China: A New World of Adware Exploration

"Is it Adware? Spyware? Malware? Is the intent behind it malicious, or is it supposed to serve some useful purpose? How do we track the money streams? Will we be able to penetrate the networks behind the scenes and work out who the key players are? Most importantly, what do we do when faced with a EULA containing six million Chinese characters?" - Paperghost, quoting himself, just now, on the Internet

The hot new area of Adware research at the moment is all the crazy crap coming out of China - and it really does leave us somewhat up the creek with no paddle.

Let's put it this way - we have pretty much mapped out the Western World with regards spyware and adware. We know (mostly) who all the big players are, the (supposedly) legit companies, the chumps, the losers, the talented ones and the leet haxors. Pirates are busted left, right and centre, the carders are too visible for their own good, pop into the Shadowserver IRC chat and you'll witness bad guys happily discussing their plots for world domination with the good guys.....so on and so forth. Hell, we've even managed to map out most of the family groups and categories for all those dodgy files from gangs in the outermost reaches of Russia.

In short, when something comes up, you usually know

a) who to go to
b) where to make a big stink
c) how to get something pulled offline

China, however, is a staggeringly huge pain in the buttcheeks.

All those carefully mapped out networks of people behind the scenes - gone! All that knowledge of meticulously laid out families of infection files - no longer useful! The most basic thing of all - is this file supposed to be legit Adware or scumbag-tastic Spyware - flushed down the pipe! Who the Hell is this company anyway, and how on Earth do I get in touch with them, let alone deduce whether they're supposed to be the equivalent of our "legit" Adware vendors or a skanky, fly by night bunch of cowboys?

You can see where I'm coming from here.

Thankfully, I have a fairly decent network of contacts out East - but it's still nowhere near enough. In some ways, it's like the old days of Adware exploration are starting up all over again.

Check out the Coopen writeup on Spywareguide (if you haven't already), then grab your compass and dust off your map. There's a whole new heap of ass out there to kick, and something tells me it's going to be a longhaul flight...