It has a EULA, it must be legit

### Overview Presented at VB2014 by Stefan, a virus researcher at Bitdefender, the talk explores how End-User License Agreements (EULAs) can be leveraged to classify Windows binary files as clean software or potentially unwanted applications (PUAs/PUPs). While malware creators historically wrote code for notoriety, the modern ecosystem has pivoted heavily toward monetary gain. However, operating illicit botnets carries severe legal risks, leading many actors to transition into the aggressive advertising and bundleware markets. To shield themselves from legal liabilities and maintain a borderline legitimate status, these publishers present extensive, obfuscated EULAs that disclose their tracking or ad-injection behaviors. Stefan presents an automated natural language processing (NLP) pipeline designed to extract, parse, and classify binary software based directly on the publisher's disclosed legal text.

### Key Topics - **Evolution of Malware to PUAs:** The shift from author recognition to financial incentives, where developers use social engineering, bundling, and clandestine installations to grow large install bases for ad revenue. - **Legal Obfuscation in EULAs:** How software vendors exploit binding EULA contracts by drafting lengthy, jargon-heavy disclosures (compared in size to massive agreements like PayPal's 25,000+ words) that users rarely read—often spending under eight seconds on them. - **A Novel Detection Vector:** Introducing EULA-based detection alongside traditional static (binary analysis) and dynamic (behavioral analysis) detection methods to classify applications based on the vendor's self-described behavior.

### Technical Details - **Dataset & Extraction:** The Bitdefender team processed approximately 1 million Windows binary files, collecting clean samples from known vendors and adware from their internal repository. They extracted agreements via specialized handlers for Inno Setup installers (linking agreements directly to installers) and an in-house generic unpacking engine capable of handling multiple packers to discover online EULA and privacy policy links. - **Text Processing Pipeline:** Built in Python using the NLTK library (alongside C components), the pipeline splits extracted EULA text into sentences, performs tokenization, and computes part-of-speech (POS) tags. Stop words are stripped to eliminate noise. - **Stemming & Disambiguation:** The researchers evaluated standard stemmers (Porter, Lancaster, Snowball) but achieved the best results with WordNet, which enabled effective root form extraction and synonym mapping (e.g., mapping "various" to "assorted", "advertisement" to "ad"). - **Feature Selection & Classification:** After extracting the top 10,000 frequent words and top 10,000 two- to three-word combinations across sentences (producing a 20,000-feature space), they applied feature selection methods to feed a linear classifier termed a "one-side perceptron." - **Model Performance:** Among four feature selectors, the `prog diff` metric (the difference between percentages of clean and adware samples sharing a feature) achieved the highest performance: a 96.6% detection rate with 98.8% accuracy. Human-crafted word combination signatures also demonstrated an 85% detection rate with zero false positives. - **False Positives:** A notable false positive discussed during Q&A was the Google Chrome browser EULA, because its legal terms describe sending queries and user data to services to improve advertisements.

### Takeaways Classifying software via EULA disclosures offers a practical, automated mechanism to identify adware and PUAs generic across families without executing or analyzing binary logic. Although current models focus on English-language agreements, distinctive multi-word combinations (such as statements declaring the intent to display ads) provide powerful discriminators that expose unwanted programs through their own legal disclosures.