Major Rogue Anti-Virus Program Shut Down 59
krebsatwpost writes "TrafficConverter.biz, one of the more notorious pay-per-install affiliate programs, was dismantled this week after media attention caused Visa and Mastercard to shut down the group's payment operations. The action comes just a few days after a report by The Washington Post that showed some affiliates were making more than $100,000 USD a week installing rogue anti-virus software. The credit card industry may have been spurred by the fact that the first version of the Conficker worm told infected systems to download a file from TrafficConverter, although the story posits that this could have been an attempted Joe Job rather than a blatant attempt to drum up more installs."
Amazing, credit card companies being useful! (Score:1)
Re:Amazing, credit card companies being useful! (Score:4, Insightful)
$3,000/week isn't a big enough chunk of change to compensate for the damage to their corporate image that would result if it became widely known they were knowingly doing business with such an outfit.
Re:Amazing, credit card companies being useful! (Score:5, Insightful)
I wonder why this doesn't happen more often. The vast majority of online scams (fake drugs, etc.) and spammers get their money through credit cards. Why not more effort to cut off their source of funds? It seems like a weak point in the operations.
Re: (Score:3, Interesting)
The problem is that the laws and the penalties are too relaxed for crimes like these.
A more severe penalty for involvement in fraud crimes would make many more a lot more vigilant when it comes to strangling that kind of behavior.
Re: (Score:2)
When fraud happens, the credit card company often doesn't pay for it, the merchant does.
For instance, if someone steals your card and a goes out to eat, you don't pay for that meal and Visa doesn't pay for that meal. Guess who does?
Now if there were a law that Visa et. al. had to pay, in full, any fraudulent charges (i.e. absorb the damage), I bet this would change reaaal quick.
Re: (Score:1)
Nah, you'd still pay... Visa would just find another way to increase your "gotcha" fees.
Re: (Score:3, Interesting)
Re: (Score:2)
It's Visa and Master Card, who else are you going to use?
Re: (Score:2, Insightful)
That's nothing.
First that figure is from just ONE affiliate.
Then add in all the money they were making from chargebacks too.
Re: (Score:1)
Re: (Score:1, Interesting)
I think that's the issue. You can't accept dirty money... running it through your transaction gateway has no down side for the credit card companies. Now if they were responsible for a percentage of the damages...
Re: (Score:2)
I guess we'll hear right-wing radio decrying this as yet one more example of government interference stifling innovation in the marketplace.
Apologies, but I couldn't resist.
Re: (Score:2, Insightful)
I guess we'll hear right-wing radio decrying this as yet one more example of government interference stifling innovation in the marketplace.
Apologies, but I couldn't resist.
I guess I'll hear Leftist radio .... nevermind.
No one that can drive listens to left wing radicals.
Re: (Score:1, Insightful)
I'm surprised visa/MC actually shut them down.
3% of 100k/week is a decent chunk of change.
But not much in their overall operations, if you look at VISA and MC themselves.
The biggest hurdle is finding out exactly who the VISA/MC service provider really is, since most people scammed don't want the embarrassment of reporting it.
I doubt the service provider is a "real" bank, most likely it's one of the many non-bank providers who do it for the money, since that would be big money to them.
VISA and M/C should do more to police their service providers and enforce the contracts already in place.
Re: (Score:2, Informative)
I'm surprised visa/MC actually shut them down. 3% of 100k/week is a decent chunk of change.
Most of that 3% goes to the acquiring bank, rather than the payment system (Visa/MC).
About farking time... (Score:2)
After all that, one article in the WaPo gets it shut down?
Welcome to Public Relations 101. (Score:5, Insightful)
Yes. Because those thousands of people every year don't have the public impact that a news story does.
This has been going on for YEARS and the credit card companies NEVER took any action before now. Because the credit card companies were getting their share of the loot.
Now that the PR problem might be more costly than their share of the fraud, they take action.
Re: (Score:2)
That would be the Washington Post Exclusion Law that only allows you to be ethical if a story in the newspaper says you should be? I'm surprised Bernie M hasn't taken advantage of that law.
"But Your Honor, the Washington Post never told me I shouldn't be engaged in a Ponzi scheme!"
Re: (Score:2)
Now that the PR problem might be more costly than their share of the fraud, they take action.
Again, all I can say is: ban Windows. Then let's see how well they do.
Yes, really. I'm getting sick of the worm-of-the-week crap.
Re: (Score:1)
I'm quite happy with Windoze. The "worm-of-the-week' is like the Christmas gift that keeps on giving.
Re: (Score:1, Insightful)
You obviously don't understand that the only reason there aren't many viruses for Linux is because virus writers don't give a shit about Linux. They only put their time and effort into something that will achieve their goal with most ease, and since Windows has % of the market share.... that's the one they write viruses for.
I know you were being facetious, but that doesn't negate the fact that your statement is retarded. The moment everybody starts using Linux is the moment that people start putting Linux_V
Re: (Score:1)
Re: (Score:1)
Re: (Score:1)
Re: (Score:3, Funny)
Flying under the radar while you collect tons of cash: Free.
