What is a PUP? Bundled software dangers

A potentially unwanted program (PUP) refers to software that reaches devices via questionable means. Typically, it will arrive in a freeware bundle as an additional program. It means that users might have not installed them intentionally. Thus, the existence of a PUP might be a surprise to them. However, PUPs can exhibit questionable behavior, ranging from minor transgressions to more severe ones. Despite their potential sins, such programs avoid the title of malware as users agree to install them. The consent, as mentioned, might not be intentional. After all, users tend to skip through installers, conforming to all conditions along the way.

What is a PUP?

A PUP (potentially unwanted program) is software that users might regard as undesirable. A common distribution strategy for these tools is to come in software bundles. Let’s say you find a tool that you want to have on your device. In some cases, freeware could have wrapper applications that get installed alongside the main program. Whether users know about the additional tools usually depends on their vigilance.

Software providers should be specific about what programs users will receive after concluding an installation. And, in many cases, they provide all these details. It all relies on people’s willingness to read lengthy End User Licence Agreements (EULA).

These documents govern how the recipient should use the software. However, they also mention everything that the installation will guide into your device. Therefore, to avoid receiving multiple PUPs, you need to read these documents carefully. If you blindly install everything offered, the sheer number of questionable tools will start to clog up your system.

Thus, unwilling PUP installation relies on a series of dark patterns that providers use to get the intended result:

• Burying information about additional software to be installed deep in the EULA.
• Automatically marking check-boxes that allow the installation of PUPs.
• Adding labels of world-leading security companies to make the software seem more reliable.

PUPs are direct consequences of installation processes that users skip through in a couple of seconds. People prioritize speed over security, and external entities continue exploiting it. Whenever you decide to install a new tool, make sure that it won’t bring any additional friends. They will ruin the party, clog up your system, and might engage in other unwanted behavior. For instance, PUP malware could collect information about you and sell it to advertisers.

Where do PUPs come from?

There are several ways PUPs can enter your system. The first, and the most common, is that it comes bundled with other software. In an Emsisoft study, the researchers highlighted the worst offenders in their distribution: download portals. The chances of installing PUPs are incredibly high on these sites. Thus, it is wise to avoid download portals like Filehippo, SnapFiles, and Softonic. Instead, download tools from official pages or reliable software stores.

The other route PUPs take is more straightforward. People might install them intentionally, believing that the software will improve their experience. However, the true intention behind the program might be suspicious. For instance, it might collect information about their users and deliver adverts within the software or anywhere else.

Typically, users should have all the information related to the way the applications will work. However, many miss these data-harvesting and ad-delivery conditions because they neglect EULAs. Thus, while the program might have been installed willingly, the further behavior might be unwanted.

An important note here is that PUPs might not break any laws, leaving users solely responsible for their decisions. Why? If providers supply the necessary details in official documents, recipients have an obligation to read them before clicking “agree.”

Are PUPs dangerous?

There are examples of PUP malware when such bundled software behaves maliciously. For instance, it might relate to unscrupulous data collection, tracking, and questionable display of online ads. A more severe scenario would mean that a PUP attempts to perform administrator-type functions on the infected device.

Nevertheless, PUPs are more like pests that won’t necessarily threaten your security but will take up space and drain resources. Many PUPs in an operating system will surely slow it down, especially if these programs relaunch after every reboot. Even if you believe to turn them off, they might continue running in the background, boosting your CPU usage.

Mitigation and prevention

PUP prevention is relatively simple:

• The first step is to avoid download portals and other sources offering freeware or other software. Instead, you should install tools from their official sites or verified stores.
• The second step is to read EULA documents to know exactly what you are about to install. If the tool mentions additional programs, find out whether you can opt out of having them.

When it comes to getting rid of PUPs, a simple uninstall might not work. These tools could be rather persistent and require more attention. Thus, you might need software capable of detecting PUPs. Since these programs might not be malicious, some security solutions fail to locate them.

Overall, users should always know what tools they have installed on their devices. Perform regular checkups to find tools that you no longer need or did not install in the first place. Leaving such questionable tools in your OS could manifest in more severe problems in the future.