It seems that every day we read about pollution around the world. From whales caught up on nets to particulates in the air we breathe, from water infested with everything from toxic chemicals to raw sewage. Then, there is the growing horror of microplastics, which are small chunks of plastic officially defined as being smaller than 5mm in diameter. Now, I read microplastics are being found inside living creatures.

The pollution problem is getting worse in the world of computing and the internet, too, except here it’s mostly related to a tidal wave of advertising material. Some of it is obvious, with websites that are often more advert than content a particular bête noir of mine. Other adverts are more insidious, such as those injected into video streams on YouTube. I understand the need for advertising revenue, and that I can pay the monthly YouTube fee to get rid of the inserted adverts, but this doesn’t rid me of the almost endless product placements made within the video itself.

Then, there’s my hatred of the inline feed adverts on Facebook, which has reached the level of almost a nervous tick. I have a morbid fascination with hitting the “block advert” button on the iOS app, then flagging the advert as “irrelevant” and then blocking the advertiser, which can eventually make the Facebook advertising algorithm back off for a few weeks. On desktop browsers, Social Fixer strips the feed of much unwanted rubbish, but Social Fixer and Facebook appear locked in an endless game of cat and mouse as Facebook tries new methods of getting around the filtering.

It doesn’t stop there, of course – buy a new computer and you can rest assured there’s a wheelbarrow full of rubbish to be immediately uninstalled, starting with the ubiquitous antivirus trialware. I strip laptops back to the bare minimum, keeping only necessary vendor-supplied tools for updating firmware and drivers.

So, you can imagine my horror at reading reports that a company, Glance, is about to launch its lockscreen tool for Android phones in the USA. It replaces the standard lock screen with its own platform and, as you can probably expect, this means adverts can be delivered directly to this screen. Although the company insists that it isn’t an ads platform but a “smart surface”.

“In the US, monetisation on the lock screen surface will be primarily driven by the Space that a consumer chooses to consume at any moment,” its blog says. “For example, consumers can pay a subscription fee for premium news wraps by a major publisher arriving every morning on their lock screens; or, they could choose to buy products from merchants when the product drop of the day surfaces on the lock screen.”

Time will tell how Glance works in the US – and you can expect the UK won’t be far behind – but my suspicion is that Glance-enabled phones will be supplied by telcos for a slightly lower fee, much as Amazon offers a discount on some Kindles.

Adverts have their place, but only if there is a clear understanding that the costs to the end-user are reduced, often to zero, by accepting the adverts. That requires a clear understanding that you either get the adverts, or you can pay a small subscription and get the clean feed. However, no one wants to engage in that discussion, mostly because it requires them to put a value on the advertising feed, and thus onto the end user uptake.

If I find a site or platform that offers a paid-for subscription, I will usually try it for a period. If I find the feed still laden with adverts, of whatever sort, then I will back away and have few qualms about applying technology to get the feed in a form that I want.

It really is about time that there was clarity in this space. Buy a laptop with all the crapware installed and pay a price. Pay slightly more and get it without. Then I can choose, based on the cost of my time, to clean things up.

At the same time, we need to talk about online advertising and its place in our lives. And this is before we even get onto the enormous amount of user profiling that is happening in real-time of each and every internet user, and the question of where and how that data is being used.

I absolutely would not buy a smartphone that had built-in advertising of the form provided by Glance. Telcos have no right into my phone operation other than providing raw connectivity.

It is no longer acceptable to just sit back and assume that we’re going to get swamped, and that there is nothing we can do about it. All that will happen is the pollution will grow and mutate until, like microplastics, it’s so pervasive that we can’t even spot it anymore. It's just there, inside our devices. It’s time we put these companies back into their box.

Security researchers have found a new Adload malware variant targeting Apple devices.

Researchers at Sentinel Labs observed over 150 unique samples as part of a new campaign that remains undetected by Apple’s on-device malware scanner.

The AdLoad malware initially surfaced in 2017 but has evolved over the years to evade detection by Apple’s XProtect security system. In 2019, Apple had some partial protection against its earlier variants, but there were no updates to cover the then-new 2019 variant.

AdLoad is a type of adware that redirects a user’s web traffic through the attacker’s preferred servers. The aim is to hijack and redirect user’s web browsers for monetary gain.

Researchers said the 2019 and 2021 AdLoad variants used persistence and executable names that followed a consistent pattern. In 2019, that pattern included some combination of the words “Search,” “Result,” and “Daemon,” such as “ElementarySignalSearchDaemon”.

