Click Here To Infect Your PC!

Email me for FREE viruses writes "Just how many people would click an ad saying "Is your PC virus-free? Get it infected here!"? According to the security researcher who ran that very ad on Google for 6 months, 0.16% (409 of 259,723) would click on it. 98% of those people were running Windows. The Google Adwords campaign cost $23 in total, which works out to $0.06 per infection had the site actually been malicious."

Goatse!

Goatse! [goatse.ch]

Everyone loves a good goatse.

How many slashdotters

Then went and clicked on the link in the article? :P

Re:How many slashdotters

You mean amongst the approximately 0.16% who actually RTFA? :o)

Re:How many slashdotters

"Click Here To Infect Your PC!" == "NAKED NAKED NAKED LADIES FREE BEER"

Curiosity killed....wait free beer?

Re:How many slashdotters

Well, there is a certain logic to it anyways. Normally when you click a pr0n-link, you get infected with a virus. So if you click a virus-link, you would expect to see porn.

Re:How many slashdotters

Thats why real perverts run linux ;)

Re:How many slashdotters

Yes but I did it from lynx, on a non priveliged account, on an AIX box - I'd like to have see the malware that would target that!!!

I'm not paranoid!! They are out to get me!!

Re:How many slashdotters

I'm not paranoid!! They are out to get me!!

hmm, there's still scope for narrowing the attack surface. I'll snail-mail you a C64 port of Lynx and follow with a MD5 hash to your next door neighbor 2 weeks later ...

Re:How many slashdotters

Arguably, you wouldn't want to use Internet Explorer for that. 80% of the visit to the site were made with IE. Here is a quote :

Here is a breakdown: IE 5.5 1
IE 6.0 286
IE 7.0 48
Safari (419.3) 1
Opera 9.01 1
Opera 9.10 1
Firefox 1.0 7
Firefox 1.5.0.7 9
Firefox 1.5.0.8 2
Firefox 1.5.0.9 3
Firefox 2.0 3
Firefox 2.0.0.1 6
Firefox 2.0.0.2 1
Firefox 2.0.0.3 21
SeaMonkey 1.1 2
AdsBot-Google 24

Total 416

It's hardly a surprise

to tech professionals, that users need clue distributed by bat

Re:It's hardly a surprise

Getting rid of most std's is easier than getting rid of some spyware/viruses...

Consider your average spyware/virus akin to chlamydia or syph, while the really nasty stuff is more like aids/herpes...

Granted, you can't reformat your body and get rid of it, but if you consider a reformat more along the lines of reincarnation...

Re:Time for a crusade!

If you had a hardened system first then porn wouldn't be as useful.

Re:It's hardly a surprise

The worst-case scenario are however very significantly different.

Worst-case for a virus-infected windows-machine ? Complete reinstallation. A day lost, hell make it "toss away $1000 machine".

Worst-case for std ? Death.

Not really comparable.

Sad...

The sad thing is that using something more enticing like "Free boobs this way" would send millions of clueless Joe Windowses your way... All ripe for the picking.

Re:Sad...

Which way did you say?

Badsense

The sad thing is that using something more enticing like "Free boobs this way" would send millions of clueless Joe Windowses your way...

I can see the advert now:-

Free boobies for all! [wikipedia.org]
Cute booby chicks for your delectation! aff
en.wikipedia.org

Re:Sad...

It's true. Free porn is a great way to get people to click on things they usually wouldn't click on. While I was in college about 8 years ago, I set up a porn share from my computer that was password protected. I also included a file called GET_PORN_PASSWORD.EXE which popped up a box with the password. The EXE also installed the client stub for Sub7 (a type of back-orafice program). Since Sub7 was fairly new, none of the antivirus software picked up on it. Over the next 24 hours I had pretty much 8,000 machines that I could fully remote, pull data off of, log key strokes, etc (my personal favorite was opening the cdrom drive and playing a "FEED ME" wave file).

Luckily I was never questioned about the matter and by the time most people caught on, Antivirus definitions were updated to detect the Sub7 stub.

0,16%

At a click rate of 0,16% - about one in 600 - I have to wonder if not a fairly large portion is simple click errors. You intend to click on some other link nearby on the page but by mistake click that one instead. There's several kind of interaction slips just like that that we do in other circumstances after all.

