The Fix on Winfixer via AOL- The Latest Tricks Exposed

Microsoft IE Security MVP, Sandi Hardmeier, pinged me earlier this weekend over yet another problematic advertisement in a big network. She blogs again on the elusive “Winfixer”, or you can pick a name among many, for this deceptive software scam. I noted this at Revenews after the discovery of the “scareware” being served up through Windows Live Messenger (previously known as MSN IM) and I commented on MSFT’s negative eCPM…I have analyzed the Groups Case fragments sent to me by others, but they are not conclusive or cohesive enough to make a determination- only some guesses. Not enougn information, but I will comment. Perhaps others have insight.

Microsoft Groups Case

Let’s revisit this incident with a small picture of the technical action. In this case I am going on a 3rd party trace and a capture of the packets in a heavily cropped .PNG file from Menthix.net used with permission (Thank You Johan). It is interesting, but very slim to go on.

rads.msn.com appears to be MSFT’s ad server for MSN.
(NASDAQ: MSFT)

clk.atdmt.com would be Atlas- owned by Seattle based, aQuantive Inc.
(NASDAQ: AQNT)

img-cdn.mediaplex.com- owned by ValueClick.
(NASDAQ: VCLK)

aQuantive owns a number of digital businesses including Avenue A | Razorfish, Atlas and DRIVEpm.

ValueClick, also a powerhouse, owns Commission Junction, Fastclick, Inc., Web Marketing Holdings, Inc. E-Babylon, Inc. and Shopping.net among other business units.

The first thing that pops out as a little odd is the use of two ad serving platforms- direct competitors. VCLK network ads are normally served off their ValueClick network, but not always. Is it possible the party was trying to obscure the action in this way?. I am speculating here, but I am guessing since MediaPlex (VCLK) leased their ad server technology- that leaves aQuantive in the mix as serving up an that made a call to VCLK?.. Did they lease out Atlas or did they buy a ton of bulk inventory and resell some of it?

Not enough information from this small snippet, but it appears Flash and ActiveScript might be involved.

Speculation and ActiveScript

A network like DRIVEpm, or any other large network for that matter, will buy huge amounts of inventory on a CPM basis. Given ROS inventory in large networks is often sold at $1.00 to $2.00 CPM, one can probably estimate that properties like Windows Live Messenger and Microsoft Groups are less than stellar buys and probably came along with a deal- low value inventory. I would estimate the CPM is probably pennies per impression. The network that does the large buy at MSN and monetizes what they can. Even then they are probably left with excess inventory.

In turn they might farm that inventory out on a CPA basis or any other type of deal structure or to resellers e.g. brokering, because the inventory is unfilled and from their view it is better to get something rather than nothing. In this case the “something” turns out to be more than nothing if you are on the receiving end of one of these ads. This is really bad if it jeopardizes your strategic relationships.

There is no way to prove it all conclusively, I don’t have all the pieces, or know for sure how it got through the system of checks and balances that should be, and usually are in place, but it is possible it came through obfuscated or encrypted ActionScript and Flash ads. I will get to that…

Winfixer and MVPs on The Trail

This time Sandi finally has a conclusive packet capture of the “Winfixer” family of software in action- complete with the deceptive screenshots. This time it isn’t via MSFT but coming in via AOL. In Microsoft’s case it was seen served via Windows Live Messenger, pulled rapidly and then a week later came through MSN groups through what appears to be low-value ROS ads.

Sandi notes on it on the Money AOL section, although it appears to be served from DoubleClick Inc., who owns performics, and later pops up in the WinAmp forums, serving through atwola.com domains- AOL.

Sandi writes in this entry:

I’ve posted a couple of times on this blog about how visits to AOL pages were redirecting at random to the scareware/malware commonly known as Winfixer (aka SystemDoctor and ErrorSafe aka several other names). On previous occasions I did not have network monitors running, and therefore could only offer screenshots and my word as “proof” of the incidents.

(http://msmvps.com/blogs/spywaresucks/archive/2007/03/22/701346.aspx)
(http://msmvps.com/blogs/spywaresucks/archive/2007/03/21/697330.aspx)

This time, however, Microsoft Network Monitor was running when I visited the AOL page (http://money.aol.com/news/articles/_a/technical-goof-wipes-out-38-billion/20070320140609990001) and was redirected to an ErrorSafe page.

Below are snippets of relevant network data - the full logs are available for inspection and use by the appropriate authorities…

and she goes on to make this editorial comment…

Editorial: It is well and truly time for MSN, MS, AOL and any other big name that has had their advertising networks infiltrated by the crud that is commonly known as Winfixer to go after Winfixer, its affiliates, and the sites that host the malware by using every legal avenue open to them, and with no holds barred. I say join forces and go after those behind Winfixer, those who host it, and those who spread it, with everything legal weapon at your disposal. Shut them down, and shut them down for good!

