Spyware Floods In Through BitTorrent (
Page 1 of 2 )
Anti-spyware advocates cry foul as the popular peer-to-peer protocol becomes the latest mechanism for the stealthy distribution of adware/spyware bundles.BitTorrent, the beloved file-sharing client and protocol that provides a way around bandwidth bottlenecks, has become the newest distribution vehicle for adware/spyware bundles.
Public peer-to-peer networks have always been associated with adware program distributions, but BitTorrent, the program created by Bram Cohen to offer a new approach to sharing digital files, has managed to avoid the stigma.
Not any more, anti-spyware advocates warn.
According to Chris Boyd, a renowned security researcher who runs the VitalSecurity.org nonprofit resource center, the warm and fuzzy world of BitTorrent has been invaded by a massive software distribution campaign linked to New York-based adware purveyor Direct Revenue LLC.
"This is the marketing campaign to end all marketing campaigns," said Boyd, the Microsoft Security MVP (most valuable professional) known throughout the security industry by the "Paperghost" moniker.
To read about spyware threats associated with file-sharing program Kazaa, click here.
In an e-mail interview with Ziff Davis Internet News, Boyd said rogue files have popped up occasionally in BitTorrent land but those were usually just random executables. "This is the first time Ive seen a definite money-making campaign with affiliates, distributors and some pretty heavy-duty adware names," he added.
Boyd, widely known for chronicling spyware, hacking and malware exploits, has
published details of the
BitTorrent distributions and identified Direct Revenue and Marketing Metrix Group as the companies responsible for the rigged files.
Boyd said he got the first inkling that BitTorrent was a major adware distribution vehicle while searching for the source of Direct Revenues Aurora, an adware program that includes the prevalent "nail.exe" component. Sifting through mountains of HijackThis logs posted on security forums, Boyd said the answer was staring him in the face. (HijackThis is a popular freeware spyware removal tool that keeps detailed logs of Windows PC scans).
In the logs, he found that "nail.exe" and "aurora.exe" were always listed alongside "btdownloadgui.exe," the user interface that downloads/uploads when using BitTorrent.
"I checked hundreds of those logs, and more often than not, [btdownloadgui.exe] was chugging away in the background. No wonder none of the victims (or spyware experts) seemed to know what site Aurora was coming from—there was no site. It would have never occurred to the end users that it could have crept in by another means altogether," he said.
Because BitTorrent strips digital files into tiny shreds and reassembles them locally once a user completes a download, it has emerged as the perfect place to bundle adware programs among the bits, without the end user ever knowing.
A BitTorrent user downloading a movie clip only becomes aware of the associated adware after the files are reassembled. At that stage, when the user attempts to load the reassembled file, he or she is greeted by an installation notice for an adware bundle distributed by MMG (Marketing Metrix Group), a Canadian company that specializes in P2P network marketing.
Officials from MMG did not respond to queries for comment. On its Web site, the company lists BitTorrent as a lucrative adware distribution vehicle. "Although Bit Torrent is a file format and not a P2P Network … [it] is the fastest growing protocol for file sharing online. Many top Bit Torrent sites such as SuprNova, Lokitorren and Bit Tower support millions of downloads daily," said MMG, which lists PartyPoker.com and Hotbar.com among other clients on its roster.
Symantec strikes back at adware vendor Hotbar. Click here to read more.
Boyd said his interest in Aurora increased because it "is absolutely everywhere at the moment, though no one could work out where the infections were coming from."
"I had heard rumors that there was something in peer-to-peer land, but I didnt expect it to be on the BitTorrent network, and finding these files has been surprisingly difficult," he added.
Boyd said BitTorrent was currently "overwhelmed" with multimedia files rigged with adware bundles, adding that the file sizes vary from 3MB to 175MB.
"I expect well see more of this, and if the first ever 1GB malware/adware install has a chance of happening anywhere, it will be on file-sharing networks where programs are broken up into pieces. The problem is, you never know whats going to come out the other side," he said.
Next Page: Aurora is installed with full disclosure, the company says.
Network Security & Hardware 
/ 3 
