good afternoon everyone we're ready to
start with the last session of North sac
we will have Hugo presenting Hugo with a
malware researcher with ESET and he will
be talking about why Jam so please join
me in welcoming Hugo
[Applause]
so hi everyone so thank you for coming
to my talk even if this is the last one
of the day so today I'll represent you
the story of what Jam so this is a
social search engine developed by a
famous Montreal startup which became a
massive spread adware so what about me
my name is ego I work at the Montreal
office of ESET as a malware researcher
and basically my work consists to track
different kinds of my issue software and
analyze them and assertion essentially
in doing reverse engineering so here is
the agenda for this presentation first I
will present you a jam as a company as
well as their product and the reasons
behind this research then we will go
through the story of what Jam to get a
bit of context the next two sections
will be about the analyze of the
different versions of the software we
collected and you will see the
techniques used by what Jam in the
software look a lot like techniques
typically typically used by malware's
and finally finally and we give you some
takeaways of this research and what is
research patent in evidence so let's
start with a brief presentation of what
Jam
bust as a company and the software so
what is wedge am what I am internet
technologies the company founded in
December 2008 in Montreal by Metallica
Trimble this is a famous entrepreneur in
Quebec I participated at some popular TV
shows like the Dragons Den and the only
product that this company is a social
search online application so basically
it allows searching through the content
share by your relations and the social
networks like Facebook LinkedIn Twitter
or even Google Plus which doesn't exist
anymore in certain
and here is an example of what result
you could expect in using wet jam so
when you use an online search and drying
like Google for example it will give you
the content share by friends and social
networks related to the keywords you
search for and as you can see that there
are no ads and this example but this
one's comes from wet John directly this
is an actual example of a Google search
with wet jam and you can see the ads and
the the Facebook Twitter contextual menu
at the top so you can see what John adds
and maybe you can wonder why we did this
research at this kind of software we
could be actually useful and actually we
knew what John for several years but we
really started to look at it when
Malwarebytes published an article about
my quest malware intercepting encrypted
traffic for add injection and
malwarebytes don't leak into a jam but
the domain names use were the same and
injection process of adware was the same
so then one or two months later we found
a Windows version of wet Jam based on
the kernel driver to intercept traffic
and also as we work in a Montreal office
this is a local local story for us so we
wanted to fill the gap between the
public reporting and actual behavior of
what Jam so this we started to look
deeper at the different samples and as
well as the previous one from from 2011
so yes of course I love studying white
wares and so before looking at the
technical part and the analyze of the
software let's go through the unique
history of the company to get a bit of
context so what Jam history stands with
a lot of success the company has been
rewarded
time and was a claim by many famous
magazines like Forbes or different local
newspapers so this was really a success
story in Montreal and even with students
why Jam the sponsor was a famous
Montreal student Claire the DCI so this
is in French sorry for the
english-speaking persons and but however
the success story is balanced by the
important number of user complaints
regarding the the behavior orders of the
software and as you can maybe see and
the examples most most of the users
complain about the unwanted installation
of webcam and their machines and the
heavy display of ads making the software
almost universal and one of the other
where Jam issues is the collection of
personal information so I represent more
about the kind of information that what
Jam collects later but in 2016 the
office of the Privacy Commissioner of
Canada initiated a complaint against
against the company for breaching the
personal information protocol protection
and electronic documents Act so
basically this is the federal privacy
law for private sector organizations and
it set out the ground rules for how
businesses must handle personal
information in the course of commercial
activity so as you can see on this
timeline the investigation of the OPC
started in June 2016 and the final
report was published in August 2017 and
during the time of the investigation
what John transferred all his assets to
uncle company called Iran Montaigne
technology limited I am here also one
interesting thing you can found by G OPC
is the progressive and silent removal of
LinkedIn Google+ and Facebook of their
software between 2012 and 2014 so this
means that from 2014
it was only possible to see Twitter
results when using wooja-- so here is
the the the company webcam
funds this assets - so here is a
screenshot of their website and to get a
bit of context and this is the answer of
what John - the report of the OPC in
August 2017 and basically what John
stated that it was no longer accountable
for inglés practices so however even the
OPC had some tabs whether the two
organizations where regimen I until were
actually entirely separate entities and
if we go further in the report it says
they observed that Island chair was
incorporated in November 2016 what the
investigation was ongoing so and beside
the director of the company specialized
in the providing business relocation and
copyright services to businesses wishing
to establish a presence in Hong Kong so
quite curious and a few months ago
actually in October 2010 18 services in
French a local press investigation
published and analyzed the report of the
OPC and it's supposed interesting
elements regarding the transfer of what
John 2d to this new company and
