IE Used To Launch Yahoo IM Clickfraud 76
An anonymous reader writes, "There's a new Instant Messaging worm in the wild that is taking the idea of Botnet clickfraud up a level. It trades in automated drones (prone to malfunction and detection) for real live people who (of course) have the option of not actually clicking anything, thus theoretically making their clicks harder to identify as 'fraudulent.' This IM attack doesn't even need a victim to physically run anything to become infected — simply visiting a certain site in Internet Explorer will cause the files to download and start sending infection messages. At this point, their homepage is changed to a site using Mesothelioma (a rare form of cancer) to ring up high-paying results on the perpetrators' Google ads. As the researcher who discovered the infection notes, 'It's way, way harder to trace some random boob who has a ton of (partially) unconnected people shunting IM links all over the place. Try staying anonymous as a Botnet owner who just had the entire details of his server splattered across the net by Shadowserver. What will be interesting to see is if some of the smaller Botnet guys ditch their technical woes and jump on the much-easier-to-maintain IM bandwagon to get their clickfraud kicks.'"
What? (Score:5, Funny)
Re:What? (Score:5, Funny)
Re:What? (Score:5, Funny)
It trades in automated drones (prone to malfunction and detection) for real live people who (of course) have the option of not actually clicking anything, thus theoretically making their clicks harder to identify as 'fraudulent.'
Of course when you write (of course) with constant parenthetical statements (prone to misunderstandings and pointless complication) in the sentence, then use single-quotes for (apparently) 'no' reason, how could you (not you specifically, but 'you' in the general case) possibly understand it?
Re: (Score:3, Interesting)
Re:What? (Score:5, Funny)
Re: (Score:2)
HaHa. (Score:2)
[Translated Version] (Score:3, Informative)
Re: (Score:1)
Whatever the case, it's clear that we, as a global society, have greatly underestimated the horror th
Re: (Score:1)
I hope all self respecting slashdotters resisted the urge to RTFA in this case...
Re: (Score:1, Informative)
"Anonymous reader" should stick to reading! (Score:1)
Re: (Score:1, Funny)
*inserts toast into Betamax VCR and continues regardless*
Un-believable... (Score:2)
Oh well, I've had smart-assed comments modded "insightful" before as well....that's karma
I wasn't busy at all (Score:2)
Call it "smug" if you must, but it would appear my accessment was correct nonetheless.
No, just a mis-spelling (Score:2)
You're probably right... (Score:2)
In this forum, I type it and fire it off. For business communications, I spend a lot of time reviewing before I let it go.
Re: (Score:2)
Now, respond to this post so you can say you had the last word and that will be the end of the time I waste on you.
Re: (Score:2)
It was intended to be a subtle play on words, but it seems to have not had the desired effect. Perhaps I should have ended with something like this:
{voice from crowd}
{me}
Huh? (Score:2, Funny)
Seriously though, what the hell does that sentence mean?
Re:Huh? (Score:5, Informative)
Re:Huh? (Score:5, Informative)
If you want to screw over some lawyers and Google, search for mesothelioma and click on the AdSense links.
Re: (Score:2)
Re:Huh? (Score:5, Informative)
For 'mesothelioma', Exact Match, the current estimate seems to be that a max bid of $100/click will normally land one in position 1-3 and cost $44.23/click -- which is very, very good. It's not the highest I've seen (and there are ones that have both significantly higher CPC and probably a much higher clickthrough rate given greater applicability, judging from some experimentation... but I'm not here to help the click-spammers increase their take), but it's up there.
Re: (Score:2)
at least the Mesothelioma example targets lawyers (Score:2, Funny)
without RTFA... (Score:2, Informative)
Mesothelioma ads = gold mine for hucksters (Score:5, Informative)
You get an infected Yahoo IM. In addition to propogating, it turns your IE home page into an ad-filled page. The ad page works like Google's adsense, only in this case instead of Google paying a legitimate web site when people click-through the ad, Google or some other company winds up paying the scammer or his cronies.
Because of the way it works it's a lot harder to detect than automated fraud or paid-human click fraud. Because the end user will likely click on the ad only if he's actually interested in it, the company that originated the ad might not even consider it fraud - he's just found a live potential client.
