Rogue security software is a form of computer malware that deceives or misleads users into paying for the fake or simulated removal of malware. Rogue security software, in recent years, has become a growing and serious security threat in desktop computing.[1]
[edit] Propagation
Rogue security software mainly relies on social engineering in order to defeat the security built into modern operating system and browser software and install itself onto victims' computers.[1]
Most have a Trojan horse component, which users are misled into installing. The Trojan may be disguised as:
Some rogue security software, however, propagate onto users computers as drive-by downloads which exploit security vulnerabilities in web browsers or e-mail clients to install themselves without any manual interaction.[2]
[edit] Operation
Once installed, the rogue security software may then attempt to entice the user into purchasing a service or additional software by:
- Alerting the user with the fake or simulated detection of malware or pornography.[4]
- Displaying an animation simulating a fake system crash and reboot.[1]
- Selectively disabling parts of the system to prevent the user from uninstalling them. Some may also prevent anti-malware programs from running, disable automatic system software updates and block access to websites of anti-malware vendors.
- Installing actual malware onto the computer, then alerting the user after "detecting" them. This method is less common as the malware is likely to be detected by legitimate anti-malware programs.
Some rogue security software overlaps in function with scareware by also:
- Presenting offers to fix urgent performance problems or perform essential housekeeping on the computer.[4]
- Scaring the user by presenting authentic-looking pop-up warnings and security alerts, which may mimic actual system notices.[5] These are intended to leverage the trust of the user in vendors of legitimate security software.[1]
Sanction by the FTC and the increasing effectiveness of anti-malware tools since 2006 have made it difficult for spyware and adware distribution networks—already complex to begin with[6]—to operate profitably.[7] Malware vendors have turned instead to the simpler, more profitable business model of rogue security software, which is targeted directly at users of desktop computers.[8]
Rogue security software is often distributed through highly-lucrative affiliate networks, in which affiliates supplied with Trojan kits for the software are paid a fee for every successful installation, and a commission from any resulting purchases. The affiliates then become responsible for setting up infection vectors and distribution infrastructure for the software.[9] An investigation by security researchers into the Antivirus XP 2008 rogue security software found just such an affiliate network, in which members were grossing commissions upwards of $USD150,000 from tens of thousands of successful installations per month.[10]
[edit] Law enforcement
In December 2006, the Washington Attorney General announced that it had reached settlement in a suit against Secure Computer LLC, the White Plains-based vendor of the Spyware Cleaner rogue security software, under the Computer Spyware Act passed by the Washington State Legislature in 2005. Secure Computer, under consent decree, agreed to pay more than $USD75,000 in restitution to consumers.[11]
In December 2008, the US District Court for Maryland—at the request of the FTC—issued a restraining order against Innovative Marketing Inc, a Kiev-based firm producing and marketing the rogue security software products WinFixer, WinAntivirus, DriveCleaner, ErrorSafe, and XP Antivirus.[12] The company and its US-based web host, ByteHosting Internet Hosting Services LLC, had their assets frozen, were barred from using domain names associated with those products and any further advertisement or false representation.[13]
Law enforcement has also exerted pressure on banks to shut down merchant gateways involved in processing rogue security software purchases. In some cases, the high volume of credit card chargebacks generated by such purchases has also prompted processors to take action against rogue security software vendors.[14]
[edit] Partial list of rogue security software
The following is a partial list of rogue security software, most of which can be grouped into families. These are functionally-identical versions of the same program repackaged as successive new products by the same vendor.[10][15]
[edit] References
- ^ a b c d "Microsoft Security Intelligence Report volume 6 (July - December 2008)". Microsoft. 2009-04-08. pp. 92. http://www.microsoft.com/downloads/details.aspx?FamilyID=aa6e0660-dc24-4930-affd-e33572ccb91f&displaylang=en. Retrieved 2009-05-02.
- ^ a b Doshi, Nishant (2009-01-19), Misleading Applications – Show Me The Money!, Symantec, https://forums2.symantec.com/t5/blogs/blogprintpage/blog-id/security_risks/article-id/53, retrieved 2009-05-02
- ^ Doshi, Nishant (2009-01-21), Misleading Applications – Show Me The Money! (Part 2), Symantec, https://forums2.symantec.com/t5/blogs/blogprintpage/blog-id/security_risks/article-id/54, retrieved 2009-05-02
- ^ a b "Free Security Scan" Could Cost Time and Money, Federal Trade Commission, 2008-12-10, http://www.ftc.gov/bcp/edu/pubs/consumer/alerts/alt121.shtm, retrieved 2009-05-02
- ^ http://tech.yahoo.com/blog/null/107193
- ^ Testimony of Ari Schwartz on "Spyware", Senate Committee on Commerce, Science, and Transportation, 2005-05-11, http://www.cdt.org/testimony/20050511schwartzspyware.pdf
- ^ Leyden, John (2009-04-11). "Zango goes titsup: End of desktop adware market". The Register. http://www.theregister.co.uk/2009/04/21/zango. Retrieved 2009-05-05.
