 |
Someone Spying on You? Fight Back! Currently 25,860,543 Spy Software Busted! |
Anatomy of a Drive-By Install- Even on Firefox
by (Everything you wanted to know about drive-by's installs but were afraid to ask.) IntroductionFor the purpose of this test we visited the Spazbox.Net domain to perform a series of tests on what the user experiences at the domain. We specifically selected this domain because it exhibits stealth behavior of software installations. We specifically wanted to dissect these installations through the eyes of a user using one of any of the three most popular browsers including Internet Explorer with Service Pack 2, Firefox and Internet Explorer with Service Pack 1. We have elected not to test Netscape because SpywareWarrior.com has a complete write-up, with video. Note they do have a slightly different approach to their testing. Their write-up is is worthy of reading and understanding as it is directly related to this incident. It also covers separate issues with certain other vendors which we do not touch upon. Warning: We discourage people without a highly technically background to visit the domain in question. In other words- do not try this at home. All videos have been made by a professional technician on a closed-circuit course. :) PreparationEach installation and analysis was performed on a fresh machine. We deactivated any anti-virus or anti-spyware software on the machine. In addition we deactivated XBlock Enterprise perimeter defense product (our own proprietary product in beta testing) so that no programs would be stopped from installation or frozen from operating. We also removed our freeware ActiveX inoculation product. In the case of the Firefox installation we started with a virgin install of the Firefox browser. What The User SeesBehavior the use encounters will differ greatly depending on the browser used: Internet Explorer SP2
Mozilla Firefox
Internet Explorer SP1
Source Code AnalysisMain pageWe are examining the source of the default homepage of spazbox.net. The page is devoid of any real content (technically it is not even correct HTML), and only contains this code: <!-- AUTO PROMPT START --> These are 3 different calls to external Javascript files. We shall examine each Javascript individually. Javascript Number 1URL: http://static.windupdates.com/prompts/a072a874/a577a9.js (Cached copy of the script) This domain is owned by CDT Inc, which is now owned by 180solutions after a recent acquisition of CDT. One page on it has a special note on the EULA mentioning 180solutions and other partners. Side Note on Windupdates License Agreement: During IE SP1 installs and java installs users are never presented with a EULA or license agreement. However in the case of an install on IE with SP2 (see video) users will see the agreement AFTER the installation of the software and not before. Users should take special note of Section 15 of the EULA. In this section of the agreement the user cannot participate in a class action suit, but must abide by the AAA. The user also agrees to pay for all direct or indirect costs arising out of the claim including legal costs, transportation, accommodations, and telephone calls. In addition you must pay CDT (now owned by 180solutions) $300 per hour to attend the arbitration including transport time. The cost of arbitration would clearly be far beyond the resources of the average citizen. Quote from the CDT EULA 15. ARBITRATION. Any claim or controversy arising out of or related to this Agreement, or the products or services we provide and/or distribute shall be settled by binding arbitration in accordance with the rules of the American Arbitration Association. Any such claim or controversy shall be arbitrated on an individual basis and shall not be consolidated with a claim of any other party. You agree to pay any/all direct and/or indirect costs arising out or related to the claim and/or controversy, including but not limited to legal costs, transportation, accommodation, telephone calls. You also agree to pay CDT $300 per hour to attend arbitration including transport time. The foregoing shall not preclude CDT from seeking any injunctive relief for protection of CDT's intellectual property rights. Analysis
|
|||
 |
 |
MarketLeap is a free tool that allows users to gauge estimates of page saturation and link popularity by automating and aggregating queries across multiple search engines. In this case analysis shows Spazbot.net garnering no appreciable search engine saturation (number of pages found in a search engine) across any major search engine. This is strange as most legitimate sites have at least their home page indexed, unless, of course, the site has been penalized by various search engines under their own rules.
More importantly MarketLeap analysis shows no in-bound or incoming links with the exception of one link coming from MSN in the form of an Arabic Message board.
Important Question:
While this domain appears isolated with virtually no links
in from any significant search engine, and no page saturation in any search
engine it is paradoxical to the Alexa data that shows transient, yet significant
traffic spikes throughout the year. In short where are the visitors coming from
if they are not coming from the Web? Could traffic be originating from. IRC,
SPIM, Word of Mouth, or another source unknown? There is the remote possibility
the domain owner could be using U.C.E. to attract visitors but scanning across
known repositories of spam operations and USENET abuse reports show no such
activity so this has been ruled out.
