Adware and Browser Plugins

Adware is software programmed that displays advertisements – usually popups, though often also a range of other formats including banners, injections, popunders, and more – as users browse the web. Some adware installs as freestanding EXEs or APPs on Windows and MacOS. Other adware operates as browser plugins.

Rogue affiliates use adware to change the user experience. For users, adware means extra ads. For advertisers, adware can be even worse. We focus especially on adware round-tripping and plugin round-tripping, where an attacker watches user activity, waits for a user to show interest in a given advertiser (often by visiting its site or searching for its name), then invokes its affiliate link. Under standard measurement, this traffic looks valuable – it converts at a high rate. But it’s actually worthless – traffic the advertiser would have received anyway. Furthermore, every time an advertiser credits the rogue affiliate using adware round-tripping or plugin round-tripping, the advertiser under-credits the source that truly caused the referral – be that SEM, another affiliate, display, or some other marketing effort.

Beyond affiliate violations, we also test adware and browser plugins for other problems. Adware and plugins insert entries into search results, and we can figure out which entries, obtained through which ad networks, inserted where. Adware and plugins insert banner ads into other companies’ web sites – “ad injection” – and we can provide examples, track the ad networks and brokers that are involved, and identify the publisher accounts getting paid.

We built best-in-the-industry automation to test a variety of adware and browser plugins. We scour the web for significant adware, identifying commonalities across app families and branding to make sure we check all the apps. We scour app stores in search of rogue plugins. Our automation tests all these apps on an ongoing basis.