Spyware Floods In Through BitTorrent

[54/102 CEF]

Some of you may have seen the website http://militaryvideos.net/ -- the site is excellent and provides a great service with great software called Bit Torrent - I sent them a donation and its great - I guess I must like it? 

BUT! I cam across this story on what unscrupulous web pirates can do with the software and thought it may be of interest to you.

In brief - it suggests the user could be vulnerable to spyware if they use Bit Torrent

I think a work around is reject all cookies from websites or downloads as part of the solution

Anyway - on with the story

Spyware Floods In Through BitTorrent  http://www.eweek.com/article2/0,1759,1828633,00.asp?kc=ewnws061605dtx1k0000599
June 15, 2005

By  Ryan Naraine

BitTorrent, the beloved file-sharing client and protocol that provides a way around bandwidth bottlenecks, has become the newest distribution vehicle for adware/spyware bundles.
Public peer-to-peer networks have always been associated with adware program distributions, but BitTorrent, the program created by Bram Cohen to offer a new approach to sharing digital files, has managed to avoid the stigma. ADVERTISEMENT
Not any more, anti-spyware advocates warn.

According to Chris Boyd, a renowned security researcher who runs the VitalSecurity.org nonprofit resource center, the warm and fuzzy world of BitTorrent has been invaded by a massive software distribution campaign linked to New York-based adware purveyor Direct Revenue LLC.

"This is the marketing campaign to end all marketing campaigns," said Boyd, the Microsoft Security MVP (most valuable professional) known throughout the security industry by the "Paperghost" moniker.

To read about spyware threats associated with file-sharing program Kazaa, click here.

In an e-mail interview with Ziff Davis Internet News, Boyd said rogue files have popped up occasionally in BitTorrent land but those were usually just random executables. "This is the first time I've seen a definite money-making campaign with affiliates, distributors and some pretty heavy-duty adware names," he added.

Boyd, widely known for chronicling spyware, hacking and malware exploits, has published details of the BitTorrent distributions and identified Direct Revenue and Marketing Metrix Group as the companies responsible for the rigged files.
Boyd said he got the first inkling that BitTorrent was a major adware distribution vehicle while searching for the source of Direct Revenue's Aurora, an adware program that includes the prevalent "nail.exe" component. Sifting through mountains of HijackThis logs posted on security forums, Boyd said the answer was staring him in the face. (HijackThis is a popular freeware spyware removal tool that keeps detailed logs of Windows PC scans).

In the logs, he found that "nail.exe" and "aurora.exe" were always listed alongside "btdownloadgui.exe," the user interface that downloads/uploads when using BitTorrent.

"I checked hundreds of those logs, and more often than not, [btdownloadgui.exe] was chugging away in the background. No wonder none of the victims (or spyware experts) seemed to know what site Aurora was coming fromâ ”there was no site. It would have never occurred to the end users that it could have crept in by another means altogether," he said.

Because BitTorrent strips digital files into tiny shreds and reassembles them locally once a user completes a download, it has emerged as the perfect place to bundle adware programs among the bits, without the end user ever knowing.

A BitTorrent user downloading a movie clip only becomes aware of the associated adware after the files are reassembled. At that stage, when the user attempts to load the reassembled file, he or she is greeted by an installation notice for an adware bundle distributed by MMG (Marketing Metrix Group), a Canadian company that specializes in P2P network marketing.

Officials from MMG did not respond to queries for comment. On its Web site, the company lists BitTorrent as a lucrative adware distribution vehicle. "Although Bit Torrent is a file format and not a P2P Network ... [it] is the fastest growing protocol for file sharing online. Many top Bit Torrent sites such as SuprNova, Lokitorren and Bit Tower support millions of downloads daily," said MMG, which lists PartyPoker.com and Hotbar.com among other clients on its roster.

Boyd said his interest in Aurora increased because it "is absolutely everywhere at the moment, though no one could work out where the infections were coming from."

"I had heard rumors that there was 'something' in peer-to-peer land, but I didn't expect it to be on the BitTorrent network, and finding these files has been surprisingly difficult," he added.

Boyd said BitTorrent was currently "overwhelmed" with multimedia files rigged with adware bundles, adding that the file sizes vary from 3MB to 175MB.

"I expect we'll see more of this, and if the first ever 1GB malware/adware install has a chance of happening anywhere, it will be on file-sharing networks where programs are broken up into pieces. The problem is, you never know what's going to come out the other side," he said.

