Unraveling the Financial Web

While the definition of malicious software seems clear, that of Potentially Unwanted Programs (PUPs ) is less so.

The first come under the generic title of malware. They are used to steal or destroy information. Even when distributed via games, they can damage the computer system and can often remain resident without authorization. Malware is mainly created to cause harm to the target computer. Authors of malware expect to gain notoriety, or more and more often, illicit income.PUPs on the other hand are usually made by legitimate corporate entities for specific beneficial purposes (to whom they may be beneficial is debatable).

Adwares belong to this category of programs. They install themselves on the user’s machine collecting marketing data and distributing targeted advertising intended to generate income. Their legitimacy becomes debatable when they alter the security state of the computer on which they are installed, or the privacy posture of the user using the computer.

Between 2000 and 2002 there were only about forty or so adware families. Their number rose sharply in the next years. It increased by more than 1000% in three and a half years. In August 2006 there were more than 450 adware families with more than 4000 variants.

I just finished a white paper describing the main participants in the on-line marketing domain. This document explains the concept of affiliators and affiliates and the recognition techniques used to install the payment systems. It analyzes the amounts which affiliates can expect to be paid depending on whether they use “soft” or aggressive methods. The firsts use conventional techniques (pay-per-display, per-click or per-profile). They can expect to receive a payment of $25 for every 1000 positive occurrences produced. On the same basis, an adware pay-per-install payment may bring in up to $150 for 1000 computers.

Following the money, this white paper demonstrates why many low-level delinquents do not hesitate to distribute these programs on a large scale using reprehensible methods.

Now, some “cyber-delinquents” quickly and secretly install thousands of programs each day on target computers without the knowledge of their owners. They are thus able to pocket some tens of thousands of dollars each month.The complete study is available here:

Adware and Spyware: Unraveling the Financial Web