Slashdot Mirror
Banks Faulted For Fake Antivirus Scourge
krebsonsecurity writes "Merchant banks that process credit card payments for fake antivirus or 'scareware' exhibit a distinctive pattern of card processing that could be used by Visa and MasterCard to weed out the rogue processors, according to a new study by the University of California, Santa Barbara. From the study: 'The UCSB team found that the fake AV operations sought to maximize profits by altering their refunds according to the chargebacks reported against them, and by refunding just enough to remain below a payment processor's chargeback limits. Whenever the rate of chargebacks increased, the miscreants would begin issuing more refunds. When the rate of chargebacks subsided, the miscreants would again withhold refunds.' The study also highlights how few customers ever request a refund, and how affiliates pushing this junk software made more than $133 million."
Of course it is. You can technically secure a computer all you want, but there's no defense against fraud.
Give me Classic Slashdot or give me death!
Unfortunately, you can't patch users.
Seriously? You dont know? FUCKING PEOPLE WILLINGLY INSTALL THIS SHIT. Its impossible to secure a computer where the admin will grant root permission to almost anything that asks.
Good-bye
If homeopatic "medicine" can be sold legally, I see no reason why anti-virus software that does absolutely nothing should be considered illegal.
I'd like to know how non-admin users who don't have an admin password can still execute files in say, C:\programdata.
Social engineering becomes practical once the administrator is as dumb as the user, especially on a home PC. The scareware wedges itself deep into the user's profile, popping up a UAC or gksudo prompt every two minutes. "Daddy, the computer looks broken. Could you run this fix for me?"
Credit card payment processing is the ideal complicity/trace/choke point for much of the world of spam and crimeware.
Why doesn't the FBI turn the next prosecution into a RICO prosecution and drag a payment processor and/or bank and some of its executives into the prosecution?
A few 20 year jail sentences and $250,000 fines plus forfeitures would make many processors think twice about their "man in the middle" role.
Spam and scareware wouldn't be worth doing if you couldn't get paid for them -- no matter how scared I am, I can't manage to shove a $20 into my monitor.
Unfortunately, you can't patch users.
If they pay enough, I'll patch them (afterwards).
The sadist in me detects an enticing business opportunity!
Those who can make you believe absurdities can make you commit atrocities. - Voltaire
The problem with your assertion is that rogue antivirus targets home users, where the unsavvy user is required to also be administrator. Or are you suggesting that the average user pays some service like Geek Squad to administrate the user's home computer? That sounds like it's an even bigger waste of money...
I would be really happy if my bank gave me a fake credit card number that I could give to every scammer or asshat who tried to sell me "car warranty insurance" or "anti-virus" over the phone. The idea is, it'd be declined, but it'd also flag that this retailer is less-than-ethical, not paying attention to "Do Not Call", etc.
Like anything else, this shouldn't be connected to automated blacklisting (since people who decide that "Best Buy sucks" might try using it there), but it would be an immediate red flag if thousands of attempted transactions from a payment processor came back this way.
So, we start a campaign to educate users, right? "If you see a popup, asking if you wish to install Windows, click "Cancel" immediately!"
"Windows is like the faint smell of piss in a subway: it's there, and there's nothing you can do about it." - Charlie Br
The changes the rogue a/v do don't require admin rights in the users profile.That's why you will see only the user profile infected. It DOES require admin rights to change the HKLM, so on admin accounts they will typically change that as well.
.exe was run, it would execute the fake A/V, with the original target as the command line variable. That way, the original program would allow some things to run, other things no. Also, it was a brilliant way to ensure persistence!
The lions share of rogue A/V are really just registry mods and a simple GUI sham program. But, I have been seeing some rogue A/V coming with rootkit as well, which would obviously happen more on XP or admin accounts.
Here is an example: I have seen first-hand a limited user account on a corporate windows domain (XP) get a fake A/V. This user couldn't even change the freakin CLOCK, yet she got a fake A/V. It was doing porn pop-ups as well.
Some rogue A/V will apply XP-Pro type Group Policy changes to the registry even on OS like XP Home. I just saw a fake A/V modify the registry so that every time a
Flappinbooger isn't my real name
It's not like the scareware crooks are blowing the whistle on potentially illegal government activity, so why would they get involved?
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage