BitTorrent, the beloved file-sharing client and protocol that provides a way around bandwidth bottlenecks, has become the newest distribution vehicle for adware/spyware bundles.
Public peer-to-peer networks have always been associated with adware program distributions, but BitTorrent, the program created by Bram Cohen to offer a new approach to sharing digital files, has managed to avoid the stigma.
Not any more, anti-spyware advocates warn.
According to Chris Boyd, a renowned security researcher who runs the VitalSecurity.org nonprofit resource center, the warm and fuzzy world of BitTorrent has been invaded by a massive software distribution campaign linked to New York-based adware purveyor Direct Revenue LLC.
“This is the marketing campaign to end all marketing campaigns,” said Boyd, the Microsoft Security MVP (most valuable professional) known throughout the security industry by the “Paperghost” moniker.
In an e-mail interview with Ziff Davis Internet News, Boyd said rogue files have popped up occasionally in BitTorrent land but those were usually just random executables. “This is the first time I’ve seen a definite money-making campaign with affiliates, distributors and some pretty heavy-duty adware names,” he added.
Boyd, widely known for chronicling spyware, hacking and malware exploits, has published details of the BitTorrent distributions and identified Direct Revenue and Marketing Metrix Group as the companies responsible for the rigged files.
Boyd said he got the first inkling that BitTorrent was a major adware distribution vehicle while searching for the source of Direct Revenue’s Aurora, an adware program that includes the prevalent “nail.exe” component. Sifting through mountains of HijackThis logs posted on security forums, Boyd said the answer was staring him in the face. (HijackThis is a popular freeware spyware removal tool that keeps detailed logs of Windows PC scans).
In the logs, he found that “nail.exe” and “aurora.exe” were always listed alongside “btdownloadgui.exe,” the user interface that downloads/uploads when using BitTorrent.
“I checked hundreds of those logs, and more often than not, [btdownloadgui.exe] was chugging away in the background. No wonder none of the victims (or spyware experts) seemed to know what site Aurora was coming from—there was no site. It would have never occurred to the end users that it could have crept in by another means altogether,” he said.
Because BitTorrent strips digital files into tiny shreds and reassembles them locally once a user completes a download, it has emerged as the perfect place to bundle adware programs among the bits, without the end user ever knowing.
Breakdown on how Aurora piggybacks on BitTorrent
More data on Aurora
