malware. Samples of security programs that can stop 0-day malware:

There are certainly other security solutions that can stop 0-day malware, but antivirus isn’t one of them. The samples above are part of the security protection for my systems.

It’s unlikely that either the regulation or the advertisement distribution online will change anytime soon. There’s too much money to be made in the current ad delivery schema. As such, your favored website(s) might be serving up malware to your system that may just gobble them up. You should protect your system against them and by now, you should know that antivirus will not protect you.

Friends, don’t let friends rely on antivirus protection only…

Malvertising at the watering hole…

Posted on October 27, 2014 by BITS

The basic definition of malvertisement is:

infected online advertisement.

The legitimate website is supporting its operation cost by displaying adds from advertisement clearing houses. The actual add is downloaded in the background by your browser and the content of it is loaded, usually on the right side of the main content, but can be anywhere, including popping up the ad.

The ads can be useful for some people, but mainly annoying to others. It’s a business model where you receive “free” content and the website in question earns money to operate the site. You don’t necessarily need to click on the link in the ad to generate income for the website, just displaying the ad earns income for the website. The size of the income does increase, if and when the visitor clicks on the ad.

So, what’s wrong with this business model? The short answer is… nothing. The long answer…

The advertisement clearing houses collects potential clients, pretty much in discriminatively since their income depends on clients advertising products. Clearing houses also sell the client advertisement to other clearing houses, in addition to advertising companies selling it to these clearing houses. The cross selling is mainly due to the clearing house clients, some have more than others and in targeted advertisement it is important which website(s) will display the ad(s). As such, by the time the advertisement makes its way to the website, the actual ad could be originating from US, Europe, Asia, etc., and may have been going through 6-10 online advertisement companies.

The problem is that neither of the companies, including the website where it’s displayed, check the content of the advertisement for malware. As such, hackers love this venue for distributing their malware. They can create their ad, including malware, that may mimic legitimate products, and purchase advertisement time at the targeted website through the advertisement clearing house network. While the link is in their ad, you don’t need to click on the link to have the malware executed. It will load in the background as the website in question loads and in five minutes flat, your system is compromised.

So, what can you do against malvertisement based attacks? After all, like most people, you cannot give up visiting favored sites…

Notifying the website in question doesn’t do much good, especially after your system had been infected by the malware. The best a notification can achieve is that the malvertisment will be removed from the website, that will prevent other people getting their systems infected. Hackers will just purchase ad time with different fake brand name, may use the same malware, or create a new one.

Antivirus isn’t provide much of a protection against malware in advertisement, since the malware utilized isn’t know as of yet. Once it is known and blocked by antivirus, the hackers will create a new malware, and the perpetual cycle of unknown to known malware begins…

So, does that mean that there isn’t really much one can do, other than not using the internet? No, not really….

Let’s look at how the malware works in the malvertisement. The “payload” in the malware exploits known vulnerabilities in different applications. Different, as in most malware will try exploiting 3-4 different but vulnerable applications. Here’s a list of vulnerabilities that had been exploited in a recent malvertisement:

CVE-2013-2551 (Internet Explorer)
CVE-2014-0322 (Internet Explorer)
CVE-2010-0188 (Adobe PDF Reader)
CVE-2013-2460 (Java)
CVE-2014-0497 (Flash)

The underscored first four digit in the CVE numbers indicates the year the vulnerability had been discovered, while the second four digit is a serial number for the vulnerability for all applications, operating systems, etc., in the given year.

The list above is a mixture of old and new vulnerabilities where the malware will try exploiting the applications. Once the exploit had been fully executed, the malware will stop processing the rest of the vulnerabilities. The order of list arbitrary in this blog, it does not indicate the actual order how the malware will process them.

So, what does this information tell you?

I can just hear you say, “I know, I know!”, and you are correct. Keeping your system and applications up to date will prevent most of the malvertisement or malware exploiting your system. Just keep doing it and you should be much better off than most people who do not…