John E. Dunn, Techworld.com
Web crime has long been known to be worth good money, but now security company Finjan has been able to show just how profitable using a real-world example of such a scam - $10,800 (7,900) per day.
The figures were calculated after the company gained entry to servers controlled by a criminal group carrying out a simple but multi-faceted con based on a mixture of search engine manipulation and bogus anti-virus software, designed to mine cash from web traffic.
According to Finjan, the crime network concerned had been able to hack legitimate websites, injecting PHP scripts capable of generating Google keywords based on popular search terms of the moment, bulked by mis-spellings of other common search terms. Once these bogus key words were indexed by search engines, anyone looking for the same terms or mis-spelled terms would have found the results at the top of search results pages.
Following any one of these links would take users to websites serving rogue anti-virus products that attempt to trick users into paying for a license to remove non-existent malware.
Researchers were able to see that during 16 consecutive days, a total of 1.8 million users were redirected to rogueware sites, 1.79 percent of whom fell for the scam and paid up $50 a time for useless software.
Since the criminals were being paid 9.6 cents for each redirection as part of a larger network of criminals affiliates, they would have netted $172,000 in total, or nearly $10,800 per day for the period of the scam monitored. The risk of discovery? Given that the web is now infested with many similar scams, virtually zero, making it a low-risk way to make money over and over again.
Assuming the criminals could replicate this success over a longer period, they might be able to earn up to 2 million per annum, the company had calculated.
"We already know that cybercrime makes money. But the question is how much money," said Finjan's CTO, Yuval Ben-Itzhak. The attraction of hacking legitimate sites to plant keywords was also clever, he reckoned, because it transferred to come-back for Google keyword manipulation to the real owner, and not the criminal.
"They are breaking SEO [search engine optimisation] rules. But they do not care if they will be punished."
A video used by Finjan to demonstrate the search engine optimisation (SEO) manipulation showed the search engine results to be innocuous looking. This helped lull users into the false sense of security needed to make the rogue anti-virus software look more plausible.
Fake anti-virus software has grown into one of the commonest scams in the web, even affecting Mac users. Despite many warnings, a small minority of Internet users continue to fall for the con. The technique of carrying out immediate online scans for malware was started by revenue-hungry anti-virus companies looking for subscriptions from worried users. Although legitimate, the idea was quickly picked up on by criminals, who grasped its simple psychology of fear.
Wednesday, March 25, 2009
Macs: Not as Secure as We Thought?
When it comes to technology, security is a relative term.
Douglas Schweitzer, Computerworld
Well, I don't know about other security professionals, but I'm not at all shocked that this year's PWN2OWN contest showed that both Windows PCs and Macs could be cracked. I do have to admit that 10 seconds was a bit of a shocker for the Mac Platform.
Look, I have put my faith in OS X since 2003, but I'm not one of those Mac zealots who think that Macs are infallible. There sure are less of us than our Windows using brethren. So, we're a smaller target simply because the user base is smaller. That's one of the reasons there haven't been as many Mac viruses. But the contest also showed that the recently launched IE8 could be hacked too (although I'm sure it took longer than 10 seconds). Those mere 10 seconds keep echoing in my head.
The moral of this story is that no OS is perfect or fully secure. Neither are the Web browsers we use every day which are so tightly integrated and intertwined into the OS. Should we panic and become paranoid? Not a chance...driving, flying and many sports have inherent risks...it's just a part of playing the game.
Douglas Schweitzer, Computerworld
Well, I don't know about other security professionals, but I'm not at all shocked that this year's PWN2OWN contest showed that both Windows PCs and Macs could be cracked. I do have to admit that 10 seconds was a bit of a shocker for the Mac Platform.
Look, I have put my faith in OS X since 2003, but I'm not one of those Mac zealots who think that Macs are infallible. There sure are less of us than our Windows using brethren. So, we're a smaller target simply because the user base is smaller. That's one of the reasons there haven't been as many Mac viruses. But the contest also showed that the recently launched IE8 could be hacked too (although I'm sure it took longer than 10 seconds). Those mere 10 seconds keep echoing in my head.
The moral of this story is that no OS is perfect or fully secure. Neither are the Web browsers we use every day which are so tightly integrated and intertwined into the OS. Should we panic and become paranoid? Not a chance...driving, flying and many sports have inherent risks...it's just a part of playing the game.
Conficker to Phone Home on April Fools' Day
Security researchers are in the dark about what will happen next week when the newest variant of Conficker, 2009's biggest worm by a mile, begins trying to contact its controllers.
"It's impossible to know until we see something that has a clear profit motive," said Joe Stewart, director of malware research at SecureWorks Inc. and a noted botnet researcher.
PCs infected with Conficker.c, the third version of the worm that first appeared late last year, will use a new communication scheme on April 1 to establish a link to the command-and-control servers operated by the hackers who seeded the malware. The date is hard-coded into the worm, which in turn polls any of a number of major Web sites, including Yahoo, for the date, said Stewart.
That tactic is just one of several designed to make it tough for security researchers to figure out what Conficker's all about, and more importantly, what it might do. "We had to trick it into thinking it's not only getting back the right page, but that it's getting the April 1 date," said Stewart, talking about the machines SecureWorks purposefully infected with Conficker.c.
"So far, we haven't seen any evidence [on those machines] of what it will do April 1," added Stewart, although that's to be expected. "It's not April 1 yet, so they're not going to put something online, where it might be found. In fact, it's almost a little risky for us to try to look for those sites, since it might give away that we have some bots in their network."
