Slashdot Mirror
New Click-Fraud Attack Is Stealthiest Yet
An anonymous reader sends news from The Washington Post's Security Fix blog of a new Trojan horse program that takes click fraud to the next level. The Trojan, dubbed FFsearcher by SecureWorks, was among the pieces of malware installed by sites hacked with the Nine-Ball mass compromise, which attacked some 40,000 Web sites this month. The Trojan takes advantage of Google's "AdSense for Search" API, which allows Web sites to embed Google search results alongside the usual Google AdSense ads. (SecureWorks' writeup indicates that Yahoo search is targeted too, but the researchers saw no evidence if the malware redirecting Yahoo searches.) While most search hijackers give themselves away on the victim's machine by redirecting the browser through some no-name search engine, FFsearcher "...converts every search a victim makes through Google.com, so that each query is invisibly redirected through the attackers' own Web sites, via Google's Custom Search API. Meanwhile, the Trojan manipulates the victim's PC and browser so that the victim never actually sees the attacker-controlled Web site that is hijacking the search, but instead sees the search results as though they were returned directly from Google.com (and with Google.com in the victim browser's address bar, not the address of the attacker controlled site). Adding to the stealth is the fact that search results themselves aren't altered by the attackers, who are merely going after the referral payments should victims click on any of the displayed ads. What's more, the attackers aren't diverting clicks or ad revenue away from advertisers or publishers, as in traditional click fraud: They are simply forcing Google to pay commissions that it wouldn't otherwise have to pay." If FFSearcher were the only piece of malware on the machine, it would have a better chance of staying under the radar.
The server in the Nine-Ball distribution could be any with an active exploit against it - an "infected" server is just one serving up pages with an iframe to the exploit site, so that site visitors would end up being attacked. Since any web server on any OS can serve up HTML...
Reading the article helps - there is only one server: my-web-way.com , which is supposedly controlled by the attackers. The whois entry reveals, that it is registered in Moskow, Russia.. probably with a fake name.
Now to what gets infected: Windows machines. It plays with DLL's and the Registry (described in the article).
Interesting is: this peace of mallware does not directly (perceivably) damage the user of the infected machine, but it generates revenue through (semi fake) Google ad clicks. I wonder how they (Google) will react.. would guess that big corporations get quite pissed by this kind of stuff. Let's wait and see..
So, let me get this straight:
The trojaneers' moneymaking is predicated upon people actually clicking on ads.
Uh... good luck with that!
Why would they waste their time? Surely there are easier ways to steal from adsense that don't involve putting people at risk...
Were you just trying for first post, or did you have a point to make? "Why would they [the FFSearcher developers] waste their time?" Because it makes them money and, thus, is not a waste of time at all but rather quite the profitable use of their time. And from the summary, it sounds like FFSearcher does nothing malicious except for redirecting traffic such that it gets referral payments. How is that putting people at risk? And what are these easier-to-steal-from-adsense methods you're referring to?
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
This reminds me of the concern about bank fraud that IBM made the ZTIC device to help mitigate.
First, the attack is click fraud, but its not that large a jump to target bank transactions. The malware can target a Web browser where a person thinks they transferred some cash to their savings from their checking, when in reality, their entire balance was just moved to an attacker's offshore account. The malware would be doing a man in the middle dance making the victim think that everything is fine, when in reality their account is empty.
This type of attack would get around a lot of security measures used by banks today. The only real defense would be to have a separate device that shows transactions on it and one confirms or denies on that device as opposed to a potentially compromised computer.
the washington post article doesn't give you any more information than the summary, you should be reading the trojan analysis which is linked in both the summary and the article.
The goal is to get some website to distribute your payload, which consists of specially crafted HTML code. This can be done by simply posting a comment on any webpage which accepts and retransmits arbitrary HTML. Or it could be done by exploiting a bug in IIS, Apache, or other webserver software so that the original site serves up your payload. Or you could hack Windows or Linux to get the webserver to use your payload. The payload then exploits any number of browser bugs, whether Firefox, IE, or another browser to install software automatically into Windows when the victim visits a compromised website.
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
i don't think anything is keeping them from it, it's probably the first thing they did or are going to do. the problem is that they need to track the configuration of the trojan (which can be updated remotely) and keep shutting down accounts of the new search sites. it would be far more convenient if they had a possibility to determine click fraud by analyzing their stats, which is very difficult this way, as the fraud essentially looks the same as normal behavior. not having that option increases their work and increases the probability that there are different trojans running which they aren't aware off.
Firefox and IE are the targets of the trojan once it already has control over your computer. That doesn't mean they are "vulnerable" or are in need of patches.
Only the last link in the Slashdot article discusses how these attackers gained control over your computer:
So, basically an IE hole that was fixed in 2006, plus a handful of plugin vulnerabilities. They didn't even bother looking for an old Firefox vulnerability to exploit, perhaps because too many Firefox users are up-to-date.
The shareholder is always right.
The virus itself is a complicated one. As per the article, it was installed on the system during a mass exploit dubbed Nine-Ball, which was loaded onto 40,000 legitimate websites. Visiting those sites caused the Nine-Ball script to execute, which redirected an iframe to a page containing malicious code which mounts a series of attacks. Those mentioned by the site are:
So basically, an application (browser) visits this malicious page. If that application runs the ActiveX controls mentioned (and presumably Acrobat Reader and/or QuickTime), it was vulnerable to the initial Nine-Ball exploit. IE qualifies for all 4 of those; Firefox can use ActiveX (I believe, with a plugin), but not out of the box... however, it does have plugins for Acrobat Reader and QuickTime.
If any of those vulnerabilities were present with the applicaton visited the iframe, it runs malicious code that installs a crapton of viruses on the host computer, among them the FFSearcher virus.
Once FFSearcher is on your computer, it causes itself to get run all of the time, probably as Administrator. It then proceeds to:
So a nice, clean, and secure IE / Firefox get started up, but Windows, itself infected, loads the virus into them! No vulnerabilities are exploited, here. Since FFSearcher runs as Administrator, everything it does is straightforward and allowed by the system; it can do basically anything. What it chooses to do is target IE and Firefox. Since it's running as Administrator, it doesn't have to exploit any vulnerabilities in either; it just barges in and rewrites parts of them to do its bidding. Administrator can do things like that.
In conclusion, there isn't any vulnerability in IE or Firefox that's involved in FFSearcher, and the only reason FFSearcher doesn't pwn other browsers is because the author didn't bother to write a payload for them, too. FFSearcher, itself, was installed due to some browser vulnerability that happened sometime, and now, permanently present on the system, takes advantage of its Administrator privileges to do some pretty wicked stuff.
Ads.
Sites host ads.
People buy ads through ad placement companies like Google.
Bad people engineer ads to contain the exploit and payload.
Site serves up bad ad.
Users of site get fucked.
It's always the fucking ads.