It is amazing outfits like this can thrive for so long? I shudder to guess at their ROI- my guess these “outfits” generate thousands if not tens of thousands of dollars or more per day. Maybe more if they don’t pay their I/Os?

Civil Suit Filed
It would appear there is some private litigation underway as detailed by this rather interesting blog connecting the outfit to “ByteHosting” and one Marc Cohen who is being named in the action [PDF Link]. We will have to wait and see how those cards play.

Concerted Effort to Strike Back Needed

Sandi also writes in this later entry dated March 25, 2005:

I was in Seattle not long ago for the MVP Summit. While I was there I had a short meeting with a Director of Community & Intelligence, Security Research & Response at Microsoft who has been dealing with the fall-out of the Winfixer infiltration of the Windows Live Messenger banner ad network. The primary purpose of the meeting was to discuss my concern that the fact that winfixer had managed to infiltrate the MS/MSN ad network once meant that it would happen again.

Microsoft certainly understands the risks being faced by users of their software which includes advertisements - whether it be Windows Live Messenger, or Windows Mail Desktop with its advertisement pane, or MSN, or Hotmail. But unfortunately, although I am pleased at the high level of collaboration I am seeing at MS/MSN as a result of the Winfixer outbreak, I am not confident that another outbreak will not occur.

As long as advertising networks do not directly host creatives they will be at risk of bait and switch. Winfixer is popping up in so many places, we cannot be sure that *any* Web site that displays dynamic advertisements will be safe. So what can we, as users, do about this problem, considering the advertising networks seem to be unable to control the problem by themselves?

Yes, we can get rid of Flash. We can use ad blockers. We can use Mike Burgess’s hosts file to redirect known advert and URLs to localhost. We can disable active x completely. I’ll fight against users having to cripple their Web browsers and sacrifice access to content such as Flash and active x in an attempt to avoid malware. Mike Burgess’s HOSTS file, on the other hand, is what I recommend - block the adware content without crippling your browser or sacrificing Flash.

Web site owners and those running advert networks must surely understand the risk to their revenue streams as more and more people actively block advertisements as a self defence mechanism against malware. If we, the visitors, don’t see the adverts we are not going to click on them. If we don’t click on the adverts, there is no income. Maybe once the advertising networks realise they are at risk of losing more and more viewers, the cost of directly hosting creatives will become less prohibitive - after all, it is better to have a lowered income than no income at all.

Well said.

Strong Response is Needed

I have to agree with Sandi, and other MVPs and security guns I talk too, and I have added emphasis to her most important words in the quote. Why is it that the large network superpowers have trouble keeping this out of their advertising mix? Microsoft was quick to respond, yet reaching AOL seems problematic per Sandi’s post- I will certainly ping people I know. Again I find it troubling that roving MSFT MVPs, security forums, and everyday grassroot activists are doing the Network Quality checks in 2007.

I imagine there might be all kinds of cross-country trails that make it hard to determine the exact origin of the final parties. This is often called “partner sprawl”, but there should be an I/O, there should be a paper trail…somewhere along the line someone has to be accountable.

Let’s move on to how-to’s and a blog I find per Sandi’s site that I think has some great, and blunt advice.

Mike On Ads and ActionScript

Mikeonads, I think Mike works for RightMedia. RightMedia recently received an investment from Yahoo! for those curious. Mike goes on to demonstrate just how tricky some of the tactics can be in this detailed and educational entry. You can also check out some of the “bait and switch” creatives and flash advertising trickery.

When I see Obfuscation or Encryption- I Always Wonder What and Why it is Hidden…

This trickery is accomplished by embeddeding encrypted or obfuscated ActionScript. The examples he cites have been “decompiled” so I do not know for sure, but I note there is a subtle difference between obfuscation and encryption. The nefarious Actionscript is injected inside of the flash ads- often via creatives spoofing legitimate, big-name advertisers. Who would question these names?

The Actionscript launches popups and Active-x installs for the malware. ActionScript is a scripting language, based on the ECMAScript standard, and primarily used to develop software for Adobe Flash. I have seen a lot of nasty things with obfuscated or encrypted Javascript in general- I can think of the World Cup Javascript Page Header Injection or the ancient Spazbox case, as being incredibly complex and nasty examples. However, I have to admit that using advertising networks themselves as “virtual botnets” via ROS or remnant CPM buys and fancy Javascript is disgustingly clever and it really shocks me this can even happen. I mean I can see it from ad networks that act as “fronts”, but big established ones?

The Risky Thrill of Outside Creatives

If you work in a large network and accept outside creatives I highly suggest you build automated systems to decompile flash creatives and analyze and record what is happening in the advertisement. Mike suggests Adam Judson’s Tamper Data, FireFox plug-in. This allows you to view and modify HTTP/HTTPS headers and post parameters and well as trace and time http response/requests. You can also try Action Script Viewer.This might not scale for large networks, but for now- the front line of defense is a good offense. If you see any obfuscated or encrypted ActionScript- put a hold right there. It is not hard to spot when you crack into these creatives. It doesn’t mean there is something bad for sure, but it is just a banner creative- so why the mystery?

Another Clarion Call

I do like Mike’s call to action for executives:

Executives in the ad industry:
Take a 1-strike approach to all partners that assist in this scam
Be accountable if your organization promotes this scam
Take legal action against partners that abuse you to promote the scam

One strike…I think many people would forgive ad networks if they just spent resources going after and bringing back the bad parties to pay. Publicly traded companies have the resources, and certainly they have brands to guard. However, it is not only the smart thing to do, but the right thing to do.

The Fall Out Hurts Everyone

If networks don’t step up, if they continue to let it happen, if they don’t strike back, if ad network employees do not have the sophisticated tools and training to screen outside creative… you cannot blame failure on “banner blindness”. One can only blame it on “banner sickness”. Short term gains are not worth the long term casulties to the people that you serve: your customers, merchants, and end-users.

It is not right by end-users, and it damages the reputation of everyone involved, especially the quality publishers you serve. This is not a problem end-users SHOULD HAVE to combat- this rests firmly within the hands of advertising networks.

Sometimes I feel like a broken record. I wonder if bringing this information to advertisers, merchants, and affiliates has the effect I hope for. Sure it is good for research and understanding the latest games malware writers are up to, but ultimately I want to malware go away and the integrity of fair advertising allow people to work, create content, and serve people to help them meet their needs.

I think T.V. advertising is dated and the Internet has the great promise to deliver a whole lot more in terms of interactivity, social media, and even better advertising. Then again, one’s television set is not invaded time and time again by the commercials they run. I have never heard of a plasma T.V. “pwning” anyone.

Final Word- Drop By, Learn More, Reach Out

Chris Boyd and I gave a presentation at the RSA 2007 show a few weeks ago. In this show we covered two cases we followed- The Q8 Army and Carder Botnet- and opened the doors to a shadowy world to give people glimpses at things they may not have imagined before. Apparently it went over well since we are doing a “compressed” encore presentation at FaceTime Communications- via WebEx. There is no cost- please come on in and register, but time is almost up. I can’t promise we will be super engaging, however I would like people to consider some of the ideas we advocate and the cases I think NQ people will find fascinating.

One idea I like to advocate is security firms, legitimate advertising networks, and law enforcement working together to sythesize information faster so we actually dent the problem. I am not sure how that happens and I have been talking to many network quality departments and people seem open to the idea of dialogue, many honestly do care…that is as far as it has come in all of my talks. But money and malware go together- well known.

Security firms see the malware (and we often work with our competitors and volunteers because it is a daunting task), networks know about the money- law enforcement- well it all depends on who you get and how it is presented.

Drop on by and if you have ideas- feel free to contact either of us. I am wide open for ideas and to share them…this “blight” has gone on long enough, and it will take honest collaboration to solve some even the part of the problem.

• We Support New York Affiliates

  

• Subscribe to ReveNews

  • Get ReveNews Updates in Your Reader
  • Get ReveNews Updates in Your Email

• The Latest Comments

  • Dave on McAfee SiteAdvisor
  • Linda Buquet on Performics Becomes Google Affiliate Network
  • Julian Moss on McAfee SiteAdvisor
  • George Reedy on How To Recruit Your 1st Affiliates…
  • Nick James on Should MyPoints Award Points for Political Action?
  • Mike Allen on Performics Becomes Google Affiliate Network
  • Mike Allen on Performics Becomes Google Affiliate Network
  • Durk Price on Performics Becomes Google Affiliate Network
  • Dragon on Reality Check: Shop.org Video
  • Google Affiliate Network on Performics Becomes Google Affiliate Network

• ReveNews Readers

• Archives

  Select Month June 2008 May 2008 April 2008 March 2008 February 2008 January 2008 December 2007 November 2007 October 2007 September 2007 August 2007 July 2007 June 2007 May 2007 April 2007 March 2007 February 2007 January 2007 December 2006 November 2006 October 2006 September 2006 August 2006 July 2006 June 2006 May 2006 April 2006 March 2006 February 2006 January 2006 December 2005 November 2005 October 2005 September 2005 August 2005 July 2005 June 2005 May 2005 April 2005 March 2005 February 2005 January 2005 December 2004 November 2004 October 2004 September 2004 August 2004 July 2004 June 2004

• ScratchBack Widget