Direct Revenue admitted to using MMG to push Aurora distributions via BitTorrent, but insisted that the actual adware installation was done with adequate and up-front disclosure.

In an interview, Direct Revenue chief technology officer Daniel Doman said MMG is "one of many affiliates" used to distribute Aurora. "They [MMG] specialize in doing content distribution on peer-to-peer channels, and we think they provide an easy mechanism for people like us who want to monetize software or content."

Doman, a former director of engineering at DoubleClick Inc., said the increased visibility of Aurora and the "nail.exe" component was not the result of new installations, pointing out that Direct Revenue is auto-updating its file-naming convention to address criticisms that the adware program was hidden on purpose.

"We just recently launched a full awareness and campaign to the entire user base, and the fact that those files are showing up in logs shows that we're having success," he said. The campaign, announced on May 17, includes the placement of an uninstall facility within the add/remove panel on Windows for PCs that points users to the previously hard-to-find MyPCTuneUp Web site for adware program removal.

"We've taken pains to brand all of our windows so that the source and prominence of the advertising we serve are extremely clear," Doman said. So far, about 90 percent of Direct Revenue's user base has received the branding updates, which happen without any user action.

Direct Revenue has been heavily criticized for forcing users to visit the MyPCTuneUp site to complete the program removal, but Doman defended that strategy, insisting the Web-based uninstall utility is the most efficient way to make sure the removal is properly done.

He said the company was seeing increased traffic to the site since the launch of the campaign, adding that the daily uninstall count was "in the thousands."

Even so, he said, the thousands of daily uninstalls represent only a fraction of a percentage of the entire user count and are not materially affecting Direct Revenue's business.

Doman described Boyd's posts on VitalSecurity.org as "misleading" and pointed out that the screenshots provided by the researcher "clearly show full disclosure" before the Aurora program is installed.

He acknowledged that a "grey area" exists in the timing of the disclosure, but insisted that it was done in full compliance with existing laws. "We require all our distributors to fully inform end users about what is being installed. It's a clear opt-in procedure," he said.

"The user is downloading something through BitTorrent that is ad-supported and [Boyd's screenshot] shows the disclosure that is provided. The idea that somehow the download is surreptitious is wrong. It's very apparent that if the BitTorrent user goes through with the MMG download, they agree to install the ad-supported software."

Doman added: "The notion that the user has accidentally found all this software on his machine is false. [MMG] is using a 'pull' technology. Nothing is being snuck in the back door."

Check out eWEEK.com's Security Center for the latest security news, reviews and analysis. And for insights on security coverage around the Web, take a look at eWEEK.com Security Center Editor Larry Seltzer's Weblog.

 

[48Highlander]

uh, FYI, it's impossible to insert adware into multimedia files.  Or any executable for that matter.  This article is junk, and it's quite clear that the authors understanding of computer software is mediocre at best.

"I expect we'll see more of this, and if the first ever 1GB malware/adware install has a chance of happening anywhere, it will be on file-sharing networks where programs are broken up into pieces. The problem is, you never know what's going to come out the other side,"

That single quote is...well, the word "idiotic" comes to mind.  Someone's going to sneak a 1 gigabyte piece of executable code into your 0.005 gigabyte download of winamp.  right.

 

[Bruce Monkhouse]

Impossible is a word that has been used for years about things that actually happened not too far in the future, my brother in law does security work for Nortel and like he said " there's a lot more money in breaking something than making something" or words to that effect..............hey, we were drinking....

 

[48Highlander]

Impossible is a word that has been used for years about things that actually happened not too far in the future, my brother in law does security work for Nortel and like he said " there's a lot more money in breaking something than making something" or words to that effect..............hey, we were drinking....

Impossible is also a word used for things that continue to be impossible.

Let me put it this way - multimedia files are read, not executed.  The idea that executable code could be inserted into, say, an mp3 file, makes about as much since as saying that the same executable code could be inserted into a book.  Sure, it's possible, but what's the point?  So you go to the library, pick up a copy of "the hitchikers guide to the galaxy", and start reading.  As you get to page 93, you find that someone has shoved 10 pages of computer code between it and page 94.  Worse thing that'll happen is you'll spend a few minutes trying to read the code.  You're certainly not going to magicaly infect your computer with it.

 

[Korus]

uh, FYI, it's impossible to insert adware into multimedia files.  Or any executable for that matter.  This article is junk, and it's quite clear that the authors understanding of computer software is mediocre at best.

Uhm.. It's actually quite possible to modify an executable to install adware, spyware, virii, etc. Just requires a simple branch instruction for one possible method of running said code.

