0

During dynamic analysis, I have noticed that Adware and some Trojans modify the proxy settings within the Windows Registry. What is the purpose behind making this modification?

The most common keys I have noticed are:

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable

and

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyBypass

4
  • 1
    There are a lot of results for your question title on Google search. Have you looked up some possible reasons? – schroeder Nov 17 '15 at 3:38
  • Yep. They don't really answer my question sufficiently. – Bass Nov 18 '15 at 3:14
  • Can you explain why? It will help the community to not repeat what you have already rejected. – schroeder Nov 18 '15 at 4:23
  • I apologize for the late reply. When I was originally researching the reason why this would occur I could only find forum posts for troubleshooting purposes. While most people identified that the modifications were likely due to some type of software installation they were not clear on the reason spyware/malware would do so. Had I been searching to resolve a compromise, those responses would have been helpful. – Bass Dec 15 '15 at 15:15
2

There are several ways to inject ads or malware into a specific web page:

  • Inject into the browser itself using DLL injection or browser extensions: How this need to be done is specific for each browser.
  • Attack the server itself: But then you have only the single server compromised.
  • Or inject yourself in the connection between browser and server: This can be done be either modifying the proxy settings as in your question. This can also be done by modifying the DNS settings of the system like done by the DNSChanger trojan or even of the whole network by attacking the routers.

Thus changing the proxy is one of the easier ways to inject your ads and malware into all browsers on the system.

1
  • Thanks! I thought that was a likely reason. I've seen browser injection used but typically it is done by Trojans whereas the proxy settings are normally via Adware. – Bass Nov 17 '15 at 15:02
0

If you have ever used the adblock proxies you'd know that a proxy can act as a firewall or a secondary routing table. This being said, its possible to replace ads with your own malicious ones to earn money, its also possible to replace scripts in browser to serve malicious code...moral of the story...use HTTPS all the time

4
  • How would using HTTPS solve the issue if you've hijacked the proxy settings of the client? – Bass Nov 17 '15 at 15:01
  • You should notice that the browser is complaining about invalid certificates, if they are being modified. The malware would have to compromise the certificate store for the browser/OS to avoid those showing up. Try proxying a connection to a random HTTPS website using Burp or Zap, and you should get a warning in the address bar - this won't work with some sites, like Google, because they enforce a specific CA – Matthew Nov 17 '15 at 15:12
  • It would stop the proxy from injecting code into a site – Chad Baxter Nov 17 '15 at 15:33
  • Ah. Now that I think about it I've seen this happen with devices that perform DLP SSL inspection (man-in-the-middle). Thanks for the clarification. – Bass Dec 15 '15 at 15:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.