Adware

Adware is unwanted software whose purpose is to push advertising onto a device, usually arriving alongside something the user did mean to install.

Advertising is not malicious in itself. Adware becomes a security problem when it degrades the machine, when it collects information about the person using it, and when it opens a route for something worse.

It is normally classed as a potentially unwanted program rather than as malware outright, and that classification is part of why it survives: it sits in the space where a product can argue that the user agreed to it.

How it gets in

Almost always by consent that nobody read. Adware travels bundled with free software, with browser extensions, and with downloads from sites that repackage legitimate installers.

The installer offers a default option that includes it, in a step designed to be clicked through. The user accepts, and the machine now has software neither wanted nor noticed.

What it does once it is there

Adverts where they do not belong. Pop-ups, injected banners, text links inserted into pages that never carried them, and a browser start page and search engine that have quietly changed.

Tracking. To choose what to show, it watches. Browsing history, search terms and habits are collected and sent on, which is a privacy problem regardless of what the adverts are for.

A machine that got worse. Processes running constantly, memory and bandwidth consumed for someone else’s revenue, and a browser that no longer behaves the way its user configured it.

A route in. Some families redirect to malicious sites or fetch further payloads, which puts them next to a dropper in behaviour if not in intent.

A worked example

Somebody downloads a free photo editor from a site that is not the vendor’s own.

The installer works, and the editor works. It also installs a browser extension nobody asked for.

From then on the browser opens on a search page that is not the one that was set, results carry sponsored links above everything else, and pop-ups appear on sites that do not sell advertising.

In the background, the extension has permission to read every page visited, which is what makes this a security incident and not an annoyance.

Where this shows up in an audit

Adware on a corporate machine is rarely interesting on its own. It is interesting as evidence: it means software was installed outside the approved route, that the browser accepts extensions nobody reviewed, and that whatever else came through the same door was not stopped either. The finding is not the adware. The finding is the path it proves is open.