Measuring pay-per-install: The commoditization of malware distribution

Proceedings of the 20th USENIX Security Symposium

Volumn , Issue , 2011, Pages 187-202

  Caballero, Juan ^a   Grier, Chris ^b,c   Kreibich, Christian ^b,c   Paxson, Vern ^b,c  

^a IMDEA SOFTWARE INSTITUTE   (Spain)

^b UNIVERSITY OF CALIFORNIA   (United States)

^c ICSI

Author keywords

[No Author keywords available]

Indexed keywords

COMMODITIZATION; CONNECTED SYSTEMS; EXECUTABLES; MEASUREMENT STUDY; VALUE CHAINS;

MALWARE;

EID: 85064176806     PISSN: None     EISSN: None     Source Type: Conference Proceeding    
DOI: None     Document Type: Conference Paper

References (33)

1. Anubis: Analyzing Unknown Binaries. http:// anubis.iseclab.org/. Accessed on June 2011.
2. Ulrich Bayer, Christopher Kruegel, and Engin Kirda. TTAnalyze: A Tool for Analyzing Malware. In European Institute for Computer Antivirus Research Annual Conference, April 2006.
3. H. Binsalleeh, T. Ormerod, A. Boukhtouta, P. Sinha, A. Youssef, M. Debbabi, and L.Wang. On the Analysis of the Zeus Botnet Crimeware Toolkit. In International Conference on Privacy, Security and Trust, August 2010.
4. AS-Troyak Exposes a Large Cybercrime Infrastructure, March 2010. http://blogs.rsa.com/ rsafarl/as-troyak-exposes-a-largecybercrime-infrastructure/.
5. J. Caballero, N. M. Johnson, S. McCamant, and D. Song. Binary code extraction and interface identification for security applications. In Proceedings of the Network and Distributed System Security Symposium, February 2010.
6. C. Y. Cho, J. Caballero, C. Grier, V. Paxson, and D. Song. Insights from the Inside: A View of Botnet Management from Infiltration. In Proceedings of the USENIX Workshop on Large-Scale Exploits and Emergent Threats, April 2010.
7. N. Doshi, A. Athalye, and E. Chien. Pay-Per-Install: The New Malware Distribution Network, April 2010. http://www.symantec.com/ content/en/us/enterprise/media/ security response/whitepapers/ pay per install.pdf.
8. H. Dreger, A. Feldmann, M. Mai, V. Paxson, and R. Sommer. Dynamic Application-Layer Protocol Analysis for Network Intrusion Detection. In Proceedings of the USENIX Security Symposium, April 2006.
9. Amazon Elastic Compute Cloud. http:// aws.amazon.com/ec2/. Accessed on June 2011.
10. J. Franklin, V. Paxson, A. Perrig, and S. Savage. An Inquiry into the Nature and Causes of theWealth of Internet Miscreants. In Proceedings of ACM Conference on Computer and Communications Security, October 2007.
11. G. Gu, R. Perdisci, J. Zhang, and W. Lee. Bot-Miner: Clustering Analysis of Network Traffic for Protocol and Structure Independent Botnet Detection. In Proceedings of the 17th USENIX Security Symposium, July 2008.
12. InstallsDealer. http://installsdealer.com/. Accessed on June 2011.
13. InstallsForYou. http:// installsforyou.biz/. Accessed on June 2011.
14. Internet archive. http://www.archive.org/. Accessed on June 2011.
15. B. Koehl and J. Mieres. SpyEye Bot (Part two) Conversations with the Creator of Crimeware, February 2010. http://www.malwareint.com/ docs/spyeye-analysis-ii-en.pdf.
16. C. Kolbitsch, T. Holz, C. Kruegel, and E. Kirda. Inspector GAdget: Automated Extraction of Proprietary Gadgets from Malware Binaries. In Proceedings of the IEEE Symposium on Security and Privacy, May 2010.
17. C. Kreibich, C. Kanich, K. Levchenko, B. Enright, G.M. Voelker, V. Paxson, and S. Savage. Spamcraft: An inside look at spam campaign orchestration. In USENIXWorkshop on Large-Scale Exploits and Emergent Threats, 2009.
18. Christian Kreibich, Nicholas Weaver, Chris Kanich, Weidong Cui, and Vern Paxson. GQ: Practical Containment for Measuring Modern Malware Systems. Technical Report TR-11-002, International Computer Science Institute, May 2011.
19. LoadsSell. http://loadssell.net/. Accessed on June 2011.
20. MaxMind. Resources for Developers. http:// www.maxmind.com/app/api. Accessed on June 2011.
21. J. Mieres. Russian prices of crimeware, March 2009. http://evilfingers.blogspot.com/ 2009/03/russian-prices-ofcrimware. html.
22. A. Mushtaq. World's Top Malware, July 2010. http://blog.fireeye.com/research/ 2010/07/worlds top modern malware.html.
23. J. Oberheide, M. Bailey, and F. Jahanian. Poly-Pack: An Automated Online Packing Service for Optimal Antivirus Evasion. In Proceedings of the 3rd USENIX conference on Offensive technologies, August 2009.
24. V. Paxson. Bro: A system for detecting network intruders in real-time. Computer Networks, 31:2435-2463, December 1999.
25. R. Perdisci, W. Lee, and N. Feamster. Behavioral Clustering of HTTP-Based Malware and Signature Generation Using Malicious Network Traces. In Proceedings of the 7th USENIX conference on Networked Systems Design and Implementation, April 2010.
26. D. Plonka and P. Barford. Context-Aware Clustering of DNS Query Traffic. In Proceedings of the 8th ACM SIGCOMM conference on Internet Measurement, October 2008.
27. Best Pay-Per-Install Affiliate Program Reviews. http://pay-per-install.com. Accessed on June 2011.
28. Pay-Per-Install Programs. https://www.payper-install.org/. Accessed on June 2011.
29. K. Stevens. The Underground Economy of the Pay-Per-Install PPI Business, February 2010. Black Hat DC, Arlington, VA.
30. ThreatExpert - Automated Threat Analysis. http://www.threatexpert.com/. Accessed on June 2011.
31. The Tor Project. http:// www.torproject.org/. Accessed on June 2011.
32. Virustotal - Free Online Virus, Malware and URL Scanner. http://www.virustotal.com/. Accessed on June 2011.
33. ZeuS Tracker. https:// zeustracker.abuse.ch/. Accessed on June 2011.