Ex-Adware Designer Explains How Adware Works, Vulnerabilities in Internet Explorer

Sherri Davidoff of philosecurity.org posted an enlightening interview with Matt Knox who was previously employed writing adware for Direct Revenue.

A few highlights:

The good distributors would say, ‘This is ad-supported software.” Not-so-good distributors actually did distribute through Windows exploits. Also, some adware distributors would sell access. In their licensing terms, the EULA people agree to, they would say “in addition, we get to install any other software we feel like putting
on.” Of course, nobody reads EULAs, so a lot of people agreed to that. If they had, say, 4 million machines, which was a pretty good sized adware network, they would just go up to every other adware distributor and say “Hey! I’ve got 4 million machines. Do you want to pay 20 cents a machine? I’ll put you on all of them.” At the time there was basically no law around this. EULAs were recognized as contracts and all, so that’s pretty much how distribution happened.

Most adware targets Internet Explorer (IE) users because obviously they’re the biggest share of the market. In addition, they tend to be the less-savvy chunk of the market. If you’re using IE, then either you don’t care or you don’t know about all the vulnerabilities that IE has.

Sherri: In your professional opinion, how can people avoid adware?
Matt: Um, run UNIX.
Sherri: [laughs]
Matt: We did actually get the ad client working under Wine on Linux.
Sherri: That seems like a bit of a stretch!
Matt: That was a pretty limited market, I’d say.

Matt also goes into a lot of detail describing the different methods he employed to ensure that it was close to impossible to deactivate the adware once it was running.  Read all about it in the original article.  Thanks to Aaron Toponce and Bruce Schneier for pointing out this great interview.

The bottom line:  If you want to stay free of adware, don’t use Internet Explorer.  I’d recommend running Firefox in Ubuntu.

Is Google’s Chrome a Failure?

So, Google has surprised everybody and made their own browser:  Chrome.  If you haven’t tried Chrome, you can get it here if you are running Windows.  Google hasn’t released the Linux version yet, but you can sign up for an email notification when it’s ready, if you like.  For now, Codeweavers has hacked together a .deb, available here.

When Chrome first became available, the media was in a frenzy about how Google was going to use Chrome to crush Microsoft or something, and people were downloading it like crazy.  Now, the word is that Chrome is a failure.  The LA Times and ComputerWorld think that Chrome is failing because although it gained a lot of market share the first few days, people are now going back to their old browsers.

Is Chrome a failure?  I don’t think it’s failed, yet.  The reason the media is saying Chrome is a flop, is because they don’t understand why Google made a browser, which is partly because they don’t READ and partly because they don’t understand FOSS.

If you look at what Google has to say about why they made Chrome, and read between the lines a little, their purpose becomes clear.  It isn’t about gaining Chrome market share, it’s about building a faster Java engine for Internet Explorer and the rest of the proprietary browsers.

Google’s Web 2.0 apps like Google Docs, Google Maps, and Google Calendar run on Java, and Google reports that they are being limited in what they can do with these applications only because the Java engines of all the other browsers out there are too slow.

Google’s brilliant solution was to start a project called Chromium, and to build an open source Java engine called V8, which apparently blows the competition (excluding Firefox – see below) out of the water.  The best way to spread the word about this V8 Java engine, so as to hopefully get Microsoft to implement it in IE, was to make Chrome.  Sure, it’s a nice browser, and there is a lot Google might do with it, but it isn’t the point.  It’s just the means to an end.

What about Mozilla Firefox?  Well, Mozilla is working on their own super fast Free Open Source Java engine called TraceMonkey which will be included in the quickly approaching Firefox 3.1 update.  And according to Arstechnia, TraceMonkey is already significantly faster than V8.

Why did Google go to all the effort, if TraceMonkey is faster?  The difference, is that Mozilla’s software is under the GPL and Google’s V8 has been released under a BSD license.  If Microsoft wanted to include the GPL’d TraceMonkey code in Internet Explorer, they’d be bound to the terms of the GPL, which requires putting any additional code changes back into the Free Software community under the same license.  The BSD license has no such requirement.  Microsoft could take the code, and give nothing back.

So, has Google failed?  That depends on Microsoft.  Microsoft will have the choice of delivering a sub-standard Java experience in Internet Explorer, or taking the free gift and making Google’s web 2.0 apps faster.  Time will tell.