Author Topic: Bahama Botnet Discovered as Source of Click Fraud Surge  (Read 5364 times)

0 Members and 1 Guest are viewing this topic.

YoKenny

  • Guest
Bahama Botnet Discovered as Source of Click Fraud Surge
« on: September 19, 2009, 01:10:52 AM »
Quote
Bahama Botnet Discovered as Source of Click Fraud Surge

By: Brian Prince
2009-09-17

Forensics discovers a botnet behind a significant spike of click fraud traffic. As in the recent scam making use of NYTimes.com, attackers are using fake antivirus software to infect PCs.

Click Forensics has found an unusually large spike in click fraud traffic coming from a new botnet apparently eluding the filters of search engines, publishers and ad networks alike.
http://www.eweek.com/c/a/Security/Botnet-Discovered-as-Source-of-Click-Fraud-Surge-496555/

CharleyO

  • Guest
Re: Bahama Botnet Discovered as Source of Click Fraud Surge
« Reply #1 on: September 20, 2009, 08:40:38 PM »
***

Thanks for posting this information, YK.


***

Offline mkis

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1618
Re: Bahama Botnet Discovered as Source of Click Fraud Surge
« Reply #2 on: September 20, 2009, 10:49:36 PM »
I got a whammy by something similar when click a bad link on Google search (I think culprit) but with other urls open in the browser. It would be hard not to take the fraudulent warnings seriously if the user is not knowing about malware deceptions - obviously my computer does not suddenly have 200 odd trojans that need fixing, plus a mass of other exploits going off. I removed the fraudulent windows one at a time until my screen was wiped clean again. To delete the fraud pages and popups I just used the X at top right corner of their windows.

But for novice it would have been hard not to press the OK some time or another. The bad click generated about six or more information boxes (reasonably convincing) on my screen - much like a common advertising ploy that is still used by NYT (though perhaps less frequently nowdays) and others.

I think the virus may be neutral until the user clicks through one of the boxes - there were no alerts or anything, I did not have FF with NoScript running, but still avast, OA firewall, hostman. etc in case of injektion. But I did not clickthrough. Instead deleted. Included closing all other open windows in browser. And unhook from internet. Checked the logs but I think fraud boxes are neutral until clickthrough - bit different than customary drive-by threats where alerts will be triggered. These fraud boxes look like alerts so would be hard not to comply instinctively as first thought. But remember Dont press OK without thinking about it first.

And also, get to know your computer's defense array - antivirus, antimalware, antispyware programs - so you can differentiate between fraud boxes and genuine defense alerts when they appear on your screen. For drive by threats, delete may not be best option, for example with avast where 'abort connection' is the best option.

I was affected enough to go directly into delete mode, rather than look to capture some of the fraud windows for republish as attachments here. I did think about it afterwards, but first time happen I think best to ensure my system is kept safe by direct removal of threats. This is advice I have had from the forum, not to mess with the unknown where viruses are involved. Safety first, fight again another day. Next time if happen, will look to capture some fraud screens as well for publish here.

Almost certain came from bad link on Google search, and no indication other than searching for older, less common computer components. But worth adding that an Adobe site was also open, and possibly browser helpers active (with my unknowing). and I did probably close all down too quickly rather than investigate the matter further. But I have other things to do as well.

First time happen. Only doing usual tasks. Certainly a bit of a worry. Be careful out there.
Avast7 Free, MBAM (on demand), MVPS Hosts

Intel DG41TY, Windows 7 Ultimate, IE9, Google Chrome, 4 GB ram, Secunia PSI, ccleaner, Foxit Reader, Faststone Image viewer, MWSnap.

YoKenny

  • Guest
Re: Bahama Botnet Discovered as Source of Click Fraud Surge
« Reply #3 on: September 20, 2009, 11:38:17 PM »
@mks

Install Browser Defenderâ„¢
Quote
The Browser Defenderâ„¢ toolbar allows you to surf safely by displaying site ratings as you browse the Internet. When you visit a site its address will be checked by our servers and a rating shown in the toolbar based on any malicious behavior or threats we have found associated with the site.
http://www.browserdefender.com/download


Offline mathboyx215

  • Avast Evangelist
  • Poster
  • ***
  • Posts: 449
Re: Bahama Botnet Discovered as Source of Click Fraud Surge
« Reply #4 on: September 20, 2009, 11:45:54 PM »
There seems to be a bug in browser defender.
It will display the rating if I do a google search when I start up my browser.If I go to another site and do a google search again,it will not display the rating.
It is not possible to divide anything by zero

Offline mkis

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1618
Re: Bahama Botnet Discovered as Source of Click Fraud Surge
« Reply #5 on: September 21, 2009, 12:04:48 AM »
@ YoKenny. Yes good idea. I have it installed on a different computer and seems okay. I should add that likely that I also had on online publication open at the time (happened bout week ago) and I wasn't inside igoogle. I was kinda rush searching, so browser defender may be good idea.


