The Register® — Biting the hand that feeds IT

Feeds

Stealthy click fraud tool exploits 9ball attack

Meet the Keyser Soze of malware

Regcast training : Hyper-V 3.0, VM high availability and disaster recovery

Miscreants have developed one of most sophisticated click fraud malware applications to date.

The Trojan code - dubbed FFsearcher by security firm SecureWorks - plugs into a Google API that allows webmasters to add a Google-powered search widget (called "Google Custom Search") to their website. In normal use, search results made via the widget are displayed alongside Google AdSense ads, with webmasters receiving a small fee every time a surfer follows an ad.

The malware hijacks this feature so that every search an infected user makes is performed through a search widget under their control, so that they get paid by Google every time a surfer clicks on a sponsored ad. Hackers have also worked out a means to pull off this sleight of hand without giving any indication to surfers that anything might be amiss. Google might find it hard to unravel instances of fraud.

As such, the attack is more sophisticated than previous click fraud approaches, which relied on tricks such as changing a surfer's start page and searches to point to a third-party search engine, types of behaviour that might more easily be detected. FFsearcher works on both IE and Firefox.

"Every click on an ad is user-generated, and the user never notices any change in their web-surfing experience," writes Joe Stewart, director of malware analysis at SecureWorks.

FFsearcher is part of the exploit bundle spread by the recent Nine-ball mass compromise, SecureWorks adds. A comprehensive write-up of the attack - complete with screenshots - can be found here. ®

Agentless Backup is Not a Myth

Latest Comments

share?

PoC or it didn't happen!

0
0

Tough titty

These Google AdSense ads are a bloody nuisance !

They are so laced with malware these days as to pose quite a a threat in themselves, to the unwary. When training newbie folks in how to use the internet (it still happens), I have to point out the dangers of clicking on Google AdSense ads and advise my clients to just ignore them, as it's safer.

Which makes me wonder about the Value For Money that the paying advertisers are getting. And being linked to malware infections isn't going to be good for any company's rep.

ALF

0
0

Fraud?

since Every click on an ad is user-generated, the user is really showing interest in the ad.

for the advertiser it is not a fraud.

It is just only that google share on the revenue of the ad is lower than before.

Therefore I am sure that google will fix the api so that such a stealthy revenue diverter is not possible anymore.

0
0

More from The Register

 breaking news
NSA PRISM snoop-gate: Won't someone think of the children, wails Apple
10,000 things probed, mostly about missing kids, Alzheimer patients, we're told
 breaking news
NSA PRISM-gate: Relax, GCHQ spooks 'keep us safe', says Cameron
Whatever they are up to, it's all above board, we're told
PRISM snitch claims NSA hacked Chinese targets since 2009
Snowden suddenly looks safer in Hong Kong after revelations
 breaking news
US chief spook: Look, we only want to spy on 6.66 BEELLLION of you
Americans assured they are not in the NSA's sights
Speech-to-text drives motorists to distraction
Will talking to you mean I crash into that car up ahead, Siri?
DHS warns of vulns in hospital medical equipment
Has your doctor's anasthesia machine been hacked?
 breaking news
'BadNews is malware' says outfit that found it
Google says code harmless but Lookout says code base is evolving
Panda-peddlers cuffed for chess gambling gambit
More porridge on the menu for Chinese coders after second offence
 breaking news
Yes, maybe we should keep hackers in the clink for YEARS, mulls EU
Watch out black hats, they just might throw away the key
Microsoft borks botnet takedown in Citadel snafu
Stupid Redmond kicked over our honeypots, wail white hats