As for adware/etc in multimedia files, this website explains how it works:
http://www.freerepublic.com/focus/f-news/1312830/posts

specifically:

When Windows Media Player encounters a file with certain "rights management" features enabled, it opens the web page specified by the file's creator. This page is intended to help a content providers promote its products -- perhaps other music by the same artist or label. But the specified web page can show deceptive messages, including pop-ups that try to install software on users' PCs. User with all the latest updates (Windows XP Service Pack 2 plus Windows Media Player 10) won't get these popups. But with older software, confusing and misleading messages can trick users into installing software they don't want and don't need -- potentially so many programs that otherwise-satisfactory computers become slow and unreliable.

 

[Britney Spears]

Let me put it this way - multimedia files are read, not executed.  The idea that executable code could be inserted into, say, an mp3 file, makes about as much since as saying that the same executable code could be inserted into a book.

This is true in theory, but modern media formats are tightly integrated. With newer formats, especially those that support some kind of DRM (WMV for example) or digital cataloguing feature, it is entirely possible to insert malignent code. Heck, a while back there was a exploit found in the Winamp minibrowser, where code in the ID3 tag of a MP3 file can be used maliciously. Let me search for a link...... Found it. This was back in <a href=http://www.geek.com/news/geeknews/2002apr/gee20020501011465.htm>2002</a>.

I encounter lots of DRM protected WMV files nowadays that have scripts built into it, so that when played through Windows Media Player, they would automatically load up a website on Internet Explorer at certain points in the file. LOTS of possible ways to exploit this "feature". EDIT: Looks like Roko Beat me to it.....

Blame Microsoft and their bloated, useless lowest-denominator software. :

 

[Korus]

Blame Microsoft and their bloated, useless lowest-denominator software.

*Shakes fist angrily*

 

[48Highlander]

yep, MS proprietary media formats tend to have "rights management" functions which can be abused, however, that's a lot different than inserting adware into media files.  Sure, playing a WMV might open up a webpage, but it won't install anything unless you tell it to.  The adware is still coming to your computer from a website, and not from the torrent network or a media file.  Windows media player still doesn't execute any code within the file, it just opens a website.

Anyway, MP3, MPG, AVI, etc files can't even do that much, so a simple rule of thumb would be avoid windows media.

And roko, you misunderstood, I meant it's not possible to insert an executable in a media file and have it run, not that it's not possible to modify an executable.  It certainly IS possible to modify an executable to get it to do whatever you want - however, doing that without changing the file seize and without changing the internal structure of the file is very complicated, and that's something that you'd need to do in order to insert spyware into a legitamate piece of software which is already being shared over the torrent network.  And spyware isn't generaly inserted into executable files being shared online because that's illegal - you're much more likely to pick up a virus or trojan than adware.  So really, the only adware you're likely to pick up from executables is adware which was originaly bundled with it - and you'll get that wether you download it from a p2p network, or from an official website.

So basically the threats that this article exposes are as follows:

1)  You might download a WMV or WMA file which can open web pages.
2)  You might download shareware software which has always had spyware in it, and will have spyware in it regaurdless of where you get it.

This article is sensationalizm pure and simple.  They could have suggested that people download the MS anti-spyware softwareplus lavasoft adaware, and have an up-to-date virus scanner going.  They could have pointed out that there's no new security threat here, that these "vunlerabilities" (or features, depending on how you look at it) have existed for a long time.  Instead they take a few minor security threats, blow them out of all proportion, and then go on to propose other, nonsential, "possible threats".  Maybe these sorts of articles sell papers, but they certainly aren't doing much to educate people. All they're succeeding in doing is worrying people with no good reason.

 

[Infanteer]

I have a computer, and it uses windows.

Yesterday, I managed to make a shortcut to Spider Solitaire.

 

[Korus]

And roko, you misunderstood, I meant it's not possible to insert an executable in a media file and have it run, not that it's not possible to modify an executable.

Seen. My brain doesn't like to function late at night when I have a cold. Or maybe it's those 4 immunizations I had done the friday before.. hmm...

 

[atticus]

Microsoft® Windows AntiSpyware (Beta)

http://www.microsoft.com/downloads/details.aspx?FamilyID=321cd7a2-6a57-4c57-a8bd-dbf62eda9671&displaylang=en

Just download it and use it and don't worry so much about spyware.

 

[Warvstar]

Spyware? Haha thats old. Like the last post said just install Microsoft AntiSpyware and you will never see them again.