Slashdot Mirror
IE Used To Launch Yahoo IM Clickfraud
An anonymous reader writes, "There's a new Instant Messaging worm in the wild that is taking the idea of Botnet clickfraud up a level. It trades in automated drones (prone to malfunction and detection) for real live people who (of course) have the option of not actually clicking anything, thus theoretically making their clicks harder to identify as 'fraudulent.' This IM attack doesn't even need a victim to physically run anything to become infected — simply visiting a certain site in Internet Explorer will cause the files to download and start sending infection messages. At this point, their homepage is changed to a site using Mesothelioma (a rare form of cancer) to ring up high-paying results on the perpetrators' Google ads. As the researcher who discovered the infection notes, 'It's way, way harder to trace some random boob who has a ton of (partially) unconnected people shunting IM links all over the place. Try staying anonymous as a Botnet owner who just had the entire details of his server splattered across the net by Shadowserver. What will be interesting to see is if some of the smaller Botnet guys ditch their technical woes and jump on the much-easier-to-maintain IM bandwagon to get their clickfraud kicks.'"
Can someone translate the summary into English?
-- "I never gave these stories much credence." - HAL 9000
So what if the used to launch IM clickfraud on Yahoo? I mean, does it still do it? Can you give IE any credit for "mending it's ways"?
:) }
Probably just another M$ prejudice thing huh?
{..that wooshing sound some of you are hearing is the joke flying over your head
A goal is a dream with a deadline
Seriously though, what the hell does that sentence mean?
Thank you for helping us help you help us all.
To the person that modded this "flamebait", you do realize I was just playing on the sentance structure, right?
;)
Oh well, I've had smart-assed comments modded "insightful" before as well....that's karma
A goal is a dream with a deadline
Or at least should anonymously read what they write before they anonymously submit it.
Boffoonery - downloadable Comedy Benefit for Bletchley Park
As history illustrates the litigation around this type of cancer can net high returns for lawyers and those seeking damages- however these cases are rare. Thus the cost-per-click (CPC) can range quite a bit on bidding networks seeking these large litigation rewards. The bids may range from $4.00 to $13.00 per click and higher. This makes it a prime target for malware authors and worm writers who setup systems to either force or set-up a system to maximize clicks to these high paying keywords in order to gain their fee split.
Maybe they'll be inspired to stop chasing ambulences -- or, in this case, sufferers of "a rare form of cancer (about 1 in 1,000,000)" -- and start chasing botnet operators.
Innovation makes enemies of all those who prospered under the old regime... -- Machiavelli
Without RTFA, and thus most likely wrong, but someone feeling right, I think that what's up is that it pops open an IE with links that are just begging to be clicked, and when you do, they get their money. Of course, the user may not actually click anything, but if they're like the lusers I've seen too much of, they'll go "huh, what's that" and cha-ching...
For those who didn't RTFA, here's another summary:
You get an infected Yahoo IM. In addition to propogating, it turns your IE home page into an ad-filled page. The ad page works like Google's adsense, only in this case instead of Google paying a legitimate web site when people click-through the ad, Google or some other company winds up paying the scammer or his cronies.
Because of the way it works it's a lot harder to detect than automated fraud or paid-human click fraud. Because the end user will likely click on the ad only if he's actually interested in it, the company that originated the ad might not even consider it fraud - he's just found a live potential client.
What makes it fraud is that the end user's web page has been hijacked. In other words - it's spyware/adware.
Workaround: Don't use IE, and use a malware-detector that detects and blocks Yahoo IM Malware.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
At this point, their homepage is changed to a site using Mesothelioma (a rare form of cancer) to ring up high-paying results on the perpetrators' Google ads.
WTF? This worm gives your computer cancer?
The theory of relativity doesn't work right in Arkansas.
Just another example of clever people taking advantage of anyone that is unfortunate enough to not know to click on unwanted popup things that ask them to click here, or enter your financial information etc.
The internet will not be safe, ever, because of those people. Yes, "click here to win a date with name-a-rising-star" will always find its way to someone that thinks there is some remote possibility that Bill Gates will pay you to forward emails, or that a music hall-of-famer needs a date from someone just like them. The human factor in security will always be the weakest link. ALWAYS.
Support NYCountryLawyer RIAA vs People
I mearly made a note of the fact that not everyone would get the meaning of the joke.
Call it "smug" if you must, but it would appear my accessment was correct nonetheless.
A goal is a dream with a deadline
Good thing I'm using ICQ.
w00t
Nough said.
It's better to vote for what you want and not get it than to vote for what you don't want and get it.
- E. Debs
...but surely google would quickly become aware of the website and cancel the google ad accounts of the sites linked from the page? Thus the scammers would get no "Step 3.... profit!!!"?
