Feeds

Botnet caught red handed stealing from Google

And Yahoo!... and Bing

Protecting against web application threats using SSL

A recently discovered botnet has been caught siphoning ad revenue away from Google, Yahoo! and Bing and funneling it to smaller networks.

According to researchers at Click Forensics, computers that are part of the so-called Bahama Botnet are infected with malware that sends them to counterfeit search pages instead of the real thing. They look authentic, and with the help of DNS poisoning routines, they even display google.com yahoo.com or bing.com in the address bar.

But the search results returned by these bogus sites have been ginned in some significant ways. While links contained in the organic results ultimately lead to a real site, browsers are first redirected to a series of ad networks that receive a small referral fee. Sponsored links, which typically pay the real search engine each time they are clicked, have also been jury rigged so a smaller ad network gets paid instead.

"The idea is to make money through click fraud," said Matt Graham, a risk analyst at Click Forensics that provides auditing services to advertisers. "When those people actually do searches, that's when these guys can display these ads hidden in the organic search results."

As this video demonstrates, the faux websites have precisely the same look and feel as the real Google, Yahoo or Bing. But traffic analysis tools show the infected computer is really connected to an impostor server with the IP address of 64.86.17.56. The counterfeit site actually pulls the results from the search engine it's spoofing before they're doctored, furthering the illusion that everything is on the up and up.

A Google spokeswoman said: "We are investigating and monitoring this issue just as we investigate and monitor many other botnets and schemes every day." A Microsoft spokesman declined to comment and representatives from Yahoo hadn't responded by time of writing.

The Bahama Botnet, so named because it initially used compromised servers from that country, has already been implicated in the rogue anti-virus ads that recently found their way onto the website of The New York Times. It's also been known for its mastery of search engine optimization techniques that send people to malicious websites when they search for current events topics.

Now, instead of attacking average joes with sloppy PC hygiene, it's turning on three of the world's biggest search engines. Graham said the number of infected machines he's observed is in the thousands. And that suggests the amount of damage is still relatively modest. Should the Bahama Botnet grow, it will be worth watching to see how these sleeping giants respond. ®

Reducing the cost and complexity of web vulnerability management

More from The Register

next story
Infosec geniuses hack a Canon PRINTER and install DOOM
Internet of Stuff securo-cockups strike yet again
'Speargun' program is fantasy, says cable operator
We just might notice if you cut our cables
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Israeli spies rebel over mass-snooping on innocent Palestinians
'Disciplinary treatment will be sharp and clear' vow spy-chiefs
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
Greater dev access to iOS 8 will put us AT RISK from HACKERS
Knocking holes in Apple's walled garden could backfire, says securo-chap
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
High Performance for All
While HPC is not new, it has traditionally been seen as a specialist area – is it now geared up to meet more mainstream requirements?
Security and trust: The backbone of doing business over the internet
Explores the current state of website security and the contributions Symantec is making to help organizations protect critical data and build trust with customers.