The latest version uses a different pattern that primarily relies on a file extension that is either .system or .service. The file extension used depends on the location of the dropped persistence file and executable as described below. Still, typically .system and .service files will be found on the same infected device if the user gave privileges to the installer.

With or without privileges, AdLoad will install a persistence agent in the user’s Library LaunchAgents folder.

Researchers said they have found around 50 unique label patterns, each having a .service and a .system version. “Based on our previous understanding of AdLoad, we expect there to be many more,” they added.

Further investigations have found more than 150 unique samples in this year’s campaigns. Researchers noted there appears to have been a sharp uptick throughout July and the early weeks of August 2021. Researchers said a single sample of this variant was documented by analysts at Confiant, who described the malware’s string decryption routine.

“It certainly seems possible that the malware developers are taking advantage of the gap in XProtect, which itself has not been updated since a few weeks after Confiant’s research over two months ago. At the time of writing, XProtect was last updated to version 2149 around June 15th – 18th,” researchers said.

“The fact that hundreds of unique samples of a well-known adware variant have been circulating for at least 10 months and yet remain undetected by Apple’s built-in malware scanner demonstrates the necessity of adding further endpoint security controls to Mac devices,” researchers concluded.

Apple launched a notarization process for all apps and software created for macOS in February to weed out malware. Recently, a college student discovered adware with a full macOS notarization, according to WIRED.

Mac computers were once impenetrable vaults, which led to few hackers attempting to infiltrate them. Those who tried would generally hit roadblocks. Today, Macs are hacked nearly as often as PCs, which lead to the February launch of Apple’s notarization process.

This notarization is required for all apps and software designed for macOS. And if the notarization doesn’t exist, a user can’t run the software without a workaround. However, college student Peter Dantini purposefully downloaded malware, fully expecting his Mac to reject the installation. To his surprise, the well-traveled Shlayer adware installed on his machine without issue.

Dantini alerted Apple of the notarized malware on Aug. 28, and Apple immediately revoked the notarization certificates. Unfortunately, two days later, the malware reappeared with a notarization from a different Apple Developer ID. Dantini again alerted Apple of the issue.

Apple addressed the issue, saying, "Malicious software constantly changes, and Apple’s notarization system helps us keep malware off the Mac and allow us to respond quickly when it’s discovered.” The company continued, "Upon learning of this adware, we revoked the identified variant, disabled the developer account, and revoked the associated certificates. We thank the researchers for their assistance in keeping our users safe."

The fact that Apple quickly addressed the situation is reassuring, but this is proof that relying on Apple’s notarization system alone isn’t enough. While it can help prevent most malware, having a strong antivirus and a critical eye for iffy apps is key.

A pay-per-install (PPI) software firm has been accused of using increasingly deceptive tactics to convince online users to install potentially harmful software - while generating large revenues in the process, it has been claimed by security researchers.

WakeNet AB, which develops e-marketing platform FileCapital, offers malicious actors the tools to spread infected files and adware. These potentially unwanted programmes (PUPs) have the semblance of software with useful functionality, but pose risks to users and can seriously hamper performance.

FileCapital, the software under fire, allows malicious actors to install several PUPs on users' machines, including Wajam, which replaces display advertising with its own, and OnlineApp, a proxy which routes traffic through its own servers.

According to security researchers from McAfee, more than 1.9 million detections were seen in the wild during a 10 month period from September 2017 and June 2018 - predominately targeting devices in Germany, but also the UK and US. Overall, there were infections present in 178 countries.

"WakeNet AB has remained active for 19 years with little outcry," according to McAfee's senior security scientist Oliver Devane and security researcher Charles Crofford, who warned that installing FileCapital leads to PUP infections.

"Meanwhile, PUPs, which are more numerous than malware, plague users around the world. PUP development is unlikely to slow because they earn their distributors considerable sums.

"The security industry needs to do more to investigate companies that create PUPs and raise awareness among customers of their bad practices."

FileCapital offers its customers a variety of marketing tools such as embedded movies, landing pages, banners and buttons to coax victims into installing bundled apps that house different PUPs.

An online user, for instance, may believe they are installing a helpful performance cleaner onto their machine, only to find this is disguised as malicious software that could lead to reduced performance and the appearance of pop-up advertising.