@ mathboyx215. Browser defender rated site potential bad for first time, then an hour later was rating it good again. The site is php/css and bulletin board type but very seldom has comments. Just posts. I kept in touch with the site using same computer but never happened again.
http://eduspaces.net/mkistech/weblog/699801.html
Avast7 Free, MBAM (on demand), MVPS Hosts

Intel DG41TY, Windows 7 Ultimate, IE9, Google Chrome, 4 GB ram, Secunia PSI, ccleaner, Foxit Reader, Faststone Image viewer, MWSnap.

spg SCOTT

  • Guest
Re: Bahama Botnet Discovered as Source of Click Fraud Surge
« Reply #6 on: September 21, 2009, 12:09:06 AM »
Well, it is a beta...


YoKenny

  • Guest
Re: Bahama Botnet Discovered as Source of Click Fraud Surge
« Reply #7 on: September 21, 2009, 12:26:04 AM »
There seems to be a bug in browser defender.
It will display the rating if I do a google search when I start up my browser.If I go to another site and do a google search again,it will not display the rating.
Go to PROFILE then Forum Profile Information then update your Signature: with your operating system details and browser preference

YoKenny

  • Guest
Re: Bahama Botnet Discovered as Source of Click Fraud Surge
« Reply #8 on: September 21, 2009, 12:33:24 AM »
Well, it is a beta...
I'm not a fan of PC Tools but I like Browser Defender:
http://www.pctools.com/forum/forumdisplay.php?f=63

Offline mathboyx215

  • Avast Evangelist
  • Poster
  • ***
  • Posts: 449
Re: Bahama Botnet Discovered as Source of Click Fraud Surge
« Reply #9 on: September 21, 2009, 12:39:44 AM »
There seems to be a bug in browser defender.
It will display the rating if I do a google search when I start up my browser.If I go to another site and do a google search again,it will not display the rating.
Go to PROFILE then Forum Profile Information then update your Signature: with your operating system details and browser preference
How would that help?
It is not possible to divide anything by zero

Offline mkis

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1618
Re: Bahama Botnet Discovered as Source of Click Fraud Surge
« Reply #10 on: September 21, 2009, 12:56:49 AM »
Haven't checked yet, but as Scott says, still in Beta. So all info good info.

I don't mind WOT either. I know it has its limitations, but I see a day where the momentum of users plus tech  deployments may outweigh likelihood of false indicators to provide a kind of finjan for general users. Though when a site becomes hijacked, hard 2 see how user momentum in WOTcan suddenly swing around to show the opposite reading. Prob keep reading site as safe. I dont know, Im a bit out of touch, but I like the general idea behind WOT.
Avast7 Free, MBAM (on demand), MVPS Hosts

Intel DG41TY, Windows 7 Ultimate, IE9, Google Chrome, 4 GB ram, Secunia PSI, ccleaner, Foxit Reader, Faststone Image viewer, MWSnap.

YoKenny

  • Guest
Re: Bahama Botnet Discovered as Source of Click Fraud Surge
« Reply #11 on: September 21, 2009, 01:11:30 AM »
There seems to be a bug in browser defender.
It will display the rating if I do a google search when I start up my browser.If I go to another site and do a google search again,it will not display the rating.
Go to PROFILE then Forum Profile Information then update your Signature: with your operating system details and browser preference
How would that help?
I don't use Firefox.

WOT seams to have their fanboys and seem to be swayed by the weather or a bad meal or a scolding of a co-worker:
http://redwing.hutman.net/~mreed/warriorshtm/fanboy.htm

Offline mkis

  • Avast Evangelist
  • Super Poster
  • ***
  • Posts: 1618
Re: Bahama Botnet Discovered as Source of Click Fraud Surge
« Reply #12 on: September 21, 2009, 02:20:03 AM »
You're going to get that anyway when you have user participation as part of rating. I thought user momentum - more good than bad - might swing in favor of reasonable accurate indicators. Kind of like how common law came about.

So what to do when fanboy accidents across a real threat? This is a worry as well. Will user momentum simply crowd out individual inputs to start with, until threat becomes manifest as real danger and is rapidly spreading. Or can WOT work it in time to prevent real danage? I guess you're saying, no WOT can't do enough when it comes to that scenario either.
Avast7 Free, MBAM (on demand), MVPS Hosts

Intel DG41TY, Windows 7 Ultimate, IE9, Google Chrome, 4 GB ram, Secunia PSI, ccleaner, Foxit Reader, Faststone Image viewer, MWSnap.