Wajam: From a Start-up to Massive Spread Adware
summary
A Montreal social-search product turns into pervasive adware that uses a pay‑per‑install network (over 50 PPI affiliates between 2011–2016, OPC estimates hundreds of millions of installs) and evolves from a browser extension to a Fiddler web proxy, then to DLL injection into Chromium/IE and a mini‑filter driver and later an NDIS/netfilter kernel driver; uses AES-256 and per‑string obfuscation, installs root certs and anti‑analysis checks, and remains highly persistent and active despite investigations.
AI-written summary · about
chapters (11)
- 0:00Start
- 6:11Company timeline
- 9:28Classification of samples collected
- 12:31Common features
- 15:03Distribution
- 21:56DLL injection techniques
- 23:36File system minifilter driver
- 26:08Netfilter SDK
- 30:00Implications
- 31:02Technical evolution
- 32:12Prevention
related talks
31mWatching Commodity Malware Get Sold to a Targeted Actor
54mModern Malvertising and Malware web-based exploit campaigns
28mInvestigating Commercial Pay-Per-Install and the Distribution of Unwanted...
46mFacebook Malware: Tag Me If You Can
30mReversing Mobile Malware
55mModern Malvertising ...
44mBeyond Desktops: The Rise and Transformation of Mobile Malware
16mBeyond the surface: uncovering hidden threats in online ads