basically if you look at the the
physical address of a lien TL on their
website it matches exactly with the one
of another company called Venusian
secretarial group so as you can see so
we can we can wander some something this
is rather curious and if we look at the
services offered by this company we can
see the specialize in offshore company
incorporation so curious again and this
is actually from the from their website
they said that the display is simply the
company name in
in the reception area and documents
transferred to the original company so
this is kind of of Korea but anyway now
we have some context let's move to the
technical part and we begin with the the
common observation among the different
version of what Jam we observed and how
we classify them so this was not an easy
task
we collected an important number of wide
jam samples and so the first step was to
classify them both by versions and
features so the first observation was to
see that what Jam is that the only name
used in the software but there are many
others like social research search page
and search razón for example but
hopefully thanks to the the metadata of
the samples and mainly Windows exactly
executables like the PDB pass and the
product version it was possible to
classify them so here is some example of
version numbers and PDB paths we we
collected over the years and as you can
see there there are some very explicit
like what Jam proxy or DLL injection and
it's interesting to observe that from
2017 when the company was sold the PDB
path started to be random characters and
actually the most recent version in 2018
and 2019 are even more random and seem
to follow a specific pattern so
suggesting a possible automatic
obfuscation also the version numbering
suggest there are certain versions but
actually we've only observed the version
one two three nine eleven and thirteen
so also there is the there is the peers
in signatures so it was also a good way
to recognize and watch on samples and as
the executable was signed with the
domain names of web jump and maybe you
could recognize some of them because
they use actually Montreal street name
for for the domain names
and basically the Quebec Enterprise
register was quite useful to make the
link between the domain names and what
job as a company so as you can see the
many different domain names such as the
iPhone starter install apps and many
many others using a Montreal street name
mostly so yeah the different version we
could identify so we were we we group
them by their features and codebase even
if they even if they are distributed
with a different name or a different
version number and basically we
identified five different versions of
virgin one browser extension called the
priam 3 different version for Windows
and one for Mac OS distributed from 2007
so as you can see the name of what john
progressively disappeared and other
names like social to search and search
awesome wherever used so regarding the
features each version finally does the
same thing and Ageing sub remote
javascript code and the users web
traffic but the difference between each
version resides in the technique used to
perform the traffic interception so once
the software is able to performed in the
interception it unloads a list of
supported website so did the list Maps
domain name to specific JavaScript file
and for each URL the the what John will
check what John will check if the domain
name matches with the with any domain
name in the list and if it matches it
injects the ads and the tweets
corresponding to the user keywords so
here is an example of what Ram list of
supported web sites so there are
essentially search engines
approximately 100 and the version of the
list is identified by ash and the date
either
every 50 seconds for four for example
but the most important fill here is the
dissipated site also as you can see
there there is also a field to blacklist
some processes so if we look at one
example it's really looks like this so
there is the rejects pattern to match
the website so here Google for example
and the past of the remote JavaScript
file to twinject so this is the the
JavaScript file for Google for example
so it injects another file and this is
the one responsible for the ads
injection so what I'm progressively
corrected more and more information
related to its users so either during
the installation or when the software is
running and basically there are some IDs
to identify a particular users a lot of
blogs are sent to Virgin servers during
the installation process to ensure it is
done properly and the same with eNOS in
the installation sorry and some
information to the setup of the user
like the list of the software installed
or the model of the machines also sent
to the Virgin servers so here is an
example of network capture during an
installation of webcam on the Windows
machine so you can see a lot of logs get
some fire also regarding the
distribution as I said before a browser
extension was initially available from
the web the web cam official website
till 2014 but it is essentially diffused
by using the pay per install
distribution model and according to the
the opcd office of the Privacy
Commissioner of Canada the the report I
published in the in 2017 they used more
than 50 different PPI providers between
2011 and 2016 so this model
was criticized several times for its
usage of fake out of Flash Player
antivirus installers to deceive the user
and also the gav presence of adware and
even malware in some installers so for
the ones we are not familiar with this
model and it is based on the revenue
sharing and Commission so basically the
kingpin at the top set up a pay per
install website it recruits some
affiliates which are able to massively
spread the installers bundle by the
kingpin and they are paid for each
success installation so instead the
adware is instant on any user machine it
generates money for the adware company
and so that way a company will pay again
the kingpin for distributing it it's sad
where and etc so now we have seen there
the common features let's look deeper at
the techniques used by wagon and