- ^ Cole, Dave (2006-07-03), Deceptonomics: A Glance at The Misleading Application Business Model, Symantec, https://forums2.symantec.com/t5/blogs/blogprintpage/blog-id/grab_bag/article-id/5, retrieved 2009-05-02
- ^ Doshi, Nishant (2009-01-27), Misleading Applications – Show Me The Money! (Part 3), Symantec, https://forums2.symantec.com/t5/blogs/blogprintpage/blog-id/security_risks/article-id/55, retrieved 2009-05-02
- ^ a b Stewart, Joe (2008-10-22), Rogue Antivirus Dissected - Part 2, SecureWorks, http://www.secureworks.com/research/threats/rogue-antivirus-part-2/?threat=rogue-antivirus-part-2
- ^ Attorney General McKenna Announces $1 Million Settlement in Washington’s First Spyware Suit, Washington State Office of the Attorney General, 2006-12-04, http://www.atg.wa.gov/pressrelease.aspx?&id=5926, retrieved 2009-05-02
- ^ Ex Parte Temporary Restraining Order RDB08CV3233, United States District Court for the District of Maryland, 2008-12-03, http://www.ftc.gov/os/caselist/0723137/081203innovativemrktgtro.pdf, retrieved 2009-05-02
- ^ Lordan, Betsy (2008-12-10), Court Halts Bogus Computer Scans, Federal Trade Commission, http://www.ftc.gov/opa/2008/12/winsoftware.shtm, retrieved 2009-05-02
- ^ Krebs, Brian (2009-03-20), "Rogue Antivirus Distribution Network Dismantled", Washington Post, http://voices.washingtonpost.com/securityfix/2009/03/sunlight_disinfects_rogue_anti.html, retrieved 2009-05-02
- ^ Howes, Eric L (2008-11-21), Spyware Warrior - Family Resemblances, http://www.spywarewarrior.com/family_resemblances.htm, retrieved 2009-05-02
- ^ Precise Security - Advanced Cleaner
- ^ Spyware Warrior - AlfaCleaner
- ^ Alpha AntiVirus - Spyware-Review
- ^ BleepingComputer - AntiSpyCheck 2.1
- ^ BleepingComputer - AntispyStorm
- ^ 2-Spyare - AntiSpywareExpert
- ^ 2-Spyare - AntiSpywareExpert
- ^ 2-Spyware - AntiSpywareMaster
- ^ Precise Security - AntiSpywareSuite
- ^ BleepingComputer - AntiSpyware Shield
- ^ BleepingComputer - Antivermins
- ^ BleepingComputer - Antivirus 2008
- ^ 2-Spyware - Antivirus 2009
- ^ Article noting that Antivirus 2010 and Anti-virus-1 are the same
- ^ Details on Antivirus 2010 showing it is rogue, its symptoms and removal
- ^ BleepingComputer - Antivirus360
- ^ BleepingComputer - AntivirusPro2009
- ^ Symantec - AntiVirus Gold
- ^ BleepingComputer - Antivirus Master
- ^ Symantec - Antivirus XP
- ^ SpywareFixPro - Antivirus Pro 2010
- ^ 411-Spyware - Antivirus System PRO
- ^ 2-Spyware - Avatod Antispyware
- ^ SpywareRemove - Awola
- ^ SpywareRemove - BestsellerAntivirus
- ^ 2-Spyware - Cleanator
- ^ McAfee - ContraVirus
- ^ SpywareFixPro - Cyber Security
- ^ XP-Vista - Doctor Antivirus
- ^ 2-Spyare - Doctor Antivirus 2008
- ^ Symantec Symantec - DriveCleaner
- ^ MalwareBytes - EasySpywareCleaner
- ^ Symantec - Errorsafe
- ^ 411-Spyare - GreenAV2009
- ^ 2-Spyare - IE Antivirus
- ^ MalwareBytes - IEDefender
- ^ SpywareRemove - InfeStop
- ^ Symantec - Internet Antivirus
- ^ 2-Spyare - KVMSecure
- ^ Symantec - MacSweeper
- ^ MalwareBytes - MalwareCrush
- ^ MalwareBytes - MalwareCore
- ^ MalwareBytes - Malware Alarm
