Let adware be treated as malware, Canuck boffins declare after breaking open Wajam ad injector

The technology industry has numerous terms for sneaky software, including malware, adware, spyware, ransomware, and the ever adorable PUPs – potentially unwanted programs. But there isn't always a clear difference between malware and less threatening descriptors. In a research paper distributed this month through pre-print …

[The Man Who Fell To Earth]

So...

Do any AV makers properly identify this scrap & warn users? If so, which ones?

How about other utilities, like Spybot Search & Destroy?

[N2]

Re: So...

warn users?

Surely not? You'd spend half your life clicking 'deny'

Hosts file, Adblocker ultimate and NoScript seem to do the trick

[bombastic bob]

Re: So...

javascript is pure evil anyway. it should be off by default, and ONLY used to support features that are impossible with style sheets [and only then, when ABSOLUTELY NECESSARY].

But the JQuery cult seems to have taken over web development. Ass-hats.

[A.P. Veening]

Re: So...

Hosts file, Adblocker ultimate and NoScript seem to do the trick

I find a Pi-Hole much more convenient, protects all devices on the home network.

[eldakka]

Re: So...

I find a Pi-Hole much more convenient, protects all devices on the home network.

While the device in question is on the home network.

Doesn't help when you attach that device - as frequently happens with say, laptops - to someone else's network. Whereas the aforementioned techniques - Hosts file, Adblocker ultimate and NoScript - continue to work in this case.

Best option (IMO) would be to have a virtual machine on your device with pihole in it, and always route through that to the network. That or make a portable (battery operated) version of the pihole that you can take with you on the road.

[Mage]

Re: So...

Or uMatrix.

Javascript in emails or webpages is biggest threat after a malicious/rogue/idiot user in someone's office. AV is useless really and dangerous with false positives.

Then we have various kinds of Autorun, USB HID based attacks and people "deliberately" clicking on stupid web links in search or opening stupid email attachments. AV and/or script blocking isn't a substitute for user training,

[BobChip]

Block the lot!

Block ANYTHING and EVERYTHING you do not actively want on your system. Aggressively. By all means at your disposal. Even "harmless" adware still steals bandwidth I have paid for, and for which I have much better uses.

[thosrtanner]

Re: Block the lot!

TBH i wouldn't worry so much about static adds like they have in newspapers. Where it's the responsibility of the ad server to tell the add supplier that it had served an ad (preferably without much extra detail). I wouldn't even mind if that changed every now and then if I refreshed the page.

I can blank those ads out mentally and they shouldn't cost much bandwidth to download and would pay the website hosting them which is not per se a bad thing.

Trouble is I don't think I've seen an ad like that on the internet for years and years.

And adware like this is nothing but malware. If you can't uninstall it cleanly by design, it's malware.

[Anonymous Coward]

Re: Block the lot!

The Guardian online has ads as you describe. They don't get blocked by Firefox Focus on my iPhone, nor Pihole running on the WiFi setup here. They're static ads, change every couple of days, well labelled as paid content. They're usually quite interesting little articles too - I find I click through around 50% of them. Often I'll click through the remainder to encourage this sort of ad placement.

[N2]

Re: Block the lot!

Guardian reader eh?

I'd keep quiet about that!

[Potemkine!]

Re: Block the lot!

Yeah, they don't EVEN CAPITALIZE randomly words, there are no quasi-nude women on page 3, and it doesn't help to propagate rumors, fake news and gossips. What a shame!

[Shadow Systems]

"Advertising is not inherently bad..."

A giant, GigaMeters tall, neon, blinking, scrolling, unavoidable sign that reads: BULLSHIT!

With that out of the way, pardon me while I dream about packing a "B Ark" with advertisers & their ilk & launching the sucker into a blackhole.

[Robert Carnegie]

Thank you for advertising your opinion.

Verbal big neon sign and all.

Advertising is just communication. What can make it bad is what is communicated, and to some extent how. If I pay The Register to display my advertisement came next to their news article - then that helps to reward journalists for their work. If the card promotes my app and the app is lousy - then that's too bad for you, but never mind. If I pay them to write a story on my behalf and offer it as unbiased news... I think they published a price list for that service, unless I'm thinking of Buzzcock.

[Doctor Syntax]

Re: Thank you for advertising your opinion.

And if I were to have your ad thrust, unwanted, into my face then I'd avoid buying whatever it was that you're flogging. You'd have been ripped off by the advertising industry. The advertising industry isn't interested in selling your stuff to me. Not in the least. All they're interested in is selling advertising to you. So anything that tries to force advertising onto people who don't want it,j just so they can sell more advertising are actually committing fraud against their clients; they're taking money for harming those clients' interests.

