Slashdot Mirror
New Click-Fraud Attack Is Stealthiest Yet
An anonymous reader sends news from The Washington Post's Security Fix blog of a new Trojan horse program that takes click fraud to the next level. The Trojan, dubbed FFsearcher by SecureWorks, was among the pieces of malware installed by sites hacked with the Nine-Ball mass compromise, which attacked some 40,000 Web sites this month. The Trojan takes advantage of Google's "AdSense for Search" API, which allows Web sites to embed Google search results alongside the usual Google AdSense ads. (SecureWorks' writeup indicates that Yahoo search is targeted too, but the researchers saw no evidence if the malware redirecting Yahoo searches.) While most search hijackers give themselves away on the victim's machine by redirecting the browser through some no-name search engine, FFsearcher "...converts every search a victim makes through Google.com, so that each query is invisibly redirected through the attackers' own Web sites, via Google's Custom Search API. Meanwhile, the Trojan manipulates the victim's PC and browser so that the victim never actually sees the attacker-controlled Web site that is hijacking the search, but instead sees the search results as though they were returned directly from Google.com (and with Google.com in the victim browser's address bar, not the address of the attacker controlled site). Adding to the stealth is the fact that search results themselves aren't altered by the attackers, who are merely going after the referral payments should victims click on any of the displayed ads. What's more, the attackers aren't diverting clicks or ad revenue away from advertisers or publishers, as in traditional click fraud: They are simply forcing Google to pay commissions that it wouldn't otherwise have to pay." If FFSearcher were the only piece of malware on the machine, it would have a better chance of staying under the radar.
The article mentions that both IE and Firefox are vulnerable, but doesn't talk about other browsers. It also doesn't say if it affects current versions, or unpatched browsers only. Will security patches for IE and Firefox be coming soon?
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
I can't find how the server gets infected. Is it Windows, Linux, Apache, IIS, ... ?
What part is to blame?
Love many, trust a few, do harm to none.
no it didnt generate ANY revenue. thats the whole point, that they wont pay for fake clicks. why do you think that it FINALLY happened when in reality nothing really had changed?
So, let me get this straight:
The trojaneers' moneymaking is predicated upon people actually clicking on ads.
Uh... good luck with that!
Why would they waste their time? Surely there are easier ways to steal from adsense that don't involve putting people at risk...
Were you just trying for first post, or did you have a point to make? "Why would they [the FFSearcher developers] waste their time?" Because it makes them money and, thus, is not a waste of time at all but rather quite the profitable use of their time. And from the summary, it sounds like FFSearcher does nothing malicious except for redirecting traffic such that it gets referral payments. How is that putting people at risk? And what are these easier-to-steal-from-adsense methods you're referring to?
Want to improve your Karma? Instead of "Post Anonymously", try the "Post Humously" option.
This reminds me of the concern about bank fraud that IBM made the ZTIC device to help mitigate.
First, the attack is click fraud, but its not that large a jump to target bank transactions. The malware can target a Web browser where a person thinks they transferred some cash to their savings from their checking, when in reality, their entire balance was just moved to an attacker's offshore account. The malware would be doing a man in the middle dance making the victim think that everything is fine, when in reality their account is empty.
This type of attack would get around a lot of security measures used by banks today. The only real defense would be to have a separate device that shows transactions on it and one confirms or denies on that device as opposed to a potentially compromised computer.
What's keeping Google from shutting down the account that are getting the illegitimate clicks? I doubt they could produce a hundreds of different account just because it would make receiving payment extremely difficult.
A Magic the Gathering Article and Forum Aggregator
Does this mean Cirno is the strongest?
Who would be liable for the bug? Since its dlls that are affected Microsoft would have to fix it. The thing is why should they? Their customers are not affected terribly. It is not technically fraud because it is not really misrepresenting what it presents. Google still benefits because of the adsense charges. It would be interesting to see who wants to fix this.
Alright and then google almost immediately bans that person for adsense.
Wow brilliant plan guys.
"and it's not fair (nor should it be legal!) to penalize that person for clicks outside their control"
If you own a dog, you're responsible for it. If you own a car, you're responsible for it. If you own a computer, you're not responsible?
