CrossRider

CrossRider is a multiple-browser platform used by various adware products, including some browser hijackers. Since CrossRider heavily emphasizes reducing the PC user's control over their Web browsers, malware experts ordinarily encourage deleting CrossRider toolbars and other, related products. Although CrossRider products may market themselves under a rainbow of colorful brand names, competent PC security solutions should have zero issues with identifying and uninstalling CrossRider derivatives of all types.

CrossRider: Riding Advertisements into Every Browser You Have

CrossRider is a JavaScript-based publishing platform that claims to allow developers to create 'new' browser products in a matter of minutes. Sadly, these products always fall under the category of browser hijackers, adware and other forms of Potentially Unwanted Programs that represent significant security disadvantages for their users. Malware experts are in an ongoing analysis of CrossRider's frequent product releases, including such samples as Radio Canyon Ads, Fraveen, Weather It Up, Savings Hero, LyricsMonkey, LyricsOn and LyricsContainer.

CrossRider modifies multiple Web browsers simultaneously, including Internet Explorer, Chrome and Firefox. Its modifications are variable with the version of CrossRider that's in use, but may include:

• Browser redirects to advertising websites.
• Having your browser's default search engine reset.
• Having your browser's homepage reset.
• Injecting additional advertisements into third-party Web pages unaffiliated with CrossRider products.

CrossRider, in all of its variants, is not threatening software. However, most PC security companies classify CrossRider products as PUPs or adware. Exposure to CrossRider advertisements may harm the performance of your browser or make your PC susceptible to scripted attacks, phishing tactics and other threats. Meanwhile, malware experts, consistently, find no real marketing or distribution efforts of repute on behalf of CrossRider products, and have found some trace evidence of CrossRider's company being involved in spambot-related activities.

Crossing CrossRider out of Your Web-Surfing Life

Because of the blatant undesirability of most adware, CrossRider may be installed in bundles with other products. These bundle installers won't always request your consent prior to installing their version of a CrossRider toolbar, and you may encounter them on illicit file-downloading networks or free file hosts with poor reputations. However, malware experts find that good brands of anti-adware and anti-malware scanners have excellent rates for detecting common CrossRider installers, as well as most individual variants of CrossRider. Because of their high flexibility in brand names, you shouldn't try to identify an individual CrossRider add-on by eye. However, any add-on that provides excessive advertisements or forces your browser to load an unwanted site may present a security risk for your PC.

The Crossrider platform may be used by adware developers to ensure that their apps run on Google Chrome, Opera, Internet Explorer, Safari and Mozilla Firefox and cover larger user-base. Applications detected as CrossRider are not considered as harmful because most of them function as private ad platforms for vendors or display ads to cover developing costs and stay free-of-charge. Programs that have the CrossRider tag are often deployed as additional components of freeware packages that most users install via the 'Express' or 'Typical' option. A few examples of adware powered CrossRider applications are Compare For Fun, Coupon Server and Coupon Champion. The programs labeled as variants of CrossRider can display banners, floating ad boxes, pop-up and pop-under windows, contextual and transitional commercials. Additionally, CrossRider may use tracking cookies, web beacons, and DOM storage data to help advertisers push targeted marketing content based on the online routine of PC users. Security experts advise users to remove CrossRider software by using a trusted anti-spyware utility to ensure the optimal performance of their web browser and stop unwanted ads from appearing.

In addition to targeting Windows users, the CrossRider adware also is available for Mac. Its core features are almost identical, but it does have some extra functionality that it needs to use to bypass Apple's security measures. Thankfully, CrossRider for Mac is not threatening in its current form. Still, some of its behavior is not typical for adware certainly – for example, it is able to spy on your OSX user credentials.

The Mac Adware Uses Fake Prompts to Collect Credentials

Due to the default security measures found in Apple's operating system, adware for Mac often may be involved in shadier behavior compared to its Windows counterparts. For example, CrossRider is known to display a fake login prompt, which is used to harvest the login credentials of Mac users – thankfully, they are not used to execute harmful attacks, but the fraudsters behind the adware will use the harvested login data to install additional adware components without the user's consent. Furthermore, in case the server used to serve the adware is compromised, an ill-minded actor may modify it to deliver more threatening malware such as ransomware or backdoor Trojans.

The CrossRider may be installed using different configurations depending on the recipient's operating system version. For example, if you use OSX 10.11 and above, the adware will use the aforementioned fake login prompt to collect your password, and then use it to deploy its components silently. One of these components is a fake copy of Safari that comes with a pre-installed list of add-ons that are meant to display advertisements whenever you use the browser. The bogus Safari version will replace the original one in every menu so that users who are not aware of the issue will end up seeing tons of advertisements.

Adaptive Adware Uses Different Tricks Depending on Your Operating System Version

Users of OSX versions prior to 10.10 will not see the fake login prompt and, instead, the CrossRider adware will initialize a script called 'install.sh' – its purpose is to apply changes to the Google Chrome and Safari Web browsers that concern their active extensions. All changes will be made off-screen so that the user will not see anything out of the ordinary.

Apart from displaying advertisements, the CrossRider adware also may collect data from the local computer – username, IP address, Web browser versions, OS version and the contents of the 'Applications' folder. Another worrying trait of CrossRider is its ability to identify the version of OSX's security components.

Mac adware is much more advanced than its Windows counterparts certainly – its authors use advanced techniques to bypass Apple's security measures, and Mac adware often may engage in shady behavior to gain the ability to install components without the user's approval. There is nothing stopping the adware's creators from deciding to use a more harmful payload, and it is crucial to take the required measures to prevent threats like this from entering your system incredibly.

Technical Details