Malware spotlight: Badware
Introduction: What is badware?
Malware, as the name indicates, is malicious software designed to cause damage to computer systems and networks. Badware is often used as a synonym of malware, but in reality, there are some subtle differences between the two terms.
While malware is an umbrella term that covers a variety of malicious codes including viruses, Trojan horses, ransomware and backdoors, badware is not necessarily software created to destroy systems. In fact, it is often simply used to collect users’ information for a variety of purposes.
In some cases, “users may treat badware infection as an annoyance to be dealt with rather than a threat to their (or their company’s) data and computing resources,” says StopBadware, Inc., an anti-malware organization created in 2006. This nonprofit makes an effort to cleanse websites that are tagged as spreading badware by maintaining a catalog of sites that have been reported to distribute badware and continues to warn consumers about “this kind of attack [that] takes advantage of a vulnerability or ‘hole’ in your web browser, a browser plug-in, or other software on your computer.”
Badware, of course, can be also used by cybercriminals to hack or socially engineer a target and eventually use that info to attack with other types of malware options.
What problems can badware bring?
Badware can be bad news for both webmaster and users. This is because it is software that is able to somehow bypass the intended use of a website or connection to arrive to a certain scope. For users, this means a number of issues.
In the best-case scenario, badware is intrusive and designed mainly to track a user’s moves online to feed information to advertisers and marketing groups. The user will be unknowingly releasing information on his or her browsing or shopping habits through the use of research software or toolbars designed for the scope, or will be stuck with the installation of a secondary, unwanted program when installing a program of choice.
In the worst-case scenario, malware/badware will lead to compromise of sensitive data (like passwords or financial info), serve as a means towards attacking other computers or trick users into buying items and services. A typical purchase scam is the banner that pops up, warning the user that the computer is running slow and needs to be defragged. This prompts the user to download a specific, often infected, piece of software.
Webmasters can be equally affected by badware turning their legitimate website into a repository of malicious software. This is obviously a blow to the reputation of the site and can result in great loss of viewers and clients.
Is badware a growing problem?
Specific data solely on badware is not currently available, but it’s worth noting that this malware threat was already getting attention a decade ago. In fact, StopBadware.org’s May 2008 Badware Websites Report produced the following findings:
Source: StopBadware.org
Types of badware
The three most common types of badware behavior are:
- Malicious scripts: Used to redirect website visitors to a different site or to load actual badware from another source
- .htaccess redirects: A hidden server file used in Apache web servers that can be compromised by malicious attackers to redirect users to badware websites
- Hidden iframes: A section of a web page that loads malicious content from another page or site, without the visitor's knowledge
Cybercriminals can also infect computers with badware using drive-by downloads, which is a common method of spreading malware that occurs when a website automatically (and often silently) installs malicious code (usually an exploit kit) onto the victim’s PC — without the user being aware. No clicking is necessary with this kind of attack, which can take advantage of a vulnerability in a web browser, a browser plug-in or other software on a computer to infiltrate the system and take control of it.
How to prevent badware
First of all, it is important to keep a watchful eye and try to identify badware. For example:
- You see a warning from the antivirus software when visiting the site that displays a browser warning, such as "Reported attack site" or "This site may harm your computer"
- The site redirects to an unknown domain when you navigate to it in your browser
- You notice that permissions or files have been altered, or new users have been added
Webmasters, in particular, need to be aware and check if any search engines redirect users heading to their sites to different URLs or if the same happens while navigating within the site.
Badware can be difficult to avoid, as it can be slipped in a system via vulnerabilities or by exploiting users’ behaviors. There are a number of things, however, that can help you counteract this threat:
- Keep website software updated with the latest security fixes. This can patch loopholes that can let badware into the computer where a hacker can steal passwords and/or modify the contents that a user has uploaded.
- Use caution when deciding which third-party scripts and plugins to install. This can reduce your computer’s exposure to badware from attackers that often look for vulnerable software to exploit a website so they can modify your site’s contents.
- Remove or disable unnecessary applications that you are no longer using. This can leave another avenue for an attacker to get in the computer from a web server exploit.
- Tighten security on any used content management system (CMS) such as WordPress, Joomla! or Drupal which can be abused by hackers to deliver badware to visitors’ computers or redirect them to bad websites. Malicious web browser toolbars have also led users to different pages than the ones they expect.
- Review files, folders and web server permissions.
- Enforce strong password policies (obvious)!
- Take advantage of tools already available on your computer. Among some effective malware removal and security solutions is the SmartScreen filter built into Internet Explorer and Windows, which helps users identify reported malware websites. Also, website scanning services such as Google’s Webmaster Tools can help zero in on specific badware on a site and find more information about it.
