Hacker News new | ask | show | jobs
by Matt_Cutts 4128 days ago
Can you talk a little more about the players and the landscape? Do you live in Download Valley?
3 comments

Another ex-adware person here, from the download valley itself.

AFAIK, the key roles in the adware ecosystem are:

a. Distribution

Done mainly through "Pey Per Install" companies such as IronSource, InstallMontizer (actually funded by YC: https://news.ycombinator.com/item?id=5092711), InstallRex, etc. These folks bundle legitimate programs with adware in their installers. They use dark patterns (http://www.hanselman.com/blog/DownloadWrappersAndUnwantedSof...) in order to deceive users to install the offered "product". Some of them make it intentionally hard (practically impossible for the non-techie user) to uninstall the adware, or downloading additional adware without user consent (drive-by). Other shady practices include the use of malvertising (e.g. ad that mimic flash, acrobat or OS update) and the most extreme one, which is rare but exists, is exploit kits.

b. Monetization

Done mainly with advertising and information harvesting. Common practices (aka "revenue models"): ad injection (banners, pop-up\under, etc), affiliate fraud ("price comparison widgets", or just forcefully redirect user through affiliate link) , lead generation (e.g. scraping insurance details), social networks spam (Selling views, likes, followers, etc - works because google\fb\etc eliminates fake bot account fairly efficiently, but adware just impersonate real authenticated sessions) and selling cheap traffic.

I can't edit the original comment for some reason. Sorry for the n00bism, its my first comment here on HN.

I want to add this: The profit of an adware company is the difference between its user acquisition cost and the revenue from the monetization phase. As the monetization phase gets shortened by AV detection and removal, the lower the revenue gets. This cause adware vendor to adapt new methods that transitionally were associated with "more evil" malware (banking trojans): they use crypters and vulnerabilities in AVs in order to evade detection, randomly generated domain names (for the C&C, inject and publishing domains), etc.

Feel free to AMA

Matt, if you want to learn more about practices and players of Download Valley, you can simply talk to the local Google sales/marketing representatives, who are working VERY closely with these companies. I believe they are definitely aware of all the practices and the dark patterns.
Hey Matt -

Adwarekiller gave a good answer, and I'll add some of my own notes.

* Distribution is mostly consolidating. A lot of adware companies used to both buy their own distribution through either pay per install or revenue share agreements and then monetize those users themselves. Now, the ecosystem is fracturing into companies that actually perform the distribution and companies that monetize those users.

* Large distribution companies: - IronSource (this article) - InstallMonetizer (YC funded as adwarekiller mentioned) - Web Pick Internet Holdings (InstallRex as adwarekiller referenced them) http://www.web-pick.com/ - Cross Rider https://crossrider.com/ - Ad Peak http://adpeak.com/ - Conduit & Perion http://conduit.com/ & http://www.perion.com/

* Large monetization companies: - Future Ads & Traffic Vance for banners and pop ups https://www.futureads.com/ & https://www.trafficvance.com/ - Lead Impact for pop ups http://leadimpact.com/ - Advertising.com for banners and text ads (yes, an AOL company powers a lot of adware) https://www.advertising.com/ - Ad Peak http://adpeak.com/ for banners, text ads, pop ups, and ecommerce (like Superfish) (they seem to do a lot of both distribution and monetization) - 50onRed (as adwarekiller mentioned) for banners, text ads, pop ups, and ecommerce http://50onred.com - Superfish for ecommerce http://superfish.com - AdOn for text ads, pop ups, and email http://www.adonnetwork.com/

Both Yahoo and Google are in bed with the adware companies via search reset deals and white labeled SERP pages.

There are a lot more companies in the ecosystem. It's massive. A good rule of thumb right now is that if a company advertisers they have cut a deal with an adware company (either directly or indirectly). As you can see from the above list, there is also A LOT of VC money in the ecosystem. The reach extends further when you consider companies that get benefit, like CPXi (http://www.cpxi.com/), AppNexus (http://www.appnexus.com/), OpenX (http://openx.com), or even Amazon Web Services, Google Apps, etc. since these services usually power the business, too.

http://www.benedelman.org/ is a good source to learn more.

Here is a breakdown of IronSource's install tactics: http://www.benedelman.org/news/021815-1.html

If you'd like to talk more, let me know.

Great answer. I can confirm that the market is indeed specializing through separation of the distribution and monetization operations.

More interesting bytes:

* Ad injection mentioned in the last ANA&WhiteOps fraud report (http://www.ana.net/content/show/id/botfraud), they found that over 500K ads were injected every day to one publisher.

* Research on in-webstore extensions (https://www.usenix.org/system/files/conference/usenixsecurit... used dynamic analysis system called "Hulk" to detect malicious extensions. Summary of the results:

Analysis result Count Malicious 130 Suspicious 4,712 Benign 43,490 Total 48,332

Detection class Count [s] Injects dynamic JavaScript 2,672 [s] Produces HTTP 4xx errors 2,322 [s] Evals with input >128 chars 451 [m] Prevents extension uninstall 56 [m] Steals password from form 39 [s] Requests to non-existent domain 26 [m] Keylogging functionality 23 [m] Injects security-related HTTP header 11 [m] Steals email address from form 10 [m] Uninstalls extensions 8

c. Another paper (https://www.usenix.org/legacy/event/collsec10/tech/full_pape... from the EPFL calculates the potential revenue of an adversary as a function of adversary power to modify ads traffic (http://i.imgur.com/ut2jjQl.png).

d. There is also companies like rgnets (http://rgnets.com/), amobee (http://www.amobee.com/) and FrontPorch (http://www.frontporch.com/), which offers network appliance that performs the HTTP interception and tampering. In this method there is no need to install anything on the user, all you need him to do is connect your network. Large public networks (hotles, events, airports, etc) are using it as well as some ISPs.

Sorry for the formatting, but the edit functionality doesn't work.