The embed movie function, which is described as "by far the worst" function, can allow customers to create a fake video website to show a 'codec missing' message and entice users into downloading the bundled installer. This feature is normally prevalent on illegal football and film streaming websites.

Meanwhile, the revenue WakeNet AB generated in one year through misusing pay-per-install, according to McAfee, put it above some of the most prevalent ransomware strains - with its 2017 financial statements showing the company reaped $2 million.

"As of now, it seems unlikely that PUP development will slow since it helps their distributors earn a considerable amount of money," said McAfee's chief consumer security evangelist Gary Davis.

"With that said, it's important now more than ever for users to be aware of the security risks involved with PUPs like the ones spread by WakeNet's FileCapital."

IT Pro contacted WakeNet AB for comment but it had not responded to our request at the time of publication.

Researchers have uncovered a sophisticated rootkit-based adware, mainly prevalent on Windows 10 devices, that has been operating covertly for six years.

Dubbed Zacinlo, this rare strain of malware typically operates by silently rendering webpages in the background in hidden windows to simulate clicks and keyboard interactions, or can replace ads naturally loaded in an open web browser with its own ads to collect revenue.

The malware, subject to an extensive investigation by security company Bitdefender, is armed with a sophisticated array of features to ensure it remains undetected, and even quashes any 'competition', featuring an adware cleanup routine to remove any potential rivals in the adware space.

It can also uninstall or delete services based on instructions it receives from the command and control infrastructure, to which it routinely sends information about its environment, including what form of anti-malware services may be installed, and which applications are running on startup.

One of its most concerning features involves a significant invasion of privacy, with Zacinlo able to take screen captures of a user's desktop and send them to its command and control centre for analysis.

Bitdefender's security researchers were alerted to the rootkit-based adware last year, publishing the results of its analysis in a whitepaper.

"Since rootkits these days account for under 1% of the malware output we see worldwide, this immediately drew our attention and prompted us to carry out an extensive analysis of the payload, its origins and the spread," the report said.

"We discovered an ample operation whose central component is a very sophisticated piece of adware with multiple functionalities."

Over the course of its investigation, Bitdefender learned the adware had been running covertly since 2012/13 with at least 25 different components in almost 2,500 distinct samples. Although components date back to 2012, the adware was most active towards the end of 2017.

The researchers also learned the functionality of many of Zacinlo's components were in a state of flux throughout the time it was being tracked; with functionalities updated, dropped, or integrated with other components, indicating it is still being developed.

The vast majority of the samples tracked were spotted in the US, with a handful found in France, Germany, Brazil, China, Indonesia, the Philippines, and several infections in the UK.

Significantly, despite Windows 10 being fitted with in-built technology to protect users from rootkits, the overwhelming majority of samples, 90%, were found on devices running Microsoft's latest operating system.

"While generating untold revenue for the companies that run these programs, adware has witnessed constant improvements over the years in both data collection and resilience to removal," said Bitdefender senior e-threat analyst Bogdan Botenzatu.

"The line between adware and spyware has become increasingly fuzzy during recent years as modern adware combines aggressive opt-outs with confusing legal and marketing terms as well as extremely sophisticated persistence mechanisms aimed at taking control away from the user."

Asked where it fits into the wider threat landscape of 2018, Botenzatu told IT Pro: "Zacinlo was an unexpected surprise in the wider cyber-security landscape, which is currently dominated by ransomware and crypto-jacking malware.

"The discovery of rootkit-based malware that mostly affects Windows 10 is enough evidence that "independent" malware operators find lucrative niches in a threat landscape dominated by crypto-ransomware and illegal mining of digital currency."

Zacinlo is the latest in a number of sophisticated malware strains that researchers have uncovered in recent months. Bitdefender similarly detected a remote access tool, named RadRAT, previously operating undetected since 2015, which offers attackers full control over seized computers.

Roaming Mantis, meanwhile, which uses DNS-hijacking to redirect users to phishing sites running a Coin Hive cryptomining script, was found by Kaspersky Lab last month to be on spreading rapidly across the globe after emerging only a couple of months previously in a handful of countries including Japan and India.

Lenovo is to cut bloatware on its PCs to prevent security concerns triggered by the Superfish adware that led to a compromised HTTPS protocol.

The Superfish adware preloaded on Lenovo consumer notebooks from September 2014 caused great concern from privacy and security groups because it could potentially allow attackers to access encrypted data when it inserted visual search results into a browser.

