Christopher Boyd (IT security)

For other uses, see Chris Boyd.

Christopher Boyd
Other names	Paperghost [1]
Occupation	Computer Security Researcher
Known for	Computer Security

Christopher Boyd, also known by his online pseudonym Paperghost, is a computer security researcher.

Boyd was Director of Malware Research for security company FaceTime, before becoming a Senior Threat Researcher at Sunbelt Software (later known as GFI Software). In December 2013 Malwarebytes announced Boyd had joined their Malware Intelligence team to research new threats. ^[2]

Computer security

In July 2004, Boyd launched Vitalsecurity.org, a website bringing to the public attention issues of privacy and spyware.

In November 2004, a modular hacking technique was employed to compromise Windows end-users by hacking Apache servers. ^[3] When hacked, the servers would redirect a user on any of the server's websites, leading them to a set of ever-changing infection pages. These pages employed recoded viruses, trojans, malware and spyware. This technique is used heavily today by the groups behind the spyware CoolWebSearch (CWS).

The idea that alternative browsers such as Opera and Firefox could somehow enhance end-user security was cut down in March 2005 ^[4] with the discovery of a Java applet that, if agreed to, would install a large (and varied) adware bundle onto the end-user's PC. It was found that having the "rogue" site in the user's blocklists and security tools would do nothing, the install bypassing these tactics completely if the end-user clicked "Yes". An updated Firefox .XPI installer (which infected Internet Explorer) was also deployed in some of these installs. ^{[5] [6]}

BitTorrent controversy

In June 2005, it was discovered that more and more Adware makers were turning to alternative sources for their installs, as more end-users become aware of the more common install tactics. ^[7] A reliance on crude social engineering and P2P systems that were previously clean was now on the rise. Boyd discovered that BitTorrent forums and file-sharing sites were used as a major source of distribution for Aurora (a program produced by Direct Revenue) and a number of other major adware programs, wrapped up in bundles produced by Metrix Marketing Group (MMG), a company who lost control of their own network. ^[8] Potentially copyright infringing files, illegal pornography and incorrect / absent disclosure was exposed on such a scale as to cause the companies involved (Direct Revenue, 180solutions and others) to publicly declare their discontinuation of these methods.

This story caused such an uproar that numerous media pundits weighed in, and (in some cases) made a delicate situation worse. An article by John C. Dvorak of PC Magazine alleged Boyd was part of some "Grand Microsoft Conspiracy" to bad-mouth BitTorrent to the benefit of their planned P2P tool, Avalanche. ^[9] Furious P2P users (who were not familiar with the backstory of the investigation) even went as far to say Boyd was in league with the RIAA, out to create further problems for file-sharers by bringing these bundles to light. However - Dvorak's piece caused something approaching outrage on the other side of the fence, leading a fellow Ziff Davis Media publication to go head to head with Dvorak. ^[10] Dave Methvin of PC Pitstop followed up the investigation with his findings. ^[11] He alleges that some of the films distributed contained potentially illegal underage pornography, and not long after, MMG went offline and the Adware companies all pulled out of this particular distribution.

Fake Google toolbar

In October 2005, Boyd discovered a "fake" Google Toolbar which was being distributed via Instant Messaging. ^[12] The toolbar allowed the user to store credit card details, and also opened up a fake Google search page. Boyd also tracked the toolbar back to 2003, through three different versions, each one exploiting vulnerabilities in the Windows operating system.

Instant messaging rootkit

In October / November 2005, Boyd discovered what is considered to be the first known instance of a rootkit being distributed via instant messaging, hidden inside a large payload of adware and spyware. ^[13] Over a period of months, the group behind the attacks distributed numerous inventive payloads (such as a forced install of BitTorrent ^[14] to spread movie files) and were eventually traced back to the Middle-East.

Adware critic

Boyd is a notoriously fierce critic of adware companies, famously causing 180solutions to label him a "fanatic" on their Weblog, with bad feeling in evidence on both sides to this day. ^[15] He is regularly referenced on other leading antispyware sites such as Sunbelt Blog, Suzi Turner's ZDNet blog and Ben Edelman's home page.

Security discoveries

In 2006, Boyd continued to make significant discoveries in the field of security, including

• The discovery of a 150,000 strong Botnet ring that used a custom-built Perl script to steal payment data from third party shopping cart applications ^[16]
• An exposé of a web-browser that redirected end-users to potentially illegal pornography ^[17]
• An Instant Messaging Worm that installs its own web browser. ^[18]
• The discovery that Adware makers Zango were promoting their content on Myspace. ^[19]
• A modular, multi-chained string of infections dubbed the "Pipeline Worm". ^[20]
• An Instant Messaging infection that uses Botnet-style tactics to enable click fraud. ^[21]
• The discovery of a worm using QuickTime files to spread across MySpace with the intent of pushing Zango Adware. ^[22]

References

1. Valeros, Maria Eleanor E. "Meet Paperghost - the ethical hacker". Philstar.com.
2. "Paperghost is now Haunting Malwarebytes!" . Retrieved 6 December 2013.
3. Leyden, John (22 November 2004). "Bofra exploit tied to 'massive botnet'".
4. "Alternative Browsers and Java Lead Spyware to IE".
5. "Fake Private Videos Offer Surveys, EXEs and .XPI Installs | Malwarebytes Labs". Malwarebytes. 31 July 2014.
6. "Facebook profile viewer scams meddle with Firefox and Chrome browsers". Graham Cluley. 4 July 2013.
7. "Spyware Floods In Through BitTorrent".
8. "GFI LABS Blog".
9. Dvorak, John C. (2005-06-20). "The Scheme to Discredit BitTorrent". PC Magazine.
10. "There Is No Conspiracy Against BitTorrent".
11. "P2P Downloads Fuel Spyware".
12. "Fake Google Toolbars Go Phishing".
13. "AIM Rootkit Attack Traced to Middle East".
14. "Botnet Uses BitTorrent to Push Movie Files".
15. "Zango - Zealot or Fanatic". Archived from the original on 2006-01-28.
16. Brazen Botnets Steal From E-Shopping Carts - Security Technology News by TechWeb
17. "GFI LABS Blog".
18. Techworld.com - Hijack browser installed by new worm
19. Zango Blasted For Targeting MySpace As Adware Channel – News – InformationWeek
20. Researchers Watch AIM Bot Being Built – Security Technology News by TechWeb
21. "Botnet Tactics Enable Click Fraud - SecurityProNews".
22. MySpace worm exploits QuickTime feature | InfoWorld | News | 2006-12-04 | By Jeremy Kirk, IDG News Service Archived 2006-12-10 at the Wayback Machine