A Large-Scale Analysis of Download Portals and Freeware Installers

Alberto Geniola; Markku Antikainen; Tuomas Aura

doi:10.1007/978-3-319-70290-2_13

A Large-Scale Analysis of Download Portals and Freeware Installers

Alberto Geniola, Markku Antikainen, Tuomas Aura

University of Helsinki

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Scientific › peer-review

3 Citations (Scopus)

Abstract

We present a large-scale study of Windows freeware installers. In particular, we look for potentially unwanted programs (PUP) and other potentially unwanted modifications to the target system made by freeware installers. The analysis is based on almost 800 installers gathered from eight popular software download portals. We measure how many of them drop PUP, such as browser plugins, or make other modifications to the system. In addition to these results, we find that most installers that download executable files over the network are vulnerable to man-in-the-middle attacks, which in the worst cases may be used to execute arbitrary code with elevated privileges on the target system. Moreover, serious man-in-the-middle vulnerabilities are found in application managers provided by download portals.

Original language	English
Title of host publication	Secure IT Systems: 22nd Nordic Conference, NordSec 2017, Tartu, Estonia, November 8–10, 2017, Proceedings
Editors	Helger Lipmaa, Aikaterini Mitrokotsa, Raimundas Matulevičius
Place of Publication	Cham
Publisher	Springer
Pages	209-225
Number of pages	17
ISBN (Print)	978-3-319-70290-2
DOIs	https://doi.org/10.1007/978-3-319-70290-2_13
Publication status	Published - 2017
MoE publication type	A4 Conference publication
Event	Nordic Conference on Secure IT Systems - Tartu, Estonia Duration: 8 Nov 2017 → 10 Nov 2017 Conference number: 22

Publication series

Name	Lecture Notes in Computer Science
Publisher	Springer
Volume	10674
ISSN (Print)	0302-9743
ISSN (Electronic)	1611-3349

Conference

Conference	Nordic Conference on Secure IT Systems
Abbreviated title	NordSec
Country/Territory	Estonia
City	Tartu
Period	08/11/2017 → 10/11/2017

Access to Document

10.1007/978-3-319-70290-2_13

OpenUrl availability

Full text

Cite this

Geniola, A., Antikainen, M., & Aura, T. (2017). A Large-Scale Analysis of Download Portals and Freeware Installers. In H. Lipmaa, A. Mitrokotsa, & R. Matulevičius (Eds.), Secure IT Systems: 22nd Nordic Conference, NordSec 2017, Tartu, Estonia, November 8–10, 2017, Proceedings (pp. 209-225). (Lecture Notes in Computer Science; Vol. 10674). Springer. https://doi.org/10.1007/978-3-319-70290-2_13

Geniola, Alberto ; Antikainen, Markku ; Aura, Tuomas. / A Large-Scale Analysis of Download Portals and Freeware Installers. Secure IT Systems: 22nd Nordic Conference, NordSec 2017, Tartu, Estonia, November 8–10, 2017, Proceedings. editor / Helger Lipmaa ; Aikaterini Mitrokotsa ; Raimundas Matulevičius. Cham : Springer, 2017. pp. 209-225 (Lecture Notes in Computer Science).

@inproceedings{e2bb77a0c4d24006871c842daabd8759,

title = "A Large-Scale Analysis of Download Portals and Freeware Installers",

abstract = "We present a large-scale study of Windows freeware installers. In particular, we look for potentially unwanted programs (PUP) and other potentially unwanted modifications to the target system made by freeware installers. The analysis is based on almost 800 installers gathered from eight popular software download portals. We measure how many of them drop PUP, such as browser plugins, or make other modifications to the system. In addition to these results, we find that most installers that download executable files over the network are vulnerable to man-in-the-middle attacks, which in the worst cases may be used to execute arbitrary code with elevated privileges on the target system. Moreover, serious man-in-the-middle vulnerabilities are found in application managers provided by download portals.",

author = "Alberto Geniola and Markku Antikainen and Tuomas Aura",

year = "2017",

doi = "10.1007/978-3-319-70290-2_13",

language = "English",

isbn = "978-3-319-70290-2",

series = "Lecture Notes in Computer Science",

publisher = "Springer",

pages = "209--225",

editor = "Helger Lipmaa and Aikaterini Mitrokotsa and Raimundas Matulevi{\v c}ius",

booktitle = "Secure IT Systems: 22nd Nordic Conference, NordSec 2017, Tartu, Estonia, November 8–10, 2017, Proceedings",

address = "Germany",

note = "Nordic Conference on Secure IT Systems, NordSec ; Conference date: 08-11-2017 Through 10-11-2017",

