The Internationalization of Malware

Ant brings us a write-up from a former malware analyst about the difficulties in fighting malware as it expands beyond English-language targets and into societies with different standards for privacy and security. Quoting: "One of the most fascinating facets of the increasing internationalization of malware is the cultural assumptions around such software. What is considered malware in the US may be commonly accepted in China or Japan, and this is largely due to the society that it exists in. Anti-cheating rootkits are very common in games released in these countries. What is considered to be invasive in the North American or European world is acceptable there. These anti-cheating rootkits would hook into the kernel space in a very invasive way, and have the behavioral characteristics of malware such as hooking into the keyboard driver. This made it very difficult from a purely technical standpoint to distinguish them."

Comments

Not news if you've tried to use a Korean website..

[crossmr]

The country lives and dies on activeX. Trying to do anything other than read basic text on most korean websites requires the installation of several activeX controls, which means IE only for a lot of sites. And if you want to create an account on one as a foreigner and don't have your foreign registration with immigration you can just give them copies of your passport..

Define it

[Anonymous Coward]

Malware is supposed to do Bad Things to your computer/information. If it's hooking into the kernel, it may not necessarily be malware, per se. It may just be doing business in the entirely wrong place.

Re:Define it

[Bieeanda]

Are Bad Things intentional effects, or can they include weird, destructive side effects as well?

I installed NCSoft's 'Exteel', a localized version of a Korean game, complete with the Game Guard nanny app that's nigh-ubiquitous when it comes to Korean games. While it probably wasn't intentional, Game Guard did disable the interface for my uninterruptible power supply when it ran, and wouldn't allow the service to reactivate until after it shut itself down.

Considered to be invasive...bla bla bla

[sakdoctor]

Or is it lack of awareness. Add south Korea to that list because is currently seems acceptable to have about 10 useless browser bars attempting to take over and uninstall the competitors bar in internet explorer.

Awareness didn't come overnight in North American or European either.

Re:Considered to be invasive...bla bla bla

[Anonymous Coward]

1. Most people dont know about it. For example the South Korean nProtect Gameguard is included over 80% of online games in Asia. Only after something went wrong and the games wont load, I investigated it and found out that it acted like a rootkit, then I stopped playing online games altogether.

2. It was marketed as "anti-cheat". It wasnt supposed to be malware, right?!

3. Online-Games companies are sick and tired of fending off cheaters themselves. On top of that you have online-cash suppliers that deploy millions of bots to collect cash, selling items, inflating prices and selling online-cash to gamers. So they turned to these "anti-cheat" software.

4. Selling online-cash is lucrutive. That is why so many malware target gamers' account. Cheating tools are rigged with trojan that wont be recognised by virus scanner, they wait for a few months and then start to steal your stuff.
Gamers like us are really pissed to see entire army of bot all over the map on every server.

5. On average, anti-cheat is about 50-60% effective, but they update it weekly. It also present a challenge. It is effective to stop a gamer to cheat, however, the cash-suppliers are in the cracking contest since it is highly lucrutive.

6. The anti-cheat tools like Gameguard is language-natural, it will look for cheating tools based on Unicode/Wide-char strings, in theory it will work for any online-games. Not to mention Punk-buster is also in the same league. Just that Gameguard is particularly nasty with hiding, extremely intrusive and difficult to un-install.

What is happening is ugly and convoluted. Especially when 90% of "characters" are bots. It is very easy to spot a bot, especially when the entire group is in action. I even had fun luring big bosses (some mmorpg has big boss on each map) to ruin their party. Some mmorpg even supply their official version of "automated tools" to run your own bots, just to keep the players in the game. What fun left when the entire map is occupied by bots, and the game is basically reduced to a chatroom with only a handful of human players?

It might happen to WOW, only a matter of time.

Up front, or covert?

[petes_PoV]

The main differentiator between an invasive monitor and malware is whether the author (or organisation employing it) uses it covertly, or if they make the user aware of what will happen.

If a piece of software makes it clear, before you purchase it, that it will install monitoring software on your machine and/or it would phone home then that's one thing. You have the option of not buying it.

If this situation only becomes apparent after the package has been installed, then (IMHO) that's not an acceptance practice.

I'm sure it's true within countries, too

[grizdog]

While most people probably don't consider them malware, a lot of people find internet ads intrusive and obnoxious and we install popup blockers to get away from some of them. But the advertisers wouldn't pay for them if someone wasn't reading them and clicking on them.

More to the point, there is a huge difference in what people care about regarding their computers. Many of my friends think I "put up" with a lot because I use Linux and install things relatively methodically, always keeping control of my system. I think they "put up" with a lot, because they have no idea what is running on their computers and what the machines might be doing with their information.

It concerns me that the anti-privacy people have time on their side, because after a few more years, they will just point out how so many people haven't been enjoying much privacy anyway, so what's the big deal?

Sony didn't only rootkit their CDs

[know1]

I was extremely pissed off with the whole sony rootkit debacle, which was covert. I was even more pissed off when they bought one of my favourite music production programs Acid Pro and I checked it for the tell-tale signs of the rootkit (the processes that are started with $SYS$ are hidden from the process list) and found it present in that too. If anyone uses this product then the last rootkit free version is Acid Pro 4. Just a heads up.

Different cultures indeed

[4D6963]

What is considered malware in the US may be commonly accepted in China or Japan [...] These anti-cheating rootkits would hook into the kernel space in a very invasive way, and have the behavioral characteristics of malware such as hooking into the keyboard driver

Indeed. And if you look back in history, you will find documented examples in medieval Japan of samurais making alliances with kernel-space rootkit developers to repel Mongol invasions. But it actually goes back to the roots of Zen Buddhism which de-emphasized the attachment to privacy and instead favoured experimental realisation, including with various sorts of early meditation-space thought-loggers.

In other words...

[DrYak]

...a computer in Japan is just another appliance.

They buy it as they would buy a second TV set for the kitchen, or a vacuum cleaner or table-top cooling fan, etc.

Nobody in his/her right mind care of the stats of a vacuum cleaner, except complete nerds.

Computers are slowly drifting toward that situation.

GSM phone have already reached that point almost worldwide - the only thing most people care is if there's "Apple iPhone" written on it.
And there are often enough articles on /. about remote cellphone's mic tapping, remote GPS polling, etc... to show that there slightly more than "what's written on the case" about a phone.