Why do malware creators use such clever technologies for such silly purposes?

Question

Some days ago I got infected by a malware, probably something new and very clever, as it went in unstopped and no scanning tool was able to detect it afterwards (see this question).

It was a two-stage infection: first an obvious malware went in via Internet Explorer (fully patched, so there probably is some still unknown hole there) and started running and doing silly things like hiding all my files and flashing fake system warning popups asking me to reboot due to a "disk controller malfunction"; this was probably a way to trick me into rebooting to load the actual malware. Then, after this was removed (very easily, a simple Run Registry key), it left a rootkit behind which was absolutely undetectable... but that kept doing silly things too, like hijacking Google searches and launching background iexplore.exe processes which were clearly visible in the Task Manager (wonder what they were doing, though). At last, I was able to get rid of it by rewriting the system drive's MBR and boot sector, where some loader code had been hidden; I still don't know what that was actually loading, though.

What I'm wondering now is: people writing malware are becoming increasingly clever, using more and more advanced stealth techniques... and yet, they keep using these powerful tools to do silly things like showing advertisements, which by now almost everyone recognizes as a sure sign of malware infection (and who ever does click on them, anyway?). If it wasn't for the search hijacking and background iexplore.exe processes, I'd never have guessed a rootkit was still there after the "main" infection... and, if the "main" infection hadn't played aroud with attrib.exe to make me think all my files had disappeared, I would have just not noticed it and it would have been free to load the rootkit upon the next reboot (which, being that a home computer, would for sure have happened in at most a day).

Such a stealth rootkit could have stayed there for a long time, if it didn't make such efforts to show its presence; and it could have done real damage, like installing a keylogger or taking part in a botnet; which it maybe also did, too... but since it was so obvious the machine was infected, I started looking for a way to clean it, and found it (or otherwise I'd have just formatted, which I'm going to do anyway, just to be sure).

So, the question remains: why all of these clever infection and stealth techniques are being wasted on showing useless advertisements?

Answer 1

Various reasons:

Attacker is often not the Developer - Developers of malware sell the packages to anyone - the payload will be then defined by the attacker. Some attackers want to be stealthy - some don't, in fact some delight in being obvious and notorious.

Practice - developing techniques

Apathy/Ignorance - end users are really no good at fixing problems that can't be resolved by clicking on antivirus or malware cleaners.

Money - click-thrus and clickjacking can make good money. Viagra/Cialis spam also makes money. Fake-malware removal tool downloads can make a lot of money.

Answer 2

The answer is simple, and it's a similar phenomenon to the the anthropic principle, called survivor bias. There are many, many stealthy viruses that stay in place a long time, because they don't do this—but you don't ever hear or think about those, for the very reason that they're stealthy. Remember, what you're really asking is, "Why do I see so many non-stealthy viruses compared to the number of stealthy viruses I see?" But of course, you don't see the stealthy ones.

Answer 3

My first guess is : Money. And my second would be : challenge. Eventually you could add : pranks. (Maybe for the first malwares that was developed :D)

But malwares are also worms and viruses. So we may add to the potential gains :

• Have access to computer (botnet, proxies) => stealth
• Steal high valuable data => power, reputation
• Scare end-user and gain money => deception

Directly or indirectly, that implies money.

Maybe one of them is for world's domination though. (joke?)

Answer 4

What you are describing sound like FakeAlert or fake antivirus/pc booster/system optimizer software. The sole purpose of the software to get you to buy the "Full" edition to get ride of non existent problems, or problems it has created. They may add advertising on the side, hence Google search diversion...etc.

It's not silly malware. It's there to make money, although it won't make much on an individual system, a large deployment on maximum number of computers usuaully brings good returns. Besides the operators are just using a kit they purchased, hence it doesn't make sense at first using complex kit for such purposes.

Answer 5

Perhaps they are even more clever than you think: they create an obvious infection with annoying popups and a rootkit which is easily removed. So you think you are clean now. However: the real infection is still there but is even more cleverly hidden. Keep a close eye on your bank-account....

Answer 6

One answer is that you have a few classifications of that business model. Just if you bought a franchise, you would be purchasing a proven profitable "system". Malware and botnets could be considered a digital equivalent of that.

Unfortunately it is a vicious circle but I don't forsee it stopping because human nature includes greed. Say someone in China or Ukraine writes a new malware exploit they are more than likely doing it for the cash. Next users become infected and AV companies find out about it and create a "fix" and push the sales of their suites based on "On our product we usually have fix's to most users infections in hours VS days".

So people buy that product, but then they get "infected again" then they usually take their systems to some type of retail store who may or may not know what they are doing (toss coin here) to remove the threat(s). If the store can't figure it out then some of us (competent admins/tech's) get a call to "fix" or remove the infection(s). After resolvin the issue I always install a 3rd party HOSTS file to block a lot of crap from coming through to begin with. Why do AV companies not implement some sort of hosts blocking you might ask? $MONEY$ is always the answer. Point still being the circle makes money, bad guys, companies and the good guys will all get paid at some point in time.