[Paper Review] Privacy and Security Risks of "Not-a-Virus" Bundled Adware: The Wajam Case

Xavier de Carné de Carnavalet, Mohammad Mannan|arXiv (Cornell University)|May 13, 2019

Advanced Malware Detection Techniques22 references4 citations

TL;DR

This paper investigates Wajam, a long-standing adware platform that evolved into a sophisticated privacy- and security-compromising threat. Through reverse engineering and analysis of 52 samples (2013–2018), the authors expose advanced anti-analysis and antivirus evasion techniques, including traffic interception via ProtocolFilters, browser history exfiltration, arbitrary HTTPS content injection, and remote code execution—demonstrating that adware can pose risks comparable to traditional malware.

ABSTRACT

Comprehensive case studies on malicious code mostly focus on botnets and worms (recently revived with IoT devices), prominent pieces of malware or Advanced Persistent Threats, exploit kits, and ransomware. However, adware seldom receives such attention. Previous studies on "unwanted" Windows applications, including adware, favored breadth of analysis, uncovering ties between different actors and distribution methods. In this paper, we demonstrate the capabilities, privacy and security risks, and prevalence of a particularly successful and active adware business: Wajam, by tracking its evolution over nearly six years. We first study its multi-layer antivirus evasion capabilities, a combination of known and newly adapted techniques, that ensure low detection rates of its daily variants, along with prominent features, e.g., traffic interception and browser process injection. Then, we look at the privacy and security implications for infected users, including plaintext leaks of browser histories and keyword searches on highly popular websites, along with arbitrary content injection on HTTPS webpages and remote code execution vulnerabilities. Finally, we study Wajam's prevalence through the popularity of its domains. Once considered as seriously as spyware, adware is now merely called "not-a-virus", "optional" or "unwanted" although its negative impact is growing. We emphasize that the adware problem has been overlooked for too long, which can reach (or even surplus) the complexity and impact of regular malware, and pose both privacy and security risks to users, more so than many well-known and thoroughly-analyzed malware families.

Motivation & Objective

• To investigate the technical evolution and persistent threat of Wajam, a seven-year-old adware platform that transitioned from a social search engine to a high-risk spyware.
• To analyze the anti-analysis and antivirus evasion mechanisms used by Wajam, including polymorphic updates, steganography, and registry obfuscation.
• To assess the real-world privacy and security risks posed by Wajam, such as plaintext leakage of browser histories and arbitrary HTTPS content injection.
• To evaluate the prevalence and impact of Wajam and its clones through domain tracking and database exposure analysis.
• To advocate for greater scrutiny of adware and PUPs in cybersecurity research, given their growing complexity and threat surface.

Proposed method

• Collected and reverse-engineered 52 Wajam samples spanning 2013–2018 to track its technical evolution.
• Analyzed the use of ProtocolFilters to intercept and modify HTTPS traffic, enabling man-in-the-middle (MITM) attacks.
• Identified and validated the use of steganography to embed secondary installers within media files, evading detection.
• Tracked domain infrastructure and daily variant distribution to assess propagation and persistence mechanisms.
• Discovered and reported a publicly exposed MySQL database from a Wajam clone (OtherSearch) containing over 100 million Google search records.
• Performed behavioral analysis on registry modifications, process injection, and certificate manipulation to detect long-term persistence.

Experimental results

Research questions

• RQ1 To what extent do modern adware platforms like Wajam employ advanced anti-analysis and antivirus evasion techniques?
• RQ2 What are the real privacy and security risks associated with Wajam’s operation, particularly regarding HTTPS traffic and browser data?
• RQ3 How prevalent and widespread is Wajam and its variants, based on domain usage and network infrastructure?
• RQ4 What are the implications of adware using legitimate SDKs (e.g., ProtocolFilters) to enable MITM attacks without user consent?
• RQ5 Why has the adware threat, particularly in the form of PUPs, remained under-investigated despite its growing complexity and impact?

Key findings

• Wajam employs a multi-layered evasion strategy, including polymorphic updates, steganographic installer delivery, and registry key randomization, resulting in low detection rates by antivirus engines.
• The adware uses ProtocolFilters to perform MITM attacks on HTTPS traffic, injecting arbitrary content and exposing users to session hijacking and credential theft.
• Wajam exfiltrates plaintext browser histories and keyword searches from high-traffic websites, including Google, compromising user privacy on a large scale.
• A Wajam clone, OtherSearch, was found to leak over 100 million Google search queries and clicked results via an unsecured MySQL database, with 6.54 million unique user IDs.
• The study identified that 332 domains were used to distribute Wajam variants, with daily updates from multiple sources, indicating a highly resilient and scalable infrastructure.
• Despite its long operational lifespan and significant attack surface, Wajam remained largely undetected and unaddressed by security vendors, highlighting a critical oversight in threat analysis.