Costly freeware: a systematic analysis of abuse in download portals

Abstract

Freeware is proprietary software that can be used free of charge. A popular vector for distributing freeware are download portals, i.e., websites that index, categorize, and host programs. Download portals can be abused to distribute potentially unwanted programs (PUP) and malware. The abuse can be due to PUP and malware authors uploading their ware, by benign freeware authors joining as affiliate publishers of PPI services and other affiliate programs, or by malicious download portal owners. In this work, we perform a systematic study of abuse in download portals. We build a platform to crawl download portals and apply it to download 191K Windows freeware installers from 20 download portals. We analyze the collected installers and execute them in a sandbox to monitor their installation. We measure an overall ratio of PUP and malware between 8% (conservative estimate) and 26% (lax estimate). In 18 of the 20 download portals examined the amount of PUP and malware is below 9%. But, we also find two download portals exclusively used to distribute PPI downloaders. Finally, we detail different abusive behaviors that authors of undesirable programs use to distribute their programs through download portals.

A Review of “On Challenges in Verifying Trusted Executable Files in Memory Forensics”

“…Although the use of digital signatures in malware is not a growing trend [6], [7], there are documented cases of signed malware samples in the wild (such as Stuxnet [8], Duqu, or Flame, to name a few). Malware developers use trusted certificates that were either compromised or issued directly to them to sign their software.…”

How Did That Get In My Phone? Unwanted App Distribution on Android Devices

“…In comparison, our work measures malware distribution via multiple channels like the Play market store, alternative markets, browsers, IM, and PPI services. Prior work has analyzed Windows malware distribution through underground pay-per-install services [23], drive-by downloads [38], [58], free streaming services [59], and download portals [35], [60]. Results from these studies do not necessarily extrapolate on Android due to inherent platform differences.…”

A Systematic Empirical Analysis of Unwanted Software Abuse, Prevalence, Distribution, and Economics

“…Geniola et al [27] collected 800 installers of promoted applications from 8 download portals, executed them in a sandbox, and found that 1.3% of those installers drop well-known PUP to the system. Rivera et al [26] measured the amount of abuse in download portals. They analyzed all Windows programs offered by 20 download portals and reported an overall ratio of PUP and malware between 8% and 26%.…”

“…Download portals are websites that index, categorize, and host programs. Prior work from security vendors [23][24][25] and academic researchers [26,27] have studied the abuse of download portals by PUP and malware. A commercial PPI service acts as an intermediary between advertisers, who want to distribute their programs, and affiliates, who own programs (typically freeware) that users want to install.…”