[Mike Moyle]

Re: Thank you for advertising your opinion.

@ Doctor Syntax -- So, are you advocating for a fully subscription-based... well... everything? All of your news, all of your entertainment, all of your online activities...? (To say nothing of the "real world" services that are at least partially subsidized by advertising!) Are you prepared for the prices of all of those services to go up precipitously and are you committing to subscribe to those services in perpetuity to keep them coming?

Or are you just expecting people to keep you informed, entertained, and connected for "EXPOSURE!"? Do YOU work for free...?

[theDeathOfRats]

Re: Thank you for advertising your opinion.

Methinks you are confusing the point, here.

I don't think most people here are against adverts 'per se'. The problem is the way they're being delivered, the unwanted tracking of everything and the potencial (and proven) delivery of 'malware' or whatever you want to call It.

You wanna show me ads? OK. Do It respecting me and I won't blackhole you.

[Robert Carnegie]

Re: Thank you for advertising your opinion.

"The Register" is "the advertising industry", too. Thank you for visiting.

I see I previously typed "came" when I meant "card", which is odd.

[Patrician]

Re: Thank you for advertising your opinion.

I'm sorry but I do my utmost to not buy something that I have had a advert thrust in my face for; not always possible unfortunately. Advertisers are parasitic scum and deserve nothing less than an eternity in the flames of hell.

[Robert Carnegie]

Re: Thank you for advertising your opinion.

If not by advertisements, how do you know where to buy stuff? There are few retailers that don't advertise. Sadie's Sandwiches may merely depend on you happening to walk by, but there probably is still a menu card of sandwich options available to you. I suppose that Sadie's Sex Toys probably doesn't have a window display...

[Potemkine!]

Re: Thank you for advertising your opinion.

"Advertising is just communication"

Like fraud. Or harassment. Or swindle.

[Blockchain commentard]

If a webpage says you're infected and 'click here' to run an AV scan but just loads ad-ware, that is not just a PUP, that is deceiving the end user. Probably criminal. No reason for legit AV/malware companies to block/uninstall that junk.

[Will Godfrey]

No Chance

Unfortunately there's money to be made, and bribes to be paid off, so don't hold your breath waiting for an improvement.

[katrinab]

Re: No Chance

The companies at that end of the market mostly make their money from scamming investors rather than from the actual advertising.

[revenant]

Finally...

It's about time someone came out and made the point that any program that uses deceit to get around a user's expectations in order to install or run some unwanted thing is malware.

A shame that this wasn't the prevailing attitude when GWX was causing trouble.

[Alumoi]

Re: Finally...

Not so loud, someone will point fingers at Microsoft and Windows 10.

Program? check

Using deceit in order to install/run? check

Fsking user expectation? check

Runing unwanted things (Cortana, telemetry and all)? check

So, by your definition, Windows 10 IS malware.

[JimboSmith]

Re: Finally...

We were just discussing that red X to start the download and installation on Win10 at work today. The general consensus was that it was akin to malware.

[adam payne]

"The line between adware and malware is a gray area,"

If it installs itself without your permission and attempts to hide itself so it doesn't get detected then it's malware plain and simple.

[Steve Davies 3]

Adverts and Malware

I don't want either on my systems thanks.

Nuke the lot of them [see Icon]

Make the people responsible be forced to watch adverts 24/7 for a whole year. Then they might see that like Google, they are Evil!

[Charles 9]

Re: Adverts and Malware

And if they're masochists and LIKE the treatment?

[DryBones]

Re: Adverts and Malware

If advertising influences buying behavior, they're going to end up with hair like Fabio and Thor's hammer in their pants.

[Anonymous Coward]

Re: Adverts and Malware

Couldn'r resist:

https://www.imdb.com/title/tt0066921/mediaviewer/rm2083029248

It's still too good for them lot.

[Mystic Megabyte]

Re: Adverts and Malware

There's two main reasons why I have not owned a TV for many years.

1) Shampoo adverts. Make up some pseudo scientific chemical names and talk B.S. while vacuous models shake their heads.

2) Car adverts. You never see a traffic jam, this car can go really fast and (wipe out your family) it's really really good.

What with Pi-Hole and add-ons I am no longer shouting at the screen. Whoohoo!