- Another obvious countermeasure, especially for a webmaster, is ensuring safety while uploading material or otherwise updating their website. In fact, a common way of infecting a site is through a PC, laptop or any other mobile device that has been already infected and is then used to edit pages. It is also important to ensure that any communication with the website is done through secure network connections, especially when performing updates on the go.
Conclusion
It is truly mind-boggling to think of how many people have been affected by badware. Keep in mind that badware and malware are in general a concern for both businesses and individuals alike. Therefore, it is important to be vigilant by becoming aware of this internet-transported threat.
That said, do consider applying appropriate technical countermeasures and taking advantage of online resources including Google tools, Microsoft add-ons and projects like StopBadware. Network providers and web users alike can also play a key role by being proactive in reporting badware (contact@stopbadware.org).
Become a certified reverse engineer!
Sources
- Beware of Badware, WP Security Pros
- The State of Badware, stopbadware.org
- Badware stats, stopbadware.org
- What is badware?, stopbadware.org
- What is badware and why should I worry about it?, The Guardian
- Why Badware is Bad, The Content Works
- My site has badware, stopbadware.org
- Prevent badware, stopbadware.org
- Badware alerts for your sites, Google Webmaster Central Blog
- StopBadware addresses sites plagued by malware, The University of Tulsa
- StopBadware.org’s May 2008 Badware Websites Report, stopbadware.org
- Guest Post - StopBadware Q&A, Facebook
- ESET partners up with StopBadware for Safer Cyberspace, ESET
- Make it stop! How to cleanse your PC of unwanted adware (and ‘badware’), WeLiveSecurity
- Malware, Malwarebytes
- Group Says Google a Top Source of Badware, CSO
- What to do when your site is hacked…, Hosting Marketers News
- Gary McGraw: Eliminating badware addresses malware problem, SearchSecurity.com
- Exam Pass Guarantee
- Live expert instruction
- Hands-on labs
- CREA exam voucher
In this Series
- Malware spotlight: Badware
- How AsyncRAT is escaping security defenses
- Chrome extensions used to steal users' secrets
- Luna ransomware encrypts Windows, Linux and ESXi systems
- Bahamut Android malware and its new features
- LockBit 3.0 ransomware analysis
- AstraLocker releases the ransomware decryptors
- Analysis of Nokoyawa ransomware
- Goodwill ransomware group is propagating unusual demands to get the decryption key
- Dangerous IoT EnemyBot botnet is now attacking other targets
- Fileless malware uses event logger to hide malware
- Nerbian RAT Using COVID-19 templates
- Popular evasion techniques in the malware landscape
- Sunnyday ransomware analysis
- 9 online tools for malware analysis
- Blackguard malware analysis
- Behind Conti: Leaks reveal inner workings of ransomware group
- ZLoader: What it is, how it works and how to prevent it | Malware spotlight [2022 update]
- WhisperGate: A destructive malware to destroy Ukraine computer systems
- Electron Bot Malware is disseminated via Microsoft's Official Store and is capable of controlling social media apps
- SockDetour: the backdoor impacting U.S. defense contractors
- HermeticWiper malware used against Ukraine
- MyloBot 2022: A botnet that only sends extortion emails
- Mars Stealer malware analysis
- How to remove ransomware: Best free decryption tools and resources
- Purple Fox rootkit and how it has been disseminated in the wild
- Deadbolt ransomware: The real weapon against IoT devices
- Log4j - the remote code execution vulnerability that stopped the world
- Rook ransomware analysis
- Modus operandi of BlackByte ransomware
- Emotet malware returns
- Mekotio banker trojan returns with new TTP
- Android malware BrazKing returns
- Malware instrumentation with Frida
- Malware analysis arsenal: Top 15 tools
- Redline stealer malware: Full analysis
- A full analysis of the BlackMatter ransomware
- A full analysis of Horus Eyes RAT
- REvil ransomware: Lessons learned from a major supply chain attack
- Pingback malware: How it works and how to prevent it
- Android malware worm auto-spreads via WhatsApp messages
- Malware analysis: Ragnarok ransomware
- Taidoor malware: what it is, how it works and how to prevent it | malware spotlight
- SUNBURST backdoor malware: What it is, how it works, and how to prevent it | Malware spotlight
- ZHtrap botnet: How it works and how to prevent it
- DearCry ransomware: How it works and how to prevent it
- How criminals are using Windows Background Intelligent Transfer Service
- How the Javali trojan weaponizes Avira antivirus
- HelloKitty: The ransomware affecting CD Projekt Red and Cyberpunk 2077
- DreamBus Botnet: An analysis
- Kobalos malware: A complex Linux threat
Get certified and advance your career
- Exam Pass Guarantee
- Live instruction
- CompTIA, ISACA, (ISC)², Cisco, Microsoft and more!
Malware analysis
Malware analysis
Malware analysis
Malware analysis