Underserved group

At a click rate of 0,16% - about one in 600 - I have to wonder if not a fairly large portion is simple click errors.

At first I thought the same thing, just random misclicks. But then it hit me, there are a large number of users on the internet that don't have the know-how to install a virus on a computer of someone they hate, like an uppity coworker.

Imagine a bussiness model that would allow anyone to simply 1-click and install a virus (not a feature, those are patentable). Revenue would be generated with advertisments downloaded by the trojan, that would popup at random times on the victims computer. In essence, the victim would have to pay for the service. Brilliant!

Re:Underserved group

For the Debian users, it's easy: http://debianplanet.org/?from=405 [debianplanet.org]

Re:0,16% Mac/Linux users

And of that tiny percentage how many were Windows users taking the fairly safe bet that the ad didn't do what it said?

Re:0,16% Mac/Linux users

Virus scanners create a false sense of security.

<user> I have Norton. My computer is now immune to all viruses.
(one week later)
<user> I have a virus, can you fix it?

I've seen people many times think that because they had Norton or McAfee, that they could do whatever they want without having to worry about getting a virus and act reckless. Open every attachment they get in email, downloading and running random .exes from "FREE!!!!!!!!!" sites, use Internet Explorer, etc.

or cache pre-fetch

Would any aggressive cache pre-fetch engines follow links like this?

Re:0,16%

Even those who deliberately clicked on the link could have easily read the text as, "Get it inspected here!" Not an excuse, but certainly understandable. How many /. article postings contain at least one sincere reply of the form, "Am I the only one who read that as...?"

Hmmm

It's news that at least 0.16% of people are idiots? Actually I'm shocked the number was this low. This is actually good news.

Re:Hmmm

Consider that click through rates to a relevant ad are typically less than 3%. This represents 5% of people who would normally click on an advert.

statistics

sorry, couldn't RTFA because the link text was kinda prohibiting.

the poster makes it sound as if the conclusion from the statistic is something like "oh my god, windows users are sooo dumb". but also quoting the percentage of all users using windows would reveal a prior probability of something in the 90s already. so, assuming that the "experiment" has an error greater 0, the deviation between the prior probability and 98% has almost no significance...

Re:statistics

i was reading that more as "no, that was not linux users clicking the link for fun". i mean, i would click on such a link ;)

Not exactly.

The Google Adwords campaign cost $23 in total, which works out to $0.06 per infection had the site actually been malicious."

Not exactly.

$0.06 per infection attempt, which is obviously not the same thing.

Re:Attempted Infection == Infection

Yes, but if you didn't know what it was or whether it was safe, you wouldn't click it in your browser, would you? You'd use netcat. For example, if the link goes to http://somesite.someisp.cc/some/long/filename.ext? query_string [someisp.cc] then you'd need to do

echo -e "GET /some/long/filename.ext?query_string HTTP/1.1\nHost: somesite.someisp.cc\n" | nc somesite.someisp.cc 80

which will dump the raw HTTP response onto STDOUT. And that's safe because you can't muck anything up by printing to the screen (well, you might get unlucky and have some weirdy escape code sequence turn off echo or redefine the entire character set or beep incessantly; but the whole beauty of xterm windows is that you can always close one forcibly if you have to).

And then, if and only if it looks safe, you can use wget http://somesite.someisp.cc/some/long/filename.ext [someisp.cc] to download it for investigation.

Re:Attempted Infection == Infection

Oh no, that's much too complex. I just click on the little blue "E". Works every time.

Oh dear.

This just goes to show, not matter how much you warn people they're about to do something really dumb, the still will. How many people do you think read that advert, though "No, it can't possibly mean that..." and then clicked on it to see?

Re:Oh dear.

Or how many people thought ' it cant happen to me, as im protected ', but were still curious what the page was about.

Browser stats

The comments give the browser stats:

335 - some version of IE
52 - Some version of Firefox
5 - other

That gives Firefox a 15% share.

Tim.

Re:Browser stats

Why should I have to work to protect my browser? Or my computer while just *going* to a web site.

There's such a huge jump in logic there that it just befuddles me that 'configuring properly' is required to use the internet.

