Slashdot stories can be listened to in audio form via an RSS feed, as read by our own robotic overlord.

 



Forgot your password?
typodupeerror

IE Used To Launch Yahoo IM Clickfraud 76

Posted by kdawson
from the botless-botnets dept.
An anonymous reader writes, "There's a new Instant Messaging worm in the wild that is taking the idea of Botnet clickfraud up a level. It trades in automated drones (prone to malfunction and detection) for real live people who (of course) have the option of not actually clicking anything, thus theoretically making their clicks harder to identify as 'fraudulent.' This IM attack doesn't even need a victim to physically run anything to become infected — simply visiting a certain site in Internet Explorer will cause the files to download and start sending infection messages. At this point, their homepage is changed to a site using Mesothelioma (a rare form of cancer) to ring up high-paying results on the perpetrators' Google ads. As the researcher who discovered the infection notes, 'It's way, way harder to trace some random boob who has a ton of (partially) unconnected people shunting IM links all over the place. Try staying anonymous as a Botnet owner who just had the entire details of his server splattered across the net by Shadowserver. What will be interesting to see is if some of the smaller Botnet guys ditch their technical woes and jump on the much-easier-to-maintain IM bandwagon to get their clickfraud kicks.'"
This discussion has been archived. No new comments can be posted.

IE Used To Launch Yahoo IM Clickfraud

Comments Filter:
  • What? (Score:5, Funny)

    by I'm Don Giovanni (598558) on Tuesday October 03, 2006 @06:55PM (#16299545)
    Can someone translate the summary into English?
    • Re:What? (Score:5, Funny)

      by Frizzle Fry (149026) on Tuesday October 03, 2006 @07:02PM (#16299607) Homepage
      I gave up at the point where my homepage gets changed to a kind of cancer.
      • Re:What? (Score:5, Funny)

        by Blakey Rat (99501) on Tuesday October 03, 2006 @07:44PM (#16299939)
        You got further than I did. I'm hung up at the second sentence.

        It trades in automated drones (prone to malfunction and detection) for real live people who (of course) have the option of not actually clicking anything, thus theoretically making their clicks harder to identify as 'fraudulent.'

        Of course when you write (of course) with constant parenthetical statements (prone to misunderstandings and pointless complication) in the sentence, then use single-quotes for (apparently) 'no' reason, how could you (not you specifically, but 'you' in the general case) possibly understand it?
        • Re: (Score:3, Interesting)

          by icepick72 (834363)
          I'm so relieved this self-help thread exists. I cannot understand a damn thing that article is saying. I'm not alone (;_;) To hell with it, I'm waiting for the next story. No comment.
        • Re:What? (Score:5, Funny)

          by sidb (530400) on Tuesday October 03, 2006 @10:30PM (#16300883) Homepage
          I'm glad I wasn't the only one to have that reaction to the atrocious writing. I actually did a mental double check that it wasn't April 1. Clearly, this post was submitted by an automated drone and then machine translated through several different languages to mask its true origin. Fortunately, I am onto the evil botmaster and have no intention to RTFA or click anything.
        • by sootman (158191)
          You guys made it to the summary? I'm still counting the buzzwords in the title.
      • [Translated Version] (Score:3, Informative)

        by Anonymous Coward
        The exploit changes their homepage to some page with Google ads about mesotheleoma, and the bad guys get money from the clickfraud (people seeing impressions on an expensive Google keyword, most likely because liability lawyers are suing over it or something, and looking for people to join various class action suits where the lawyers can get big money).
      • by J44xm (971669)
        No, no, I fear you've misunderstood the author's words. You see, your homepage gets changed to a site that USES that form of cancer, not into cancer itself. I think we'll both agree that transforming a homepage INTO cancer is, at best, a preposterous idea. I believe that, once you understand this, the rest of the summary will become perfectly understandable, if not rather eloquent in its labyrinthine beauty.

        Whatever the case, it's clear that we, as a global society, have greatly underestimated the horror th
    • I would hope the researcher doesn't have google ads enabled otherwise we are the infectious problem.
      I hope all self respecting slashdotters resisted the urge to RTFA in this case...
      • Re: (Score:1, Informative)

        by hdparm (575302)
        I thought self respecting slashdotters don't use web browser in question.
    • Or at least should anonymously read what they write before they anonymously submit it.
    • Re: (Score:1, Funny)

      by vilms (106676)
      hmm, I never ever RTFA, but this is the first time a lead-in has got me stumped. Or maybe I'm getting old.
      *inserts toast into Betamax VCR and continues regardless*
  • Huh? (Score:2, Funny)

    by scott666 (1008567)
    At this point, their homepage is changed to a site using Mesothelioma (a rare form of cancer) to ring up high-paying results on the perpetrators' Google ads.
    Wow. I had no idea there was a rare form of cancer that could change your homepage. It must be very rare indeed!

