2019 - Hugo Porcher - Wajam: From a Start-up to Massive Spread Adware

Hugo Porcher, a malware researcher at ESET's Montreal office, presents a comprehensive analysis of Wajam, a social search engine that evolved from a promising Montreal startup into massive spread adware. Founded in December 2008, Wajam initially allowed users to search through content shared by friends on social networks like Facebook, LinkedIn, and Twitter. However, the company faced significant user complaints about unwanted installations, excessive ad displays, and unauthorized personal information collection, leading to a 2016–2017 investigation by Canada's Privacy Commissioner. The company transferred its assets and went through multiple name changes, including Social to Search and Search Awesome.

Porcher identifies five distinct versions of Wajam distributed from 2007 onward, each employing increasingly sophisticated techniques for traffic interception and ad injection. The earliest browser extension version (until 2014) used JavaScript injection through manifest files. The WG Proxy version attempted privilege elevation and installed root certificates to intercept encrypted traffic. Later versions employed kernel-level techniques including DLL injection into web browsers with hooks into functions manipulating HTTP traffic, mini filter drivers to hide Wajam files from antivirus products, and net filter drivers operating at the TCP/IP stack level. Each version checked for installed antivirus software, used string encryption and obfuscation, and became progressively more persistent.

The software collected extensive user data during installation and runtime, including installed software lists and machine models. Distribution primarily occurred through a pay-per-install model with over 50 different PPI providers between 2011 and 2016, often bundled with fake Flash Player or antivirus installers. The Office of the Privacy Commissioner of Canada estimated hundreds of millions of installations during the company's active period. A Mac OS version using a Safari plugin was distributed in 2017 and later switched to mitmproxy.

Porcher highlights that Wajam's evolution demonstrates how adware occupies a gray area between traditional malware and acceptable software, employing kernel-level persistence techniques typically associated with malicious software. The software's increasing sophistication, including anti-detection mechanisms and self-protection drivers, raises questions about whether such aggressive techniques belong on user systems regardless of their profit-generating intent.