No computer/browser is perfect, but it just makes basic sense to use a computer/browser that starts at a very secure state and allows you to open it up if you want/need. Rather than the other way around.

<bad car analogy> It's like having to put rear view mirrors on your car after you buy it. </bad car analogy>

Re:Browser stats

Ha! I was going to suggest that firefox users are more "educated" and less likely to click on a link.

It's not so simple. Their education allows them to know that they should not click on such a link in IE. But it also tells them to run Firefox. While running Firefox, especially on Linux, they would have no risk, and curiosity will win.

It might be more interesting (but harder to obtain) a statistic broken down not only by the browser which user is currently using, but also by browser which they usually use. Here an "usual Firefox user currently stuck on IE" might be less likely to click on such a link. But such data can unfortunately not be obtained, short of asking user directly.

Hmmm, and even in that case, the behavior might not be what would be expected. A "usual Firefox user currently stuck on IE" might still click on that link, in order to teach the party who stuck him on IE a lesson... Tricky, tricky...

On the whole though I'd assume that there were the roughly same proportion of idiots in each camp

Not necessarily. As shown above, both idiots and smart people might click on the link. But they would do so for different reasons.

Doesn't really mean much

Hell, if I saw that link I'd click on it for sure. Well, I might drop to Cygwin and use lynx "just in case", but there's no way I'd not investigate such a link.

ONLY?

0.16%? I'd have guessed far more would click.

Next time call it "hot chicks with huge tits want to give you some love virus". I predict a /. effect.

Why does it matter what OS they were using?

I once explained that browser security is almost entirely determined by the user. This proves it. I wouldn't trust that 0.16% with a pocket calculator, let alone a computer!

You can't write code or design software that will secure "stupid." Firefox and Linux are certainly easier to secure, and they have a better security model, but they aren't idiot proof.

If those folks were using an abacus, they'd probably get their head stuck in it! <G>

--
Toro

Malicious intent

I think it might very well be possible that many of those clicks are made from computers that are not owned by the user. Like maybe the school's computer or a friend's (who has wronged you) computer that the user (who has access, but not the know-how of how to infect)would want to harm. So I'd wager that quite a few of those clicks would not qualify as a completely idiotic act.

Idiots ?

Maybe people clicking this link are not so dumb.

I would say that people clicking "Click here to check if your PC is virus-free !" are more stupid.
Personally, I wouldn't have clicked the "get infected", but I understand curious people who would because they are confident in their protection and this is kind of joke. When I see "Get your PC infected !", I think "no way, nobody can want this, must be a joke or something".

Of course, being confident in one's protection and using Windows IS stupid...

You pay all this money for AV software..

sometimes you just like to know that it is working.

I wonder if average users of AV software look at their "quarantined files" and do a rough calculation of how much each of them cost..

"Hmm, I paid $60 for AV software this year and I've had a grand total of 4 files quarantined.. that's $12.50 per file."

I guess not, as 99% of people probably have zero files quarantined, not counting the false positives (I know I do).

Re:You pay all this money for AV software..

Looks like we have a member of the 0.16% here on /.
$12.50 x 4 = $50

This is only a test....

It is possible that some folks were testing their antivirus/patch status when they clicked? How many of them were loading the web page for forensic analysis?

Security "white hats" do things like that you know. All those hits could be FBI agents for all we know. ;^)

--
Toro

summing up the numbers..

From a browser perspective, 52 clicks were Firefox and 335 were IE (added up from TFA). So, 13% of those who clicked were using Firefox. From what I recall, 10-15% of all internet surfers use Firefox... I personally would have suspected a larger proportion of IE users.

Huh?

Last time I ran a Google Adwords campaign, they'd drop your advert if you get less than a threshold clickthrough rate. I think it was 0.5%. It was certainly higher than 0.16%. So how did they do this? Have Google dropped that restriction?

