Microsoft and Symantec take out botnet responsible for more than $1m of fraud

http://www.guardian.co.uk/technology/2013/feb/07/microsoft-symantec-botnet-fraud-pcs

Version 0 of 1.

Microsoft and Symantec have disabled a two-year-old network of remotely controlled PCs, or "botnet", that was responsible for at least a million dollars in "click fraud" every year – and possibly substantially more – and which may have controlled as many 1.8m PCs.

The ringleaders are reckoned to be spread globally, in Britain, Russia and Romania, the US and Australia. They used false names and stolen credit details to register a string of domains and hire server space in a number of locations. None has yet been identified formally or arrested.

The "Bamital" botnet, set up in late 2009, took over PCs and would silently click on specific adverts in search results – hijacking an average of three million clicks per day, and exposed the PCs' owners to the risk of more infection as they were taken to other sites that could carry further malware.

But the researchers point out that it is by no means the largest botnet in operation, which "puts the magnitude of click fraud botnets into perspective. There are millions of computers hijacking legitimate searches as well as generating non-human network traffic. The exact amount of loss being incurred by legitimate organisations is impossible to gauge."

But they reckon it is worth millions of dollars to the criminal underground behind the creation and exploitation of such botnets.

Click fraud is a serious problem for advertisers and search engines. Bamital exploited both the "pay per click" model, where advertisers are charged by a distribution network for every click on an ad displayed online, and the "search results" model – by diverting any click from a search results page to a fake site offering a counterfeit version of a product the user had sought.

The criminals behind the scheme were taking advantage of search advert pricing which could be as small as four-hundredths of a cent - meaning that they had to build up a large botnet that even so remained undetected by infected users, and hijack huge amounts of traffic in order to profit. The process by which clicks were rerouted via "traffic brokers" to paying advertisers was so complex, said Symantec, that in some cases it could go through 10 hops before reaching the actual advertiser.

The initial infections of the PCs were carried out via pornography sites and sites promising pictures of celebrities, as well as shopping searches.

In a white paper on the botnet and its effects, Symantec warns that "data shows that Bamital activity peaked in 2011 and early 2012. While the malware remains active today, there are indications that the attackers are reorganising their operations."

It also says that "click fraud is a lucrative business in the malware industry", and points out that Bamital is just one of the many pieces of malware used to infected computers for this work.

The takedown involved raids on data centres in New Jersey and Virginia, and followed a year of cooperation between Symantec and Microsoft. Last week the companies finally acquired a court order to seize the servers being used for "command and control" of the botnet, although those in charge of the data centres are not thought to be responsible.