What makes it fraud is that the end user's web page has been hijacked. In other words - it's spyware/adware.
Workaround: Don't use IE, and use a malware-detector that detects and blocks Yahoo IM Malware.
Re: (Score:2)
But I understand some people will just click out of curiosity and then - BANG! - the virus writer's got real money in his pocket.
D
Re: (Score:1)
Kdawson, plz to be replacing summary with parent (Score:2)
Re: (Score:2)
Don't click random links or run random crap you get via IM.
Still dump IE though.
Re: (Score:2)
Re: (Score:2)
I was just making sure I wasn't going to get flamed for NOT taking the opportunity to bash IE.
what the...? (Score:3, Funny)
WTF? This worm gives your computer cancer?
Re: (Score:1)
Re: (Score:2, Funny)
It can remotely install Windows on it without asking???
Just another example ... (Score:5, Informative)
The internet will not be safe, ever, because of those people. Yes, "click here to win a date with name-a-rising-star" will always find its way to someone that thinks there is some remote possibility that Bill Gates will pay you to forward emails, or that a music hall-of-famer needs a date from someone just like them. The human factor in security will always be the weakest link. ALWAYS.
Re: (Score:3, Insightful)
Re: (Score:2)
You can reduce 99% of this with proper education, but why teach THIS to your kids, when you can flood them with useless
Whew! (Score:2, Funny)
Sorry to ask the obvious.... (Score:1, Interesting)
Re: (Score:1)
Unfortunately, yes. I have to have both IE and Firefox for testing webpages, and YM as my main IM. And unfortunately, one of my friends is bombing me with this said worm.
Out of curiousity, I booted into ubuntu, logged into YM and tried it out, knowing I'm safe.
Re: (Score:3, Interesting)
At work some of us are stuck with the corporate desktop environment which means IE. The IT department has done a pretty good job keeping it locked down. When they run the corporate proxy server, it's easier to get a handle on what doesn't make it in. They also use managed switches, so if a machine starts spewing, it gets disconnected. It tends to stop worms that try to scan for vuneribilities or other bot activities. Even the new version of Skype that
Re: (Score:2, Insightful)
Re: (Score:1)
Re: (Score:1)
If C is just being a jerk then he'll probably be ignored (perhaps his clicks will just go unbilled by anyone). If C is trying to harm A's or B's business, then a lawsuit could result. If C does
Re: (Score:2)
If party B is the worm writer to get party C to click on the ad, then party C is not a real consumer interested in A's product at all. This fraud lines party B's pocket. A never intended to pay for clicks except by those who searched for the keyword because they were researching it for personal reasons.
Easy to stop... (Score:1, Insightful)
Doesn't sound right (Score:3, Informative)
Here, we have something different - an Instant Messaging attack launched by a webpage forcibly dumping executable files into a PCs temporary files directory, via some nifty VisualBasic scripting.
and further on:
So, how does this happen?
First of all, you need to hit an infection site using Internet Explorer - this exploit doesn't work in Firefox, for example. Due to the way these files are downloaded onto the PC, you can effectively make any site a potential threat and can scatter these files around wherever you like.
This sounds like a straight up "go to a web page and an arbitrary executable runs" attack. That would be a HUGE security hole in IE that has nothing to do with the rest of this issue. Not that it's never happened before, but I somehow doubt that this would be the first place we'd hear about it.
They play with fire (Score:1)
Hey, are you the submitter? (Score:1)
Reference (Score:2)
If the US Government can prevent banks (credit cards) from handling the proceeds of internet gambing, how comes they can't do the same for handling the proceeds of goods advertised by Spam (etc)?
Is there a US Government at all? Is the US Government controlled by a moral cesspit like Al Quaida say it is? Has Gw Bush sold his soul to the devil? Is the internet controlled by Aliens from the planet Zog? Stay tuned for more news - same chan
Funniest part of the article (Score:1)
Exposure to litigation - it can get you more than loads of cash. It can kill.
Sorry. (Score:1)
Who's missing? (Score:2, Funny)
Are we missing anyone?
YIM uses IE functionality (Score:2, Interesting)