For once I have an excuse...

for not RTFA'ing. Being a true /.er, here's my opinion anyway:
Microsoft sucks. Users are idiots.

assuming they are humans

of course these clicks couldn't be from Spiders/Robots, a lot of rogue bots/spiders use the IE UserAgent so as to fool logs, they tend to click on every link (adverts and hidden spam trap links included) i know ive grepped my logs and see so-called IE "users" clicking on every single link and download on my site within 10sec, all the time (must be fast readers or a bot) look for MFC in the UA string too as this is a sign of the IE COM component which is what a lot of the bots/spiders use for their dodgy page slurping

so by the time you remove the bots from these stats you are probably left with 3 genuine clicks and a load of "LOL this advert cannot be serious, lets have a look" clicks

click_me.exe

My good friend once joked that 95% of users would double click an icon named "ClickMe.EXE", without much thought at all.

the other 5 percent would right click and select open.

Wait....

Was this story really submitted by Gates himself?

small number of people

409 of 259,000 people is a pretty small percentage. How many of those clicks were just accidents where people only read the first sentance? How many were just mac people trying to make windows people look bad?

this is stupid

I'd just like to point out that all of you posting on this thread got here by clicking a link which says "Click Here To Infect Your PC!". Therefore, by the authors logic (and the logic of many of the posters themselves) you're all a bunch of morons. Congratulations!

I worked with a guy...

He comes into work one day and you can tell by looking at him that he's pissed. He goes into the break room to get ready for the shift so I go back there and ask him what's wrong.

He says, "I'm need a new ****ing computer."
I ask why...
"because the one I have now is too slow. I can't use the web because I get hundreds of popups."
I tell him that's a pretty easy thing to fix and off to burn a CD and write up some directions for him.
He tells me that won't work... again, I ask why.
"Because I'm ****ing sick of Microsoft."
I tell him I totally understand that, but that his problem with the pop-ups is pretty easy to fix.
He says, "No, it's not. I click on all the Windows that ask me if I want to remove the viruses from my computer and they are always charging me $20-$40 per virus. I spent almost $400 last week!"

Another computer savvy employee had joined the conversation by this point and we both looked at each other in complete disbelief. The guy wasn't joking...

My PC is still virus-free?

I'm disappointed.

Ads?

What ads?

Do not press this button

It's just like telling children "don't touch that". It only makes it more alluring...

a better study

"click here for virus" sounds like a joke.

A better study would involve a warez site with an application designed to trigger false positives among AV scanners. I wonder if embedding a virus in a function that never gets called would set off a virus scanner.

How many of them were vulnerable?

The article didn't mention any actual vulnerability detection. The price per infection at least quadruples when you consider that the web site would have a very difficult time determining in what ways each client was vulnerable and then providing the proper payload. The quoted price per infection was for advertising only. Since AdWords uses the logevity of your web site to rank your ads on their results pages, you would need to host this on a paid-for web host/connection because a hacked account is very temporary.

One explanation is that those clicks are by security researchers, probably running a virtual machine to test the link.

Curiousity

Why do people assume that the 409 persons who clicked that ad are stupid? If I had seen such an ad, I would have clicked it, because I know how not to get infected, and that it would have aroused my curiousity.

Maybe some of the 409 persons are clueless and dumb, maybe some clicked by error, and maybe some were curious and amused.

That's good news

I'm encouraged by the fact that only .2% clicked the link. I would have thought there were more curious risk takers and complete morons out there.

Can it be click fraud?

By default adwords places the ads also on the Google Network (the famous ads by Gooooogle). The website owner gets some revenue if users click on the link. Inscupulous webmasters pay people to visit sites and randomly click on ads.

Does anyone know how much Google refunds advertisers for "quality adjustment"? It is probably above the difference between 0.16% and the typical 2-3%.

Bogus because it's flawed

The tester did not take into account that his/her ad will also appear on 3rd party websites which the owner stands to make money from. There are many groups that take advantage of ads being displayed on their own 'ring of websites' and will generate fraud clicks no matter what the title/description of the ad displayed.

Example:

Joe runs a website. Joe decides he wants some income for his website and signs up for Google Adsense which displays contextual Google ads on his website. Google gives Joe a percentage of the revenue (30-40%?!-google doesn't tell exactly how much.) Joe decides to get some of his friends to click on his ads to boost his monthly revenue. Joe makes more money, and the ad gets more clicks. Advertisers have no idea that Joe is falsely generating clicks and will happily pay Google for the clicks, which in turn Google pays Joe his dividends as well.