especially the ones to perform traffic
interception so as I said before the the
first version was distributed as a
browser extension so it can easily
inject JavaScript code in any web page
with this manifest file so it matches
any anywhere on HTTP or HTTPS and an
interesting point is that some older
versions contain traces of a screen
crept capture plug-in but it seems that
the full code was never implemented and
also it was a the dos versions were able
to send the bookmarks of the user to
toejam servers and the browser extension
was not distributed is not distributed
since 2014 and they basically removed
the link to download it from their
website so here is some some traces of
the other screen capture plug-in in the
code so it comes out as
along the the browser extension and this
is one of the JavaScript files of what
ROM using the in the browser extension
to the to the left this is an old
version which leaked the bookmarks of
the user and the right the the latest
version so you can see that they remove
this figure so this is the the download
link before 2014 and after 2014
so as they were doing ads injection the
browser insertion was quickly flagged as
adware by security products so at first
we we can try the the we can see that
that what I'm try to to to us to remove
the detection but this actually did this
quickly change from 2014 so at the time
of the the browser extension was not
distributed anymore
we found another version of wide Ram
internally called WG proxy and for
Windows only and the instead of using a
browser extension to to intercept
traffic it set up so a web proxy a
third-party web proxy called the called
fiddler and also we observe the data try
to elevate the privileges using the sed
by privilege token and it's a root
certificate to intercept encrypted
traffic and avoid security warnings when
injecting JavaScript code in web page so
from what we saw the dispersion was not
distributed since 2060 this one is more
interesting so in a few months after the
the proxy violent we observed another
version with different names and
different features and the techniques
used by this one a much more aggressive
I will I would say so instead of using a
proxy it injects a dll in web browsers
to the functions manipulating clear
clear traffic and so inject ads so
different injection techniques can be
used I represent you
them to you in the next slide and also
in 2016 the they add a mini filter
driver so basically I would get to
either the software to antivirus
projects and finally they I did
progressively some anti analysis
mechanisms like strings and and the
payload encryption and checks for anti
virus keys in the in the Windows
registry so this is the simple string
encryption which in the used used by the
samples of agencies only one bugs or not
complicated at all
and also they use some encryption
algorithm like aes-256 and the Earth's
before to 20 creep other files
so here the checks of antivirus keys so
as you can see each registry registry
registry key is first decrypting and
basically if one of these keys if is fun
it just send the information to the
watchin servers and does nothing with it
so here is a sample of the architecture
of this version so basically there is a
main executable with which inject the
the dll in web browsers the DLL is
responsible to hook the functions
manipulating create traffic as I said
before like we are right we are real and
or you can be send receive etcetera and
as I said before there is a mini filter
can a driver was proposed is to ID the
main executable and the DLL to other
processes so there are different DLL
injection techniques I think that can be
used depending on the parameters even to
the main executable so we observe three
main ones it can use the set windows Oak
X technique the create frame of thread
the usage of a third-party blackboard
memory action library
so under the dll is injected it chooses
this file to set up the hooks or well
you can use this file but not
exclusively and it contains the
addresses to of the functions for every
brother every version of every brother
listed here so as you can see there are
hooks for more than 100 1000 different
version of proms and you can maybe
observe that there are no nukes for
Firefox because the addresses are
resolved that execution time so here is
an example for Chrome with the addresses
to hook you can recognize maybe appear
right period pier right it's day 1 and
here is an example of for pier right
so from Ida so basically one of the
function responsible for sending traffic
and basically the function set will
modify the pointer to the real pier
right by the fake one and this is the
fake pier right we'll which perform the
injection if the domain name matches
with one of the spotty lists then it
calls the the real pier right so as I
said before some versions include a mini
filter driver to I the files of the
software so magically what what is
driver does its intercept IO input and
output operations before they reach the
file systems so it can even can be used
to monitor accept reject the dos
operations and the most known example it
will be antivirus or more generally
security product and so it I'd it I'd
watch on files to all processes except
to a restricted list so here is the
architecture so you can see the the i/o
manager responsible to to under the i/o
operations so basically you can register
a mini filter to the filter manager so
like an antivirus
- a German filter it can be activity
monitor for example and so the the i/o
operation are filtered before reaching
the filesystem driver the mini filter
driver comes with a configuration file
so they use the name a PC W that as you
can see in the configuration and
basically the driver has a white list of
processes and sort of the files of what
ROM are hidden to any process except the
ones in this list so this is more
they're mostly web browsers as you can
see so this was for the for this version
of wagon and we we in 2016 we identified
an another version that goes deeper into
in the canal so very more persistent and
its main characteristic is the usage of
an ED filter driver to intersect web