- ^ 2-Spyware - Malware Bell
- ^ 2-Spyware - Malware Defender
- ^ BleepingComputer - MS Antivirus
- ^ BleepingComputer MS Antispyware 2009
- ^ 2-Spyware - MaxAntispy
- ^ Sunbelt Security - Netcom3 Cleaner
- ^ 411-spyware - PCSecureSystem
- ^ BleepingComputer - PC Antispy
- ^ [www.2-spyware.com/remove-pc-antispyware-2010.html]
- ^ MalwareBytes - PC Clean Pro
- ^ SpywareRemove - PC Privacy Cleaner
- ^ PC SpeedScan Pro Ripoff
- ^ MalwareBytes - PerfectCleaner
- ^ BleepingComputer - Perfect Defender 2009
- ^ BleepingComputer - PersonalAntiSpy Free
- ^ BleepingComputer - Personal Antivirus
- ^ SpywareWarrior - PAL Spyware Remover
- ^ ComputerAssociates - PCPrivacy Tools
- ^ SpywareRemove - PC Antispyware
- ^ SpywareRemove - PSGuard
- ^ BleepingComputer - Rapid AntiVirus
- ^ BleepingComputer - Real Antivirus
- ^ Precise Security - Registry Great
- ^ Bleeping Computer - Safety Alerter 2006
- ^ SpywareFixPro - SafetyKeeper
- ^ Emsi Soft - SaliarAR
- ^ BleepingComputer - Secure Fighter
- ^ SpywareRemove - SecurePCCleaner
- ^ Bleeping Computer - SecureVeteran
- ^ [1]
- ^ Spyware-Review Security Tool
- ^ Precise Security - Security Toolbar 7.1
- ^ 2-Spyware - Smart Antivirus 2009
- ^ SpywareFixPro - Soft Soldier
- ^ Symantec
- ^ Spyware Warrior - Spy Away
- ^ BleepingComputer - SpyCrush
- ^ Symantec - SpyDawn
- ^ Precise Security - SpyGuarder
- ^ BleepingComputer - SpyHeal
- ^ 411-Spyware - SpyMarshal
- ^ Symantec - Spylocked
- ^ Symantec - SpySheriff
- ^ Symantec - SpySpotter
- ^ 2-Spyare - SpywareBot
- ^ Spyware Warrior - Spyware Cleaner
- ^ BleepingComputer - SpywareGuard 2008
- ^ 2-Spyware - Spyware Protect 2009
- ^ Symantec - Spyware Quake
- ^ Spyware Warrior - Spyware Sheriff
- ^ Sunbelt Security - Spyware Stormer
- ^ MalwareBytes - Spyware Striker Pro
- ^ 411-Spyware - Spyware Protect 2009
- ^ Spyware Warrior - SpywareStrike
- ^ Symantec - SpyRid
- ^ McAfee - SpyWiper
- ^ 411-Spyare - System Antivirus 2008
- ^ BleepingComputer - System Live Protect
- ^ Symantec - SystemDoctor
- ^ 2-Spyware - System Security
- ^ (aka total security)BleepingComputer - Total Secure 2009
- ^ 2-Spyware - Trusted Antivirus
- ^ Symantec - TheSpyBot
- ^ BleepingComputer - UltimateCleaner
- ^ Symantec - VirusHeat
- ^ Symantec - VirusIsolator
- ^ BleepingComputer - VirusLocker
- ^ Symantec - VirusProtectPro
- ^ Symantec - VirusRemover2008
- ^ ComputerAssociates - VirusRemover2009
- ^ Symantec - VirusMelt
- ^ Sunbelt Security - Virus Ranger
- ^ Virus Removal Guru - Virus Response Lab 2009
- ^ BleepingComputer - VirusTrigger
- ^ Precise Security - Vista Antivirus 2008
- ^ 411-Spyware - WinAntiVirus Pro 2006
- ^ 2-Spyware - WinDefender
- ^ SpywareFixPro - Windows Police Pro
- ^ BleepingComputer - Windows Protection Suite
- ^ Symantec - WinFixer
- ^ Symantec - WinHound
- ^ Winpc Antivirus
- ^ Winpc Defender
- ^ Symantec - WinSpywareProtect
- ^ BleepingComputer - WinWeb Security 2008
- ^ Symantec - WorldAntiSpy
- ^ SpywareRemove - XP AntiSpyware 2009
- ^ BleepingComputer - XP Antivirus
- ^ [2]
- ^ Precise Security - Zinaps AntiSpyware 2008
[edit] See also
[edit] External links