    Seriously though, what the hell does that sentence mean?
    • Re:Huh? (Score:5, Informative)

      by manastungare (596862) <manas@NOsPAm.tungare.name> on Tuesday October 03, 2006 @07:11PM (#16299685) Homepage
      At this point, their homepage is changed to a site using^H^H^H^H^H about Mesothelioma (a rare form of cancer) to ring up high-paying results on the perpetrators' Google ads. High-paying, because mesothelioma is an uncommon word.
      • Re:Huh? (Score:5, Informative)

        by Software (179033) on Tuesday October 03, 2006 @07:25PM (#16299813) Homepage Journal
        No, "mesothelioma" is high-paying because it's only caused by exposure to asbestos. Therefore, plaintiff's lawyers have determined that anybody searching for it probably has the disease and therefore the ability to win a case against the asbestos manufacturers. The lawyer will, of course, get a nice cut of that (tens or hundreds of thousands of dollars). So the searchers and their clicks are very valuable to plaintiff's lawyers. One estimate I heard was that AdSense links for mesothelioma were going for about $50, if you wanted a decent position.

        If you want to screw over some lawyers and Google, search for mesothelioma and click on the AdSense links.

        • by Lehk228 (705449)
          doesn't screw ovewr google. they get paid for the clicks. they also pay some of that to hosting web sites, unless the clicks are from the google search results page itself.
        • Re:Huh? (Score:5, Informative)

          by Anonymous Coward on Tuesday October 03, 2006 @07:54PM (#16300013)
          Google does offer a public tool for estimating cost-per-click and position based on keyword, match type, and maximum bid. Toying with it...

          For 'mesothelioma', Exact Match, the current estimate seems to be that a max bid of $100/click will normally land one in position 1-3 and cost $44.23/click -- which is very, very good. It's not the highest I've seen (and there are ones that have both significantly higher CPC and probably a much higher clickthrough rate given greater applicability, judging from some experimentation... but I'm not here to help the click-spammers increase their take), but it's up there.
      • by Carthag (643047)
        Thanks. Your post was more informative than the entire article summary.
  • As history illustrates the litigation around this type of cancer can net high returns for lawyers and those seeking damages- however these cases are rare. Thus the cost-per-click (CPC) can range quite a bit on bidding networks seeking these large litigation rewards. The bids may range from $4.00 to $13.00 per click and higher. This makes it a prime target for malware authors and worm writers who setup systems to either force or set-up a system to maximize clicks to these high paying keywords in order to gai
  • without RTFA... (Score:2, Informative)

    by tygt (792974)
    Without RTFA, and thus most likely wrong, but someone feeling right, I think that what's up is that it pops open an IE with links that are just begging to be clicked, and when you do, they get their money. Of course, the user may not actually click anything, but if they're like the lusers I've seen too much of, they'll go "huh, what's that" and cha-ching...
  • by davidwr (791652) on Tuesday October 03, 2006 @07:23PM (#16299797) Homepage Journal
    For those who didn't RTFA, here's another summary:

    You get an infected Yahoo IM. In addition to propogating, it turns your IE home page into an ad-filled page. The ad page works like Google's adsense, only in this case instead of Google paying a legitimate web site when people click-through the ad, Google or some other company winds up paying the scammer or his cronies.

    Because of the way it works it's a lot harder to detect than automated fraud or paid-human click fraud. Because the end user will likely click on the ad only if he's actually interested in it, the company that originated the ad might not even consider it fraud - he's just found a live potential client.

    What makes it fraud is that the end user's web page has been hijacked. In other words - it's spyware/adware.

    Workaround: Don't use IE, and use a malware-detector that detects and blocks Yahoo IM Malware.
    • I've never really understood the psychology of this, since if I saw a page like the one linked in the article, I would just close it without clicking on anything, since none of it was of interest to me.

      But I understand some people will just click out of curiosity and then - BANG! - the virus writer's got real money in his pocket.

      D
      • I've never really understood the psychology of this [...] But I understand some people will just click out of curiosity [...]
        So you have understood it.
    • by fotbr (855184)
      Simpler solution:

      Don't click random links or run random crap you get via IM.

      Still dump IE though.
      • by Firehed (942385)
        If only you weren't preaching to the choir here, the internet would be a much better place. Telling a Slashdotter to dump IE is about as useful as telling a store owner to open his store - it's just a given. If only the people dumb enough to do those things in the first place listened to (err... read) the thousands upon thousands of sites doing the same thing, the problem wouldn't exist. Can't teach a dumb dog obvious tricks, I guess.
        • by fotbr (855184)
          Oh I know.....I know....

          I was just making sure I wasn't going to get flamed for NOT taking the opportunity to bash IE. :)
  • by User 956 (568564) on Tuesday October 03, 2006 @07:28PM (#16299831) Homepage
    At this point, their homepage is changed to a site using Mesothelioma (a rare form of cancer) to ring up high-paying results on the perpetrators' Google ads.