traffic so this version is still
distributed and build it almost every
day every day also a lot of techniques
have been added for the self-protection
purposes like the use we suggest we we
we think that they use the commercial
office cater tool to the bypass Windows
Defender and and they add signatures and
for the for the executables with
different certificates so the net filter
driver is based on the net filter SDK so
this is the framework for filtering the
data packets transmitted via via
networks it can operate at different
levels of the tcp/ip network stack
depending of what you want to do with it
so this is the the global architecture
of this version so there is a net with a
driver and the mini filter driver to
either the the different files of a
forum and it shows that what Ram is much
more implemented
much more
persistent and then before so here is
what the D string encryption looks like
in the Indus version and actually maybe
it looks easy like like that but it's
actually kind of annoying to to analyze
because each decode char version the
decode function is different depending
on the string that that is decrypted so
here for example it decode a function
name and and it gets its address with a
lot library and get proc address which
is typically used by by malware and this
is the decode char technique so it just
may perform an arithmetic operation to
get to get a character for the for the
function name so this is funny because
it looks a lot like the dystonic surface
cater and which is this do similar
techniques but we can be sure 100% so
there are also a configure configuration
files for the date so what you can see
on on this configuration file they named
the the net filter driver dis dis booth
now this is still the name used and
there is also a field for a difference
driver so this is basically the net
filter driver and the different the
different name are you as you can see
social to sir the researched not
completely used by that they used
different names and a slightly different
from the from the the the usual name of
a fortune that's all for this version
and as I said at the beginning of this
presentation we began this research
because of a Mac OS version of word jam
fund by malwarebytes a few months ago
and but actually this version was
already distributed in 2017 and at that
time it used a safari plugin so the web
browser from a quest to winter separate
to intercept traffic so they switch to a
third-party Python proxy
cold and my TM proxy in 2018 and from
what we saw there there's no official
distribution of this version and we only
saw it in fake Mac OS application cracks
distributed through Toyota whines file
so here is the info.plist
so basically this is the the manifest
file for mac OS application bundles and
the object of the application with the
the Safari plugin and you can probably
see the the virgin domain and largely
technology and here is the the my chimp
version with the the webcam domain as
well and sorry the judge does the same
thing as you as your other versions so
now we have seen the techniques you use
by what gem what what can we learn from
this and what can what are the take your
takeaways of this research so first why
Jam is still very active even if the
company was sold in early 2017 and the
the sample has distributed the through
paper install so massively spread the
GOP see the office and privacy
Commission of Canada estimate there are
hundreds of millions installations over
the between 2000 2011 and 2016 they use
different names so troe soem social
search search page etc and the self
protection anti detection techniques
most of sticky more sophisticated than
liver also that there is a post effect
of the GOP scene investigation if you go
under the wagon website with the
Canadian IP address or a non Canadian IP
address and basically the devolution of
the techniques use show that what John
was more and more persistent over the
years and they mainly used third-party
tools like filler blackboard milk and my
chimp Roxy or even that filter this is
actually probably because of the
security mechanisms added over the years
to prevent the usage of these techniques
that are typically used by malware's
actually also we can observe a change of
strategy regarding the the detection in
2014 and before the the add antivirus
for detection removal and from 2014 we
can see they they use more aggressive
techniques and like obfuscation like
checks antivirus installed on the
machine
they used random names and created
installers and etc regarding the
prevention it is quite simple because
even if our Jam used multiple
distribution channels due to the paper
install distribution model it's still
very visible and you still can use the
Installer to to do this install training
star bottom quite reliable however we we
have seen some silent hands terrors
which does not ask for the we do not ask
for the the User Agreement - for the
installation so a few plans for the
conclusion so the wait time story a
famous Montreal startup they
progressively progressively deceived the
users because the massive usage of
contextual advertising this is the
company sold in some crews circumstances
but still this is the context and that
the software is still more active than
ever
this research showed that adware and PUA
are still a gray area they used
typically malicious techniques as you as
you have seen there are more protected
than most of the malware this is a
reality and but at some point they're
more annoying before they only display
ad than unfold to the user that even if
the if they collect a lot of information
they can help to identify you a
particular user and also to get more
context some other where are remarkably
close to malware the example of standing
Co is one of them so you should be aware
of the persistence level used by some ad
where's okay you have seen that they use
some techniques in the directly in the
kernel so actually the this kind of
techniques could be attacked by another
man we're looking for persistence the
methods and the system so at some point
is it really something that you want on
your machine so let's all thank you for
your attention
[Applause]