Cry us a river - - -
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
We have 3 web sites hosted by gate.com, all different domain names, different passwords, etc.. We have the same code/virus/whatever on all 3 sites, all used a hidden iframe linking to a site in Russia.
They're not inducing clicks so it's not by definition click fraud. Who titled that? They're relying on a normal amount of clicks and just taking a commission off them that Google themselves offer freely. So basically they're just violating Google's terms of service for their search API. Actually it might not even say anything specifically related to showing a search API as a full page but still collecting the commission or whatever they're doing. Sounds like it's 99% Google's fault if you ask me.
Google's Super Secret Search Algorithm: SELECT @search_results FROM internet WHERE @search_results = 'good'
Does anyone know if the users browser times out if the router blocks the .ru domain? It may be worth monitoring your router logs for sudden excessive .ru domain requests.
The truth shall set you free!
It seems all of these nefarious activities on the Internet seem to come from Russia and other Eastern European countries. What is up with that? It it some sort of nerd gangster culture in that part of the world? Seriously, can someone please explain it to me.
Life is not for the lazy.
....the impersonators prefer "Don't Be Elvis"
Did you actually read the portion you quoted in context? The "clicks outside their control" he's talking about aren't made on his computer but by some random person/bot visiting his website, which he was trying to monetise via Adsense.
Many of them are computer scientists, mathematicians, and hackers.
Those people are actively recruited by the russian mob, because they have seen the amounts of money available in these sorts of scams.
He tried to kill me with a forklift!
"This dropper drops a dll with the name SOCKET2.DLL to Windows' system folder"
Having thus read, I need go no farther. How does the exploit actually get on to the web servers i nthe first place?
If someone injects a drug into your dog that makes him bite everyone in sight then the person who injected the drug is responsible.
I guess I should finally download Chrome - isn't that a Google product?
[...] the Trojan manipulates the victim's PC and browser so that the victim never actually sees the attacker-controlled Web site that is hijacking the search, but instead sees the search results as though they were returned directly from Google.com [italics added].
This as-though content that victim does not see is just like the content that the victim sees, the only difference being that there is no difference between the two:
Adding to the stealth is the fact that search results themselves aren't altered by the attackers, who are merely going after the referral payments should victims click on any of the displayed ads.
What's more, in this click fraud even clicks aren't changed:
What's more, the attackers aren't diverting clicks[...]
Welcome to the world of your invisible, untouchable overlords!
One solution to the AdSense cat-and-mouse game is conversion-based ad fees.
This is how the "complete 10 offers and get a free iPod" sites work. Clicking on the link doesn't work, you need to sign up for the offer and/or spend money.
If you are using AdWords fully, Google knows your conversions and knows what value those conversions provide to you. Your payment for ads could be changed so that you don't pay for CPM, you don't pay for clicks, you pay for conversions, which are money in your bank.
There is a possibility for you to game Google -- don't report all your conversions, effectively getting some of them for free. However, Google is already in the business of optimize ad serving to increase their revenue. This would be changed to optimize ad serving to increase BOTH of your revenues.
-----------
In an effort to produce a full post I will also address some implementation issues.
Another way to game Google here could allow free ads by creating many accounts or many campaigns. One solution is to have a hybrid payment method (You pay X cents per click plus Y% of your conversion value). Another solution is to only offer this new payment method to long-standing customers or those who have already paid $X in fees for AdWords.
A transparent and easy solution would be difficult, but this would remove many of the excuses people currently have for NOT using AdWords, especially on the expanded content network.
-- I was raised on the command line, bitch
That's like the kind of sneakiness that would end up in Ocean's 11 or The Unusual Suspects. Whoever made this should do something productive with their time.
Surely Google should just follow the money?
Why would they make one that was LESS stealthy? Does the Air Force work on making bombs less accurate? Does Porsche try to make their cars more sluggish? Is intel working on a chip that gets hotter?
This is like those stupid info bites where they pretend a change in any statistic is meaningful. "Unemployment is the highest it's been all month!" So what? You can always find some point in the past to say it's breaking some record. "This is the purplest purple since, um, 20 years ago. Wow!" That it beats some arbitrarily selected mark is not inherently meaningful. Especially in the case of arms races. Intel made a faster chip? No shit, Sherlock. That's their JOB.
Utilizing the synergization of benchmark e-solutions to pre-workaround action items!