This is because it used a self-signed security certificate, which, if compromised, could have provided hackers with access to all of a user's browser data - regardless of whether it had been encrypted.

Now, Lenovo said it will remove all adware and bloatware from new devices, offering tools to customers that can remove Superfish, as well as a free six-month subscription to McAfee LiveSafe service or, for existing users of the security software, a six-month extension on their existing plan.

The company said in a statement: "The events of last week reinforce the principle that customer experience, security and privacy must be our top priorities. With this in mind, we will significantly reduce preloaded applications. Our goal is clear: To become the leader in providing cleaner, safer PCs."

It will, however, include software that is "customarily expected" in some countries, which could, for example be default search engines and browsers in countries outside Western Europe.

"We are starting [to roll this out] immediately, and by the time we launch our Windows 10 products, our standard image will only include the operating system and related software, software required to make hardware work well (for example, when we include unique hardware in our devices, like a 3D camera), security software and Lenovo applications," the company added.

It plans to list all the software preloaded on its PCs and explain what it's all for to prevent the surprise of unwanted preinstalled software.

Hackers are easily able to extract the fake security certificate used by Superfish to make their malware even more dangerous, Facebook has warned.

Superfish, the adware program that came pre-installed on Lenovo machines, used a self-signed security certificate, known as a Certificate Authority (CA), to impersonate any SSL-enabled website.

That means it could trick a user's computer into connecting with a website by offering up its own, insecure CA, rather than the website's own, which a computer must receive to confirm the website is what it claims to be.

Known as a man-in-the-middle attack, this undermines the security of web browsers and operating systems, because it can see all of a computer user's actions, including banking, email and Facebook activity.

Lenovo was quick to state it didn't profile or monitor user behaviour, or record user information, and has now stopped shipping devices with the adware pre-installed.

However, Facebook security researcher Matt Richard warned other threat actors could re-use the Superfish CA on their own applications.

He wrote: "By reusing the same certificate, a bad actor could potentially obtain that CA file and perform "man-in-the-middle" (MITM) attacks on untrusted networks like public Wi-Fi, set up authentic-looking phishing pages, or sign software that makes people vulnerable to other malicious code as they browse the internet.

"In this case, the certificate used by the Superfish software is relatively easy to extract. Although we are not aware of anyone abusing this certificate in the wild, it's a real risk and would be hard to detect."

He said the social network has found more than 12 other software applications using the same fake certificate program as Superfish.

While Facebook is yet to determine the purpose of these applications, some of which appear to be Superfish-esque adware, he said a number of them are suspicious.

"What all of these applications have in common is that they make people less secure through their use of an easily obtained root CA, they provide little information about the risks of the technology, and in some cases they are difficult to remove," Richard added.

These applications are also unlikely to keep up with updates to the secure browser HTTPS protocol, meaning there's a risk they could expose private data to network attackers.

Superfish's fake CA comes from a company called Komodia, and Facebook found a Trojan horse, known as Trojan.Nurjax, using the Komodia's libraries of software development kits.

Lenovo has confirmed it has stopped shipping adware with its consumer laptops, which could have led to encrypted user data being compromised by hackers.

Known as Superfish', the program injected visual search results into the browser without user permission, according to forums unearthed by The Next Web.

While OEMs routinely install bloatware on Windows machines, the Superfish adware appeared to be dangerous, not just inconvenient. This is because it used a self-signed certificate, which if compromised, could have provided hackers with access to all browser data - regardless of whether it had been encrypted.

Lenovo's official statement

"We have thoroughly investigated this technology and do not find any evidence to substantiate security concerns," the firm said in a statement.

"But we know that users reacted to this issue with concern, and so we have taken direct action to stop shipping any products with this software.

"We will continue to review what we do and how we do it in order to ensure we put our user needs, experience and priorities first."

A Lenovo forum administrator tried to allay fears by stating Superfish did not "profile nor monitor user behavior" or "record user information". The firm has now confirmed it has stopped shipping devices with the software.

Many Lenovo users have expressed their dismay at the inclusion of the software.

"I have been working in tech software and systems engineering since mice were not even available for personal computers. I have never seen a brand, of any sort, come OTB with malware," noted a perplexed Lenovo customer.

"This is just unreal...and altogether unacceptable. Lenovo is a brand I always have associated with top quality, best practices trustworthy security. The brand has been rock solid, but sliding for years, and lately I have been having some concerns about its Chinese home...increasingly concerning to me in light of technology security and attacks originating from China."

