LAS VEGAS–After a year-long study of affiliate networks running pay-per-install programs, which often include shareware, ad-injectors, and other unwanted software, Google and NYU found that nearly 60 percent of offers bundled with these programs are flagged as unwanted and that the networks drive about 60 million download attempts every week.
PPI networks are large, complex affiliate organizations that will bundle several developers’ apps with their own and then receive a payment for each successful install. In many cases, these networks rely on deceptive or confusing dialog boxes and installation instructions in order to push users into installing the apps. Many of the apps installed through these networks are classified as potentially unwanted software, a broad term that can include things such as ad-injectors, toolbars, shareware, and useless computer utilities.
“In recent years, unwanted software has risen to the forefront of threats facing users. Prominent strains include ad injectors that laden a victim’s browser with advertisements, browser settings hijackers that sell search traffic, and user trackers that silently monitor a victim’s browsing behavior,” the new report from Google and the NYU School of Engineering says.
“Estimates of the incident rate of unwanted software installs on desktop systems are just emerging: prior studies suggest that ad injection affects as many as 5% of browsers [34] and that deceptive extensions escaping detection in the Chrome Web Store affect over 50 million users.”
“There are a multitude of deceptive behaviors currently pervasive to software bundling.”
During the year that they studied the affiliate networks, the researchers came across more than 50 affiliate networks that are pushing PPI unwanted software and tools that help defeat antimalware detection. The researchers focused on four networks in particular, and collected 446,000 PPI offers of 883 different apps. There was a lot of scareware and ad-injectors in that sample set, as well as browser hijackers.
“Furthermore, in response to protections provide by Google Safe Browsing, publishers have resorted to increasingly convoluted tactics to try and avoid detection, like the defunct technique…of password protecting compressed binaries.”
The software-bundling behavior used in these affiliate networks is at the heart of their programs, and is one of the things that makes it difficult for users to determine whether they should install a given app.
Google held an event recently to work on setting guidelines for clean software and bundling and the company said there is work going on in the software industry to make things clearer for users.