Now if the tester turned off the ability to have his ads displayed on 3rd party websites, then the test would carry a bit more ground.

I'm not saying people aren't dumb enough to click on the ad, I'm just bringing up a valid point that exists in web advertising everywhere, especially Google (even they will tell you that their fraud systems will catch the persons 100% of the time - lol)

h

I know why this happens

98% of those people were running Windows.

And 99% of this 98% were running FireFox with Adblock Plus extension.

Bad Math

409 / 259,723 ~ 0.001574% ...not 0.16%. --- John Martinelli RedLevel.org Security

Did anyone notice?

The submitter "email me for FREE viruses" has an e-mail link to [e-mail]

98% of "victims" were using Windows

So 2% were running some superior OS? I am appalled that a single Linux or Mac user would fall for this. You would think that someone who bold enough to think outside Microsoft's box would read before they clicked. Well, maybe a Linux user clicked on it on purpose just to get a kick out of the fact that his/her system is immune to the virus they think they were exposing themselves to.

Click Fraud

Its more than likely just the click fraud. Having worked on internet ad servers and reporting engines, its a pretty reasonable number for people deliberately trying to improve their CPC by cheating.

I know people are desperate to believe that some people are stupid, and masturbate at the thought of them, like, getting their computer all screwed up because they deserve it for being so dumb, but cheating is a far more logical, and real explaination.

reminds me of

(link to video) those Girls pledging to support abolishing women's suffrage [break.com]

Law firms?

According to the security researcher who ran that very ad on Google for 6 months, 0.16% (409 of 259,723) would click on it.

I have to wonder if that is the number of law firms out there that use google, noticed the ad and thought they won the lottery. Get a PC, put critical data on it, then click the ad. Then sue Google, the sponsor and laugh all the way to the bank. I bet they were thinking this is way too easy... Slam dunk lawsuit!

if clicking a link is the same as executing..

..then I wouldn't just say "dumb user." I'd also say, "amazingly defective web browser." I never worry about the "consequences" of clicking links, except for what they might do to my mind (e.g. goatse).

The story here isn't that people clicked the link; the story is that it still apparently matters what people click. In other words, there are still some MSIE users out there.

Clickhereforfreepics

Oh the late 90s, what memories

Is there such a thing as research trolling?

I think this Didier Stevens (if that's his name, didn't follow the link myself) counts as a troll, whether he's claiming to do research or not. He can't explain or document WHY those 409 people followed the ad. His "research" doesn't prove that those 409 people are stupid and clueless, because he can't document WHY they clicked on his ad.

More likely than not, those were the *most* intelligent of the 260,000 people that saw it, and were completely stunned and disbelieving that anyone could place such an ad, and thus were compelled by curiosity to investigate the ad (no doubt with extreme caution).

I, frankly, would like to hear from some of those 409 people. Their story is probably much more interesting than reports of this troll's "research".

Seriously stupid piece

Why? It demonstrates how stupid somebody is to believe that .16% stupid people is something that is NEWS.

The number of stupid people is more like 98%. .16 isn't even on the radar.

In fact, those .16% were probably SMART and CURIOUS people with a lot of security software installed on their Windows machines who clicked on the ad to see IF their system could be infected. For all we know, they were all running their browsers in a VM!

Morons wrote the article.

Morons published it here.

'Nuff said.

Relavance?

Can someone please explain the relevance of the "98% of those people were running Windows" statement? This is an honest question and I just don't see the correlation between how many people are dumb enough to willingly click on an ad to infect there PC with a virus and what OS they are running.

Typical Adds

Its Just Like those adds that promise me prizes and then when I click on them I never get anything. This offered me viruses and do I get any?

Very disappointed

I clicked the link TWICE and still didn't get infected. :(

my experience

I have to say that years ago I wrote a little vb app as a joke for april fools day that said that it was deleting windows froze up your pc and showed a fake bluescreen of death until the user did a ctrl+Q (it didn't tell you that though) and dropped it on the desktop of 5 ppl at work (at a place that I was doing IT)- the app was called "virus.worm.exe" all 5 of them tried to open the file when they saw it there and called me to fix their pc's. so I have to say that I am surprised so few clicked through the link.