Loading…
25th USENIX Security Symposium has ended
Back To Schedule
Thursday, August 11 • 4:00pm - 4:30pm
Investigating Commercial Pay-Per-Install and the Distribution of Unwanted Software

Sign up or log in to save this to your schedule, view media, leave feedback and see who's attending!

In this work, we explore the ecosystem of commercial pay-per-install (PPI) and the role it plays in the proliferation of unwanted software. Commercial PPI enables companies to bundle their applications with more popular software in return for a fee, effectively commoditizing access to user devices. We develop an analysis pipeline to track the business relationships underpinning four of the largest commercial PPI networks and classify the software families bundled. In turn, we measure their impact on end users and enumerate the distribution techniques involved. We find that unwanted ad injectors, browser settings hijackers, and “cleanup” utilities dominate the software families buying installs. Developers of these families pay $0.10–$1.50 per install—upfront costs that they recuperate by monetizing users without their consent or by charging exorbitant subscription fees. Based on Google Safe Browsing telemetry, we estimate that PPI networks drive over 60 million download attempts every week—nearly three times that of malware. While anti-virus and browsers have rolled out defenses to protect users from unwanted software, we find evidence that PPI networks actively interfere with or evade detection. Our results illustrate the deceptive practices of some commercial PPI operators that persist today.

Speakers
avatar for Elie Bursztein

Elie Bursztein

Anti-fraud and abuse research team lead, Google
Elie Bursztein leads Google's anti-abuse research, which helps protect users against Internet threats. Elie has contributed to applied-cryptography, machine learning for security, malware understanding, and web security; authoring over fifty research papers in the field for which... Read More →
DM

Damon McCoy

New York University
JP

Jean-Michel Picod

Reverse engineer, Google Switzerland


Thursday August 11, 2016 4:00pm - 4:30pm PDT
Zilker Ballroom 3

Attendees (4)