A Large-Scale Analysis of Download Portals and Freeware Installers

• Published in: Secure IT Systems Vol. 10674; pp. 209 - 225
• Main Authors: Geniola, Alberto, Antikainen, Markku, Aura, Tuomas
• Format: Book Chapter
• Language: English
• Published: Switzerland Springer International Publishing AG 2017; Springer International Publishing
• Series: Lecture Notes in Computer Science
• ISBN: 3319702890; 9783319702896
• ISSN: 0302-9743; 1611-3349
• DOI: 10.1007/978-3-319-70290-2_13

We present a large-scale study of Windows freeware installers. In particular, we look for potentially unwanted programs (PUP) and other potentially unwanted modifications to the target system made by freeware installers. The analysis is based on almost 800 installers gathered from eight popular software download portals. We measure how many of them drop PUP, such as browser plugins, or make other modifications to the system. In addition to these results, we find that most installers that download executable files over the network are vulnerable to man-in-the-middle attacks, which in the worst cases may be used to execute arbitrary code with elevated privileges on the target system. Moreover, serious man-in-the-middle vulnerabilities are found in application managers provided by download portals.