0

During dynamic analysis, I have noticed that Adware and some Trojans modify the proxy settings within the Windows Registry. What is the purpose behind making this modification?

The most common keys I have noticed are:

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable

and

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyBypass

Improve this question
4
  • 1
    There are a lot of results for your question title on Google search. Have you looked up some possible reasons?
    – schroeder ♦
    Nov 17, 2015 at 3:38
  • Yep. They don't really answer my question sufficiently.
    – Bass
    Nov 18, 2015 at 3:14
  • Can you explain why? It will help the community to not repeat what you have already rejected.
    – schroeder ♦
    Nov 18, 2015 at 4:23
  • I apologize for the late reply. When I was originally researching the reason why this would occur I could only find forum posts for troubleshooting purposes. While most people identified that the modifications were likely due to some type of software installation they were not clear on the reason spyware/malware would do so. Had I been searching to resolve a compromise, those responses would have been helpful.
    – Bass
    Dec 15, 2015 at 15:15

2 Answers 2

Reset to default
2

There are several ways to inject ads or malware into a specific web page:

  • Inject into the browser itself using DLL injection or browser extensions: How this need to be done is specific for each browser.
  • Attack the server itself: But then you have only the single server compromised.
  • Or inject yourself in the connection between browser and server: This can be done be either modifying the proxy settings as in your question. This can also be done by modifying the DNS settings of the system like done by the DNSChanger trojan or even of the whole network by attacking the routers.

Thus changing the proxy is one of the easier ways to inject your ads and malware into all browsers on the system.

Improve this answer
1
  • Thanks! I thought that was a likely reason. I've seen browser injection used but typically it is done by Trojans whereas the proxy settings are normally via Adware.
    – Bass
    Nov 17, 2015 at 15:02
0

If you have ever used the adblock proxies you'd know that a proxy can act as a firewall or a secondary routing table. This being said, its possible to replace ads with your own malicious ones to earn money, its also possible to replace scripts in browser to serve malicious code...moral of the story...use HTTPS all the time

Improve this answer
4
  • How would using HTTPS solve the issue if you've hijacked the proxy settings of the client?
    – Bass
    Nov 17, 2015 at 15:01
  • You should notice that the browser is complaining about invalid certificates, if they are being modified. The malware would have to compromise the certificate store for the browser/OS to avoid those showing up. Try proxying a connection to a random HTTPS website using Burp or Zap, and you should get a warning in the address bar - this won't work with some sites, like Google, because they enforce a specific CA
    – Matthew
    Nov 17, 2015 at 15:12
  • It would stop the proxy from injecting code into a site
    – Chad Baxter
    Nov 17, 2015 at 15:33
  • Ah. Now that I think about it I've seen this happen with devices that perform DLP SSL inspection (man-in-the-middle). Thanks for the clarification.
    – Bass
    Dec 15, 2015 at 15:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .