Investigating commercial pay-per-install and the distribution of unwanted software

Kurt Thomas, Juan A. Elices Crespo, Ryan Rasti, Jean Michel Picod, Cait Phillips, Marc André Decoste, Chris Sharp, Fabio Tirelo, Ali Tofigh, Marc Antoine Courteau, Lucas Ballard, Robert Shield, Nav Jagpal, Moheeb Abu Rajab, Panayiotis Mavrommatis, Niels Provos, Elie Bursztein, Damon McCoy

    Research output: Chapter in Book/Report/Conference proceedingConference contribution


    In this work, we explore the ecosystem of commercial pay-per-install (PPI) and the role it plays in the proliferation of unwanted software. Commercial PPI enables companies to bundle their applications with more popular software in return for a fee, effectively commoditizing access to user devices. We develop an analysis pipeline to track the business relationships underpinning four of the largest commercial PPI networks and classify the software families bundled. In turn, we measure their impact on end users and enumerate the distribution techniques involved. We find that unwanted ad injectors, browser settings hijackers, and “cleanup” utilities dominate the software families buying installs. Developers of these families pay $0.10–$1.50 per install—upfront costs that they recuperate by monetizing users without their consent or by charging exorbitant subscription fees. Based on Google Safe Browsing telemetry, we estimate that PPI networks drive over 60 million download attempts every week—nearly three times that of malware. While anti-virus and browsers have rolled out defenses to protect users from unwanted software, we find evidence that PPI networks actively interfere with or evade detection. Our results illustrate the deceptive practices of some commercial PPI operators that persist today.

    Original languageEnglish (US)
    Title of host publicationProceedings of the 25th USENIX Security Symposium
    PublisherUSENIX Association
    Number of pages18
    ISBN (Electronic)9781931971324
    StatePublished - Jan 1 2016
    Event25th USENIX Security Symposium - Austin, United States
    Duration: Aug 10 2016Aug 12 2016

    Publication series

    NameProceedings of the 25th USENIX Security Symposium


    Conference25th USENIX Security Symposium
    Country/TerritoryUnited States

    ASJC Scopus subject areas

    • Information Systems
    • Safety, Risk, Reliability and Quality
    • Computer Networks and Communications


    Dive into the research topics of 'Investigating commercial pay-per-install and the distribution of unwanted software'. Together they form a unique fingerprint.

    Cite this