Symantec Corp.'s Vincent Weafer, vice president of the company's security response group, agreed with Stewart that it's impossible to know ahead of time what stunt Conficker's controllers will pull next week. "Nobody has any real idea," said Weafer. "There's no indication of what it will do April 1."
Weafer characterized the Conficker.c update as one to "armor and harden the existing infections," and noted that the variant, unlike its predecessors, cannot spread to other PCs. "This variant is very defensive-oriented," said Weafer, "to make it less visible and more resilient."
Like Weafer, Stewart sees Conficker.c as a move to by the worm's maker or makers to consolidate what's already infected. "The big question is what's the end game?" he said. "Is it just as big as they want it to get?"
He also noted Conficker.c's tilt toward the sophisticated, seconding Weafer's opinion that the worm's makers are trying to stump both researchers and anti-virus software.
"This a very curious thing," Stewart said. "[The hackers] are more patient and more methodical than most. They're raising the bar, by a lot, in terms of what we have to do to figure out what it does, to block it, to clean it.
"It's not your typical type of e-crime," he said.
Conficker, which is also called Downadup by some security companies, first appeared late last year, and originally exploited a Windows vulnerability that Microsoft Corp. patched in an October 2008 emergency update. In early 2009, the next version -- Conficker.b -- infected millions of PCs in just a few days.
Gregg Keizer, Computerworld
"It's impossible to know until we see something that has a clear profit motive," said Joe Stewart, director of malware research at SecureWorks Inc. and a noted botnet researcher.
PCs infected with Conficker.c, the third version of the worm that first appeared late last year, will use a new communication scheme on April 1 to establish a link to the command-and-control servers operated by the hackers who seeded the malware. The date is hard-coded into the worm, which in turn polls any of a number of major Web sites, including Yahoo, for the date, said Stewart.
That tactic is just one of several designed to make it tough for security researchers to figure out what Conficker's all about, and more importantly, what it might do. "We had to trick it into thinking it's not only getting back the right page, but that it's getting the April 1 date," said Stewart, talking about the machines SecureWorks purposefully infected with Conficker.c.
"So far, we haven't seen any evidence [on those machines] of what it will do April 1," added Stewart, although that's to be expected. "It's not April 1 yet, so they're not going to put something online, where it might be found. In fact, it's almost a little risky for us to try to look for those sites, since it might give away that we have some bots in their network."
Symantec Corp.'s Vincent Weafer, vice president of the company's security response group, agreed with Stewart that it's impossible to know ahead of time what stunt Conficker's controllers will pull next week. "Nobody has any real idea," said Weafer. "There's no indication of what it will do April 1."
Weafer characterized the Conficker.c update as one to "armor and harden the existing infections," and noted that the variant, unlike its predecessors, cannot spread to other PCs. "This variant is very defensive-oriented," said Weafer, "to make it less visible and more resilient."
Like Weafer, Stewart sees Conficker.c as a move to by the worm's maker or makers to consolidate what's already infected. "The big question is what's the end game?" he said. "Is it just as big as they want it to get?"
He also noted Conficker.c's tilt toward the sophisticated, seconding Weafer's opinion that the worm's makers are trying to stump both researchers and anti-virus software.
"This a very curious thing," Stewart said. "[The hackers] are more patient and more methodical than most. They're raising the bar, by a lot, in terms of what we have to do to figure out what it does, to block it, to clean it.
"It's not your typical type of e-crime," he said.
Conficker, which is also called Downadup by some security companies, first appeared late last year, and originally exploited a Windows vulnerability that Microsoft Corp. patched in an October 2008 emergency update. In early 2009, the next version -- Conficker.b -- infected millions of PCs in just a few days.
Gregg Keizer, Computerworld
Site Hacks, Fake Security Rakes in Serious Cash
Site Hacks, Fake Security Rakes in Serious Cash
Erik Larkin
Here's a recipe for illicit online riches:
1. Hack a Web site to insert pages full of keywords to popular terms.
2. Redirect the millions of people who click on the search result links to the fake pages to a site selling rogue antivirus software.
3. Sit back and collect affiliate fees from the rogue software seller, to the tune of up to $10,000 a day.
Web security company Finjan gathered details on this kind of operation after gaining access to a traffic management server used by the bad guys. The redirection that started with a poisoned search link went through the traffic servers on the way to rogue AV sites, allowing Finjan to observe the process.
The company found that crooks were hacking legitimate Web sites to insert parasite pages stuffed full of search terms pulled from the Google Trends system, along with others with minor typos from real terms like Gogle or Obbama.
These fake pages, designed to get search engines to find and display the pages in online searches, would redirect anyone who clicked on them to a site selling rogue AV software. Pushing the fake apps has become a popular profit-making technique among online crooks, and for good reason.
Finjan found that affiliate programs from the crap software pushers pay hackers 9.6 cents per redirection to the software-selling sites. That adds up to serious cash when you're talking about 1.8 million unique user redirections in 16 consecutive days, as Finjan observed.
Of those 1.8 million users, 1.79 percent of them paid $50 for the fake AV software. The software sellers used those profits to pay a total of $172,000 - or $10,800 per day - to affiliates.
With numbers like these, it's no surprise that rogue antivirus is becoming more common. And its spread doesn't just hurt those who get conned out of $50 or more for the software. Search engines will typically penalize sites that they believe are trying to game the system by stuffing pages full of random search terms, Finjan says. So the legitimate sites that get hacked may be penalized and see their real pages drop in search engine rankings.
Subscribe to:
Posts (Atom)