    WTF? This worm gives your computer cancer?
    • no no no.. you got it all wrong. your computer gives YOU cancer
    • Re: (Score:2, Funny)

      by Anonymous Coward
      WTF? This worm gives your computer cancer?

      It can remotely install Windows on it without asking???
  • by zappepcs (820751) on Tuesday October 03, 2006 @07:35PM (#16299881) Journal
    Just another example of clever people taking advantage of anyone that is unfortunate enough to not know to click on unwanted popup things that ask them to click here, or enter your financial information etc.

    The internet will not be safe, ever, because of those people. Yes, "click here to win a date with name-a-rising-star" will always find its way to someone that thinks there is some remote possibility that Bill Gates will pay you to forward emails, or that a music hall-of-famer needs a date from someone just like them. The human factor in security will always be the weakest link. ALWAYS.

    • Re: (Score:3, Insightful)

      by Otter (3800)
      ...and clickfraud at the expense of class-action lawyers trying to sue whatever is left on the skeletons of asbestos companies (who did you think had such an expensive interest in mesothelioma?), while undoubtedly Wrong, isn't high on my list of the world's problems.
    • by suv4x4 (956391)
      The internet will not be safe, ever, because of those people. Yes, "click here to win a date with name-a-rising-star" will always find its way to someone that thinks there is some remote possibility that Bill Gates will pay you to forward emails, or that a music hall-of-famer needs a date from someone just like them. The human factor in security will always be the weakest link. ALWAYS.

      You can reduce 99% of this with proper education, but why teach THIS to your kids, when you can flood them with useless /to
  • Whew! (Score:2, Funny)

    by cciRRus (889392)
    Good thing I'm using ICQ.
  • by Anonymous Coward
    ...but surely google would quickly become aware of the website and cancel the google ad accounts of the sites linked from the page? Thus the scammers would get no "Step 3.... profit!!!"?
  • Easy to stop... (Score:1, Insightful)

    by Anonymous Coward
    I didn't RTFA, but presumably the ads being displayed are associated with a certain Google publisher account (or a handful of them). It should be pretty easy for Google to mark all clicks from those accounts as fraud, not charge the advertisers, and not pay the publishers.
  • Doesn't sound right (Score:3, Informative)

    by CaseyB (1105) on Tuesday October 03, 2006 @11:22PM (#16301199)
    The article is written so badly that's it's very hard to figure out the meaning. But this bit seems to describe the "entry point" to the infection:

    Here, we have something different - an Instant Messaging attack launched by a webpage forcibly dumping executable files into a PCs temporary files directory, via some nifty VisualBasic scripting.

    and further on:

    So, how does this happen?
    First of all, you need to hit an infection site using Internet Explorer - this exploit doesn't work in Firefox, for example. Due to the way these files are downloaded onto the PC, you can effectively make any site a potential threat and can scatter these files around wherever you like.


    This sounds like a straight up "go to a web page and an arbitrary executable runs" attack. That would be a HUGE security hole in IE that has nothing to do with the rest of this issue. Not that it's never happened before, but I somehow doubt that this would be the first place we'd hear about it.
  • Those click-frauders can be traced back and personally identified because they have to run "websites" to generate revenue from those clicks. So their personal "income" address (to send paychecks) is in the Google Adsense (available), once identified they can be brought to justice by Google (if only Google ever really wanted to combat them). More scary scenario is that they can virtually destroy any small-midsized website business if they target it with these botnets. Google may cut them from Adsense and red
    • I think we (slashdot readers) have just 'found out' who the (anonymous) submitter (of TFA) 'really' is (or at least their 'slashdot userid') based on the (unique) writing 'style'.
  • I refer the honourable gentlemen to the satement i made some moments ago:

    If the US Government can prevent banks (credit cards) from handling the proceeds of internet gambing, how comes they can't do the same for handling the proceeds of goods advertised by Spam (etc)?

    Is there a US Government at all? Is the US Government controlled by a moral cesspit like Al Quaida say it is? Has Gw Bush sold his soul to the devil? Is the internet controlled by Aliens from the planet Zog? Stay tuned for more news - same chan

  • Mesothelioma is a rare form of cancer commonly caused by prolonged exposure to asbestos and litigation



    Exposure to litigation - it can get you more than loads of cash. It can kill.

  • I have to type this message from my laptop, because my hard disk needs chemo...
  • by Silik (30759)
    So Microsoft is being used to make use of Yahoo! in trying to throw click fraud at Google.

    Are we missing anyone?
  • Several years ago I disabled cookies in IE and found it broke YIM. I decided this made YIM a security risk and quickly switched to Trillian for all my IM need. I have NEVER regretted making this change.

The idle man does not know what it is to enjoy rest.

Working...