Obviously the only way to accurately verify traffic would be access to the machine's server logs which are not made public.
Important Questions To Be Asked
- How can SpazBox.net enter into an affiliate agreement to become a multi-toolbar distributor using a domain with zero content to prove site intent or purpose? More specifically what were the vetting procedures used to select this site as a distribution partner?
- During the install on the SP2 video are the labeling of xxxtoolbar, CDT and SearchMiracle installations appropriate, accurate and giving enough information for the average user to understand what they are receiving?
- During the IE Service Pack1 install, the user receives no prompts, no EULA, or license agreement whatsoever. Does this behavior violate any deceptive advertising practices or laws? How can a user be bound by an agreement they are not presented?
- Why does CDT generate javascript code in an encrypted format designed to make analysis difficult and non-transparent?
- Since certain distributors claim to verify traffic and scrutinize their affiliate partners with great diligence it is important to note that while the affiliate site shows suspicious traffic patterns, the affiliate site is merely cutting and pasting in standard links from distribution partners. Is the affiliate breaking any of the distributor's TOS?
- Why do Service Pack 2 users (and only those) see an elaborate movie explaining to them how to accept the installation without any reference to what is being installed, why it is being installed, or from where it is being installed. The only information they receive from the movie, aside from install instructions, is a sign that says THEY MUST INSTALL it.
- Why are some browser users entitled to less information than other browser users? For example users with IE Service Pack 1 receive no information and only a blank page, while users with Service Pack 2 receive an instructional flash movie on how to install something.
- Since the affiliate receives compensation per download, why would companies enter into agreements where affiliates can put forth so many programs that a machine’s performance is seriously compromised to the point to where one of our test machine’s required extensive repair as Windows would no longer function properly. If the goal for adware makers is to make money- they why enter into agreements with affiliates that overload machines? This seems to fly into the face of standard performance marketing best practices.
Who to Blame for this Situation- The Facts
Before making any decisions, let us have a look at what (according to our analysis) each actor did:
SpazBox.net (The Affiliate)
- Signed up for various affiliate programs. Source of sign-up or affiliate system undetermined and may be governed by different agreements.
- Cut and pasted standard code from the affiliate program or broker into the empty web page
- Posted Web Page online.
- Directed traffic to the web page through methods unknown and undiscernable at this time.
"Software Makers" (The Distributors)
- Either accepted the affiliate into their program or worked with a broker or sub-broker who accepted the affiliate agreement on that person's behalf
- Provided linking code to this affiliate or as the case may be a deal broker. However we tend to rule out the possibility of the broker arrangement since the linking code appears to use the same static affiliate ID that points directly to the software program distributors domains. This linking code is provided for accurate means in which to calculate compensation.
- The Software Makers Host ALL content used in this scenario including the code signed CAB files, Java packages, and XPI files (for Netscape or Firefox users) and all the javascript seen in action during this scenario.
- Through javascript analysis it can be concluded they implemented routines to install software on or through all major browser platforms.
- Selected wording and graphics to be shown (or not shown) to the user upon, during and before installation.
- In one case a Distributor, "Windupdates", obfuscated their javascript through encryption technology.
- Distributors appear to log all installations of their various software programs including the referral URL and affiliate ID.
- In general served lists of ads to display and keywords to match on to the installed software components.
XBlock's Conclusion
Based on the evidence gathered Spazbox.net did not demonstrate any special technical skills or trickery on the index page of domain based on the code shown above. It appears the owner merely copied and pasted pre-made javascript code that was generated or given to him by the distributor. The only element in his behavior that is unclear is how traffic is being generated to this site in order to drive installations.
It is in our opinion that the software distributors are responsible for any and all behavior that we have documented in the packet logs, screen captures and movies above. The SpazBox.net affiliate had no control over the behavior of the programs or the javascripts as they were executed unless the Distributor allowed him to make modifications but again this is putting the responsibility on behalf of the Disitributor(s).
This article is copyright 2005 by XBlock.com.
It may not be reprinted or copied without the express written consent of the author.
| © Copyright 2003-2011, Actiance, Inc. All rights reserved. Privacy Policy |