Below is a tutorial showing users how to uninstall the adware. Those affected are also encouraged to install a fresh copy of Windows to make sure the rogue security certificate is completely removed from their system.

The article was originally published on 19/2/15 and has been updated to reflect with the latest statements from Lenovo.

Yahoo has confirmed a number of ads on its European sites were serving malware to visitors for three days over the New Year period.

The issue was first noted by Dutch IT security company Fox-IT, which said in a blog post it had detected and investigated infections suffered by clients who had visited yahoo.com.

According to the organisation, those who clicked on the ads were redirected to a Magnitude exploit kit, which can install various different malware including ZeuS, Andromeda and Necurs.

The malicious ads first appeared on 31 December until 3 January, after Yahoo removed them.

A Yahoo spokesperson told IT Pro: "At Yahoo, we take the safety and privacy of our users seriously. From December 31 to January 3 on our European sites we served some advertisements that...spread malware. Users in North America, Asia Pacific and Latin America...were not affected. Additionally, users using Macs and mobile devices were not affected."

The company said it is continuing to monitor the adverts appearing on its sites for any other suspicious activity.

Further information for users will also be posted shortly, the spokesperson said.

Security firm Malwarebytes has sounded the alarm on a new bogus Flash Player update which causes legitimate advertisements to be replaced with spam and inappropriate banners.

FlashPlayer11.safariextz is a convincing fake browser extension, Malwarebytes claims. It uses the correct Flash Player logo and even includes a hyperlink to the official Adobe website.

However, once installed, the application either introduces its own intrusive adverts or overlays the official ads on legitimate websites with its own.

According to Malwarebytes security analyst Jerome Segura, the authors of this rogue application are hoping to tap into the lucrative business of web advertising by generating revenue from users clicking on the fake adverts.

"Online advertising is a billion dollar industry and everybody wants to have a piece of it. With such invasive adverts, cyber-crooks are likely to generate a lot of views' and even pay per clicks," he said.

As pointed out in Segura's blog post, these adverts are not only intrusive, but also indiscriminate in what they display.

"Shortly after being installed, [FlashPlayer11.safariextz] will begin to inject very rough advertisements on any website you visit," said Segura.

"For example, I visited pbskids.org, a site for children to play games and watch their favourite characters, when all of the sudden a pornographic advertisement was displayed," he added.

According to Segura, the malicious extension is being pushed from various websites, but most commonly comes from adult websites.

He also said he found it "interesting that the bad guys are banking on the fact people are now quite aware of how important it is to apply software updates".

"This is why you should always install updates from the vendor's official website to avoid nasty surprises," he advised.

McAfee has reported what it claims is the most significant malware outbreak in three years, with more than 500,000 detections of a Trojan horse which masquerades as a media file.

A number of fake video and music files have been deliberately spread over peer-to-peer file sharing services like Limewire and eDonkey. These were malicious MP3 and MPEG files triggering the download of an application which served ads to the infected computer.

"People were downloading these files hoping it was music, but it was a media file format that allowed you to link to another site where you downloaded additional files," said Toralv Dirro, security strategist at McAfee Avert Labs.

"Those files downloaded turned out to adware that in some cases even asked the user to accept an end user licence agreement prior to installing."

McAfee saw this as 'medium' risk, with no other malware receiving that risk rating since 2005 as all others were rated less severe.

The security vendor claimed that it was the most prevalent piece of malware in the last three years, and that it had never seen a threat this significant come as a media file.

The huge figure came from retail users that had the option to submit data on what viruses and adware was detected on their computer to McAfee and made publicly available.

Dirro said: "We are currently seeing that the distribution is still going on. It is now at about 580,000 where files have been detected, so people are continuing to download and share these files."

The strategist said that these only reported the incidents that were actually detected, and the real number of users and computers affected would be much higher.

He said that although the damage in this case was not too serious as it was only adware, it could have been much worse and what McAfee were now afraid of in the future was attackers with a more sinister agenda.

"They could try and copycat this attempt as they have seen it is a very successful way to distribute malware," Dirro said. "In the future we are pretty much expecting this distribution method a lot more."

Dirro said that instead of pointing to adware, it could lead users to spyware which would instead try to steal people's data. Instead of being a multimedia file it could take the form of a directly executable one.

"It has happened in the past, but not anywhere close to this scale," Dirro said of the peer-to-peer nature of the attack.