}

Geniola, A, Antikainen, M & Aura, T 2017, A Large-Scale Analysis of Download Portals and Freeware Installers. in H Lipmaa, A Mitrokotsa & R Matulevičius (eds), Secure IT Systems: 22nd Nordic Conference, NordSec 2017, Tartu, Estonia, November 8–10, 2017, Proceedings. Lecture Notes in Computer Science, vol. 10674, Springer, Cham, pp. 209-225, Nordic Conference on Secure IT Systems, Tartu, Estonia, 08/11/2017. https://doi.org/10.1007/978-3-319-70290-2_13

A Large-Scale Analysis of Download Portals and Freeware Installers. / Geniola, Alberto; Antikainen, Markku ; Aura, Tuomas.
Secure IT Systems: 22nd Nordic Conference, NordSec 2017, Tartu, Estonia, November 8–10, 2017, Proceedings. ed. / Helger Lipmaa; Aikaterini Mitrokotsa; Raimundas Matulevičius. Cham: Springer, 2017. p. 209-225 (Lecture Notes in Computer Science; Vol. 10674).

Research output: Chapter in Book/Report/Conference proceeding › Conference contribution › Scientific › peer-review

TY - GEN

T1 - A Large-Scale Analysis of Download Portals and Freeware Installers

AU - Geniola, Alberto

AU - Antikainen, Markku

AU - Aura, Tuomas

N1 - Conference code: 22

PY - 2017

Y1 - 2017

N2 - We present a large-scale study of Windows freeware installers. In particular, we look for potentially unwanted programs (PUP) and other potentially unwanted modifications to the target system made by freeware installers. The analysis is based on almost 800 installers gathered from eight popular software download portals. We measure how many of them drop PUP, such as browser plugins, or make other modifications to the system. In addition to these results, we find that most installers that download executable files over the network are vulnerable to man-in-the-middle attacks, which in the worst cases may be used to execute arbitrary code with elevated privileges on the target system. Moreover, serious man-in-the-middle vulnerabilities are found in application managers provided by download portals.

AB - We present a large-scale study of Windows freeware installers. In particular, we look for potentially unwanted programs (PUP) and other potentially unwanted modifications to the target system made by freeware installers. The analysis is based on almost 800 installers gathered from eight popular software download portals. We measure how many of them drop PUP, such as browser plugins, or make other modifications to the system. In addition to these results, we find that most installers that download executable files over the network are vulnerable to man-in-the-middle attacks, which in the worst cases may be used to execute arbitrary code with elevated privileges on the target system. Moreover, serious man-in-the-middle vulnerabilities are found in application managers provided by download portals.

U2 - 10.1007/978-3-319-70290-2_13

DO - 10.1007/978-3-319-70290-2_13

M3 - Conference contribution

SN - 978-3-319-70290-2

T3 - Lecture Notes in Computer Science

SP - 209

EP - 225

BT - Secure IT Systems: 22nd Nordic Conference, NordSec 2017, Tartu, Estonia, November 8–10, 2017, Proceedings

A2 - Lipmaa, Helger

A2 - Mitrokotsa, Aikaterini

A2 - Matulevičius, Raimundas

PB - Springer

CY - Cham

T2 - Nordic Conference on Secure IT Systems

Y2 - 8 November 2017 through 10 November 2017

ER -

A Large-Scale Analysis of Download Portals and Freeware Installers

Abstract

Publication series

Conference

Access to Document

OpenUrl availability

Fingerprint

Cite this