[Anonymous Coward]

Re: why I have not owned a TV for many years

You forgot the breakfast commercials, with a table with enough food to feed a third-world country for weeks, a smiling, radiant housewife who had time to apply make-up before cooking breakfast, two well-behaved kids already dressed and ready to leave, hubby in a suit getting ready for work.

Now get off our lawn.

[Anonymous Coward]

Simple

Adware ⊂ Malware

That is: all adware is malware, but malware could be something else. Adware is a subset of malware. Surely that's not difficult to understand.

Banish malware and we'll banish adware in the process.

[Anonymous Coward]

AV is a PUP in itself.

it all carp

[martinusher]

I've been listening to quacking for decades now

It all started with 'push' technology back in the 90s. Some smartass marketing people thought it would be a Really Good Thing to all websites to load applications content onto users's computers because it was the obvious way to monetize web sites. Since the PC software vendors were ever compliant in this users have had a generation of whack-a-mole with vulnerabilities because as has been pointed out "one person's adware is another's malware".

What's particularly frustrating about all this crapware is just how badly it works. Quite apart from clagging up my computer(s) it rewards me by serving up all sorts of irrelevant advertisements (often in Spanish but I've had ads from Ukranian car dealers). Its become a bit of a game, "Confuse their AI", searching for all sorts of weird and wonderful things just to see what it can offer me. I actually don't mind relevant ads and I'd even give people hints about what I'm looking for but obviously there's a reason why "Javascript is the most popular programming language" (to me their efforts are bit like watching someone struggle with an AI or real-time problem using an early version of BASIC -- you really can do anything in any language, just don't expect it to work very well!).

[Alan Mackenzie]

No wonder we have this trouble

> It (Canada's data protection regulator) made a series of recommendations to remediate violations, only to have the company sell its assets to Hong Kong-based Iron Mountain Technology Limited.

No wonder we have this trouble. The directors of that company knew full well what they were doing, and that they were breaking the law. What other type of fraud, when detected, is just met with a polite request to stop? When are such directors going to start getting substantial gaol sentences, like lone teenage crackers do?

[Aitor 1]

Money

Make ad networks and websites reasonably responsible for malware.. and javascript in ads will magically disappear.

By that I mean: if they inject javascript in the ads, either they have to check it or they have to stand by it.

[Mage]

ad networks and websites reasonably responsible for malware

Make anything other than a static image with same address for everyone and a plain link on it illegal.

Also Google, Facebook et al are fake snake oil salesmen in their (immoral) marketing of advert space claiming to leverage "profiles", it's mostly ineffective and entirely parasitical and dishonest.

[jezza99]

I get so many ads for scams served up by both Google ads and Facebook I wouldn’t trust anything advertised on the internet anyway.

[Aodhhan]

Technology out paces and out wits lawyers and law makers

Most don't understand how stealing bandwidth and affecting availability is harmful to information systems, and of course, to a company's bottom line.

Most law makers are just now beginning to understand the value of information being stolen from everyone. Unfortunately, once they do figure it out, those in government use it to their advantage--so I wouldn't expect any laws to shut information collection down any time soon.

Information collection makes the financial industry more powerful, just like a Vegas casino getting their hands on a secret football injury sheet.

Soon we InfoSec professionals will have to make a decision. Whether to support the collection of personal/private data or to stand against it.

Any time a large corporation with deep pockets can explain to law makers and government officials, how beneficial their technology is to their own power, the harder it is to call something malicious or damaging to the public. Just look at Huawei as an example. Countries whose population values freedom and liberty are standing against them. Those who only pretend to value these principles--to place profit above principles, are turning a blind eye.

[Mage]

Re: standing against them

Doing great till 2nd half of last paragraph. Where is proof? ZTE is Chinese Gov backed, not Huawei. Security agencies of UK, USA and Western Commercial data collection such as; Google, Facebook, Uber, Amazon, MS, Apple, Pinterest etc are the threat to ordinary citizens' privacy and democracy.

CIA use of Cisco has been proven.

[Anonymous Coward]

Re: standing against them

ANY Chinese company is subject to the intervention of the Chinese government; it's part of the overall subject of sovereign rule. And Chinese law makes it pretty clear that they can intervene in any matters within its borders at any time. They, essentially, ARE the law. IOW, Huawai is considered suspect because it's a Chinese company acting on Western interests, which means, by Chinese law, the Chinese government can intervene in Western interests through Huawei, and there's little Huawei can say in the matter, business suicide or no.

[Anonymous Coward]

follow the money

down the purple brick road....

[Potemkine!]

malware, adware, spyware, ransomware

crapware, shitware, fistfuckware, downthetroathware