adwarekiller

Great answer. I can confirm that the market is indeed specializing through separation of the distribution and monetization operations.

More interesting bytes:

* Ad injection mentioned in the last ANA&WhiteOps fraud report (http://www.ana.net/content/show/id/botfraud), they found that over 500K ads were injected every day to one publisher.

* Research on in-webstore extensions (https://www.usenix.org/system/files/conference/usenixsecurit... used dynamic analysis system called "Hulk" to detect malicious extensions. Summary of the results:

Analysis result Count Malicious 130 Suspicious 4,712 Benign 43,490 Total 48,332

Detection class Count [s] Injects dynamic JavaScript 2,672 [s] Produces HTTP 4xx errors 2,322 [s] Evals with input >128 chars 451 [m] Prevents extension uninstall 56 [m] Steals password from form 39 [s] Requests to non-existent domain 26 [m] Keylogging functionality 23 [m] Injects security-related HTTP header 11 [m] Steals email address from form 10 [m] Uninstalls extensions 8

c. Another paper (https://www.usenix.org/legacy/event/collsec10/tech/full_pape... from the EPFL calculates the potential revenue of an adversary as a function of adversary power to modify ads traffic (http://i.imgur.com/ut2jjQl.png).

d. There is also companies like rgnets (http://rgnets.com/), amobee (http://www.amobee.com/) and FrontPorch (http://www.frontporch.com/), which offers network appliance that performs the HTTP interception and tampering. In this method there is no need to install anything on the user, all you need him to do is connect your network. Large public networks (hotles, events, airports, etc) are using it as well as some ISPs.

Many people consider 50onRed (under International Web Services LLC: http://www.advertising-support.com/) as the biggest company in the field. According to a publication from March 2014, they serve up to 1.5 billion impressions per day (http://adage.com/article/digital/big-ad-injection-scheme-hit...).

I can't edit the original comment for some reason. Sorry for the n00bism, its my first comment here on HN.

I want to add this: The profit of an adware company is the difference between its user acquisition cost and the revenue from the monetization phase. As the monetization phase gets shortened by AV detection and removal, the lower the revenue gets. This cause adware vendor to adapt new methods that transitionally were associated with "more evil" malware (banking trojans): they use crypters and vulnerabilities in AVs in order to evade detection, randomly generated domain names (for the C&C, inject and publishing domains), etc.

Feel free to AMA

Another ex-adware person here, from the download valley itself.

AFAIK, the key roles in the adware ecosystem are:

a. Distribution

Done mainly through "Pey Per Install" companies such as IronSource, InstallMontizer (actually funded by YC: https://news.ycombinator.com/item?id=5092711), InstallRex, etc. These folks bundle legitimate programs with adware in their installers. They use dark patterns (http://www.hanselman.com/blog/DownloadWrappersAndUnwantedSof...) in order to deceive users to install the offered "product". Some of them make it intentionally hard (practically impossible for the non-techie user) to uninstall the adware, or downloading additional adware without user consent (drive-by). Other shady practices include the use of malvertising (e.g. ad that mimic flash, acrobat or OS update) and the most extreme one, which is rare but exists, is exploit kits.

b. Monetization

Done mainly with advertising and information harvesting. Common practices (aka "revenue models"): ad injection (banners, pop-up\under, etc), affiliate fraud ("price comparison widgets", or just forcefully redirect user through affiliate link) , lead generation (e.g. scraping insurance details), social networks spam (Selling views, likes, followers, etc - works because google\fb\etc eliminates fake bot account fairly efficiently, but adware just impersonate real authenticated sessions) and selling cheap traffic.