Does anyone that comes here on purpose us IE still or waste time with yahoo messanger? FireFox ftw
" I think that freedom is Americas biggest export. Atleast untill China can stamp it out for 20 cents a unit."
The exploit changes their homepage to some page with Google ads about mesotheleoma, and the bad guys get money from the clickfraud (people seeing impressions on an expensive Google keyword, most likely because liability lawyers are suing over it or something, and looking for people to join various class action suits where the lawyers can get big money).
I wish I understood how a simple play on words can throw you so far off the handle....perhaps you should have a beer and relax.
A goal is a dream with a deadline
The article in question is actually well-written (not saying much) compared to the summary that is little more crap that someone dropped on their keyboard.
Programming: Its not just a job - its an indenture.
Here's something I never understood. Let's say that party A puts some banners on party B's web page, with the agreement that A will pay B some money for users who click on the ad.
Now let's say that party C, just some random dude, comes along and writes a program to simulate clicks. Let's say there's no other foul play, such as zombied PCs - it's just this guy's simulated clicks.
I see some possible denial of service issues, but in what sense are these clicks "fraud"? Party C has no kind of contract with either party A or party B, so if the protocol in question allows automated retrieval and the servers freely respond, I don't see that there is any kind of fraud involved. He's just using an existing feature of the protocol. The server doesn't have to reply if it doesn't want to. Whatever arrangement A and B have between them doesn't have any bearing on C.
Maybe I don't understand it right?
I didn't RTFA, but presumably the ads being displayed are associated with a certain Google publisher account (or a handful of them). It should be pretty easy for Google to mark all clicks from those accounts as fraud, not charge the advertisers, and not pay the publishers.
The article is written so badly that's it's very hard to figure out the meaning. But this bit seems to describe the "entry point" to the infection:
Here, we have something different - an Instant Messaging attack launched by a webpage forcibly dumping executable files into a PCs temporary files directory, via some nifty VisualBasic scripting.
and further on:
So, how does this happen?
First of all, you need to hit an infection site using Internet Explorer - this exploit doesn't work in Firefox, for example. Due to the way these files are downloaded onto the PC, you can effectively make any site a potential threat and can scatter these files around wherever you like.
This sounds like a straight up "go to a web page and an arbitrary executable runs" attack. That would be a HUGE security hole in IE that has nothing to do with the rest of this issue. Not that it's never happened before, but I somehow doubt that this would be the first place we'd hear about it.
Those click-frauders can be traced back and personally identified because they have to run "websites" to generate revenue from those clicks. So their personal "income" address (to send paychecks) is in the Google Adsense (available), once identified they can be brought to justice by Google (if only Google ever really wanted to combat them). More scary scenario is that they can virtually destroy any small-midsized website business if they target it with these botnets. Google may cut them from Adsense and red flag them (innocent website owners may not even know about being targeted). And bye bye website. The core of the problem is that Google is irresponsibly allowing those fake and obvious fraud made-for-adsense websites to flourish.
Yeah... Ha-Ha... fuuunny. I meant the webpage in IE was redundant, not my comment itself.
If the US Government can prevent banks (credit cards) from handling the proceeds of internet gambing, how comes they can't do the same for handling the proceeds of goods advertised by Spam (etc)?
Is there a US Government at all? Is the US Government controlled by a moral cesspit like Al Quaida say it is? Has Gw Bush sold his soul to the devil? Is the internet controlled by Aliens from the planet Zog? Stay tuned for more news - same channel same time next week!
Sent from my ASR33 using ASCII
Exposure to litigation - it can get you more than loads of cash. It can kill.
--
On Slashdot I'm a lawyer.
I have to type this message from my laptop, because my hard disk needs chemo...
many, many grammer Nazi's lurking about these days...but it's worse than that. Over the years the right side of my brain has started to interact with my typing. For example, I'll sometimes think of one word, but type its synonym. Other time, I've been known to type a "q" when I was thinking "g".
In this forum, I type it and fire it off. For business communications, I spend a lot of time reviewing before I let it go.
A goal is a dream with a deadline
any time the term "Interet Explorer" is used in an article explaining how dangerous/damaging IE is, "internet explorer" should be at least 3 point sizes larger that the surrounding text, bold, outlined in a red box and followed by the IE logo!
So Microsoft is being used to make use of Yahoo! in trying to throw click fraud at Google.
Are we missing anyone?
Several years ago I disabled cookies in IE and found it broke YIM. I decided this made YIM a security risk and quickly switched to Trillian for all my IM need. I have NEVER regretted making this change.
I think we (slashdot readers) have just 'found out' who the (anonymous) submitter (of TFA) 'really' is (or at least their 'slashdot userid') based on the (unique) writing 'style'.