Stealthy click fraud tool exploits 9ball attack
Meet the Keyser Soze of malware
Regcast training : Hyper-V 3.0, VM high availability and disaster recovery
Miscreants have developed one of most sophisticated click fraud malware applications to date.
The Trojan code - dubbed FFsearcher by security firm SecureWorks - plugs into a Google API that allows webmasters to add a Google-powered search widget (called "Google Custom Search") to their website. In normal use, search results made via the widget are displayed alongside Google AdSense ads, with webmasters receiving a small fee every time a surfer follows an ad.
The malware hijacks this feature so that every search an infected user makes is performed through a search widget under their control, so that they get paid by Google every time a surfer clicks on a sponsored ad. Hackers have also worked out a means to pull off this sleight of hand without giving any indication to surfers that anything might be amiss. Google might find it hard to unravel instances of fraud.
As such, the attack is more sophisticated than previous click fraud approaches, which relied on tricks such as changing a surfer's start page and searches to point to a third-party search engine, types of behaviour that might more easily be detected. FFsearcher works on both IE and Firefox.
"Every click on an ad is user-generated, and the user never notices any change in their web-surfing experience," writes Joe Stewart, director of malware analysis at SecureWorks.
FFsearcher is part of the exploit bundle spread by the recent Nine-ball mass compromise, SecureWorks adds. A comprehensive write-up of the attack - complete with screenshots - can be found here. ®
COMMENTS
Tough titty
These Google AdSense ads are a bloody nuisance !
They are so laced with malware these days as to pose quite a a threat in themselves, to the unwary. When training newbie folks in how to use the internet (it still happens), I have to point out the dangers of clicking on Google AdSense ads and advise my clients to just ignore them, as it's safer.
Which makes me wonder about the Value For Money that the paying advertisers are getting. And being linked to malware infections isn't going to be good for any company's rep.
ALF
Fraud?
since Every click on an ad is user-generated, the user is really showing interest in the ad.
for the advertiser it is not a fraud.
It is just only that google share on the revenue of the ad is lower than before.
Therefore I am sure that google will fix the api so that such a stealthy revenue diverter is not possible anymore.
IT infrastructure monitoring strategies
Agentless Backup is Not a Myth
Top 10 SIEM implementer’s checklist
Steps to Take Before Choosing a Business Continuity Partner
Requirements Checklist for Choosing a Cloud Backup and Recovery Service Provider