Realizing that all that money isn't going to keep your posterior from being repeatedly violated in prison: Priceless.
Re:About farking time... (Score:5, Insightful)
Re: (Score:2)
discover what needing real virus protection is like
I just spit out my coffee. Thanks, bud.
Re: (Score:2)
You mean DirectI the large perfectly legitimate domain name registrar? I think you'll find they're as much a scam as Enom or Godaddy.
Actually, make that less. Enom and Godaddy don't exactly have pristine reputations.
These people should be in prison (Score:3, Insightful)
While I'm glad these guys were shut down, Mastercard and Visa shouldn't have had to do it. This case constitutes outright fraud, and the perpetrators should be punished like other criminals: with handcuffs, a jury, and iron bars.
We used to have strong consumer protection agencies. Then something happened. How many more electronic Elixir Sulfanilamide incidents [fda.gov] (or real ones for that matter [webmd.com]) do we need before we re-create the strong and sensible regulatory bodies that used to protect us?
Re: (Score:2)
Those people are all too busy protecting IP and going after nasty pirates now.
Re: (Score:2)
Don't forget that they are also too busy chasing unlikely conspiracy theories about Islamic Terrorists. In spite of the fact that complex conspiracies (especially those operating internationally) appear to be far more likely to involve fraud than anything else...
Re: (Score:1)
Sometimes the best way to deal with stuff like this is to stop the money. How do we know what country they're in anyway?
Re: (Score:2, Interesting)
Re: (Score:2)
However, I think a part of the problem is that people doesn't know they've been subject to fraud. As I assume they do get a pretty look antivirus app, that doesn't do much but look pretty...
Re: (Score:2)
Re: (Score:2)
I just hope they also go after the affliates, and make them pay. These are the guys creating the trojans and viruses infecting millions of people. Even if Traffic Converter goes down, they are still sitting on many millions of ill gotten gains and shouldn't be allowed to get away with that. They will just move on to TrafficConverter3.biz and do it again.
credit card processing is the chokepoint (Score:2)
What about Antivirus 2009? (Score:1)
Re: (Score:2)
AV2009 and AV360 are the same thing. In fact, you could make a strong statement that AV360 is the upgrade to AV2009. Most of the sites that have AV360 have underlying AV2009 code. I've even seen AV2009 sites give me AV360 as the payload dropper and vice versa.
Supposedly, these guys are the guys pushing AV360, hopefully infectious fall for awile, but these guys are just like spammers. I've sure next month they'll be back with Antivirus 720 or something. (There's already an Antivirus 2010 out there) That and
I'm still trying to understand... (Score:2)
...How F-secure can track down AV360's Virus Inc. but still can't figure out a way from stopping the rogue installers from running on a fully patched F-secure protected PC.
I know it's more technical than this and easy for Virus writers to workaround, but I would think that their DeepGuard system could at least block/warn anything with the name "InstallAVG_(Random 6 digit number).exe from running. That would at least keep 99% of the current AV360/AV2009 infections down for awile until they change their namin
Re: (Score:1)
Traffic Converter (Score:3, Informative)
Traffic Converter have a note on their site www.trafficconverter2.biz:
On March 18th, in the evening, with no warnings, the German Merchant Processing was cut off. Merchant was at the bank personally (without intermediaries), proved and with the arrangements on the highest level. Up until now the bank was not replying to our inquiries, but finally we received answers from them your Merchant was blocked and the account frozen until the determination of the facts. According to unofficial channels, we have been able to ascertain the following:
"I am sorry to inform you that both VISA and MC have done a surprise on site visit at the offices in Frankfurt. They are actually there as we speak.
They have instructed WC to freeze your account until further notice and both of these companies have different reasons for doing so:
VISA; they want to investigate where all the volume comes from.
MC; High CB`s the past few days."
This is absolutely unprecedented case when two of the largest payment system called the requirement to block the Merchant. We also have a reason to believe that the situation was caused by the recent publication about us and our products in Washington Post:
http://voices.washingtonpost.com/securityfix/ [washingtonpost.com]
There are, as you can see, some very serious accusations. Including the relation to Conficker, which we actually are not implicated with (and can prove it if necessary).
As a result of this situation:
- No money to pay;
- No capacity to process products (not because we're not working, but because this volume is not endure any processor)
- There is a chance to get ourselves under prosecution and let down Webmasters.
So, the decision was made to âefault and shut down the Traffic Converter. In case we resolve this issue and manage to refund the money from the bank, we will pay you off all debts as quickly as possible.
If we manage to get the stable traffic conversions we have demonstrated during the year and a half, we will contact you on individual basis.
Thanks to everyone for succesful business cooperation.
Re: (Score:2)
What about following proper judicial procedure ? (Score:1)
Am I the only one to be shocked that a private company (Visa and MC) can shut down another one simply on the basis of denunciations in the press, and be congratulated about it ?
Traffic Converter should be tried before the judicial system. They probably aren't saints, but justice works only if it is applied the same way to everybody. Otherwise it's called arbitrary. This should be obvious but apparently it seems necessary to repeat it often.