Flashback botnet is a cash cow
Posted on 01.05.2012
We have all heard about the Flashback malware targeting machines running OS X and enslaving them into a botnet, but not a lot of attention has been given to the ultimate goal of the criminals behind it.

As expected, it is money.

According to Symantec researchers, the malware's ad-clicking component is loaded into Chrome, Firefox, and Safari where it can intercept all GET and POST requests from the browser.

It then targets search queries made on Google and may redirect users to another page of the attacker's choosing. Consequently, the attackers receive payment for the ad click instead of Google.

"The ad click component parses out requests resulting from an ad click on Google Search and determines if it is on a whitelist. If not, it forwards the request to the malicious server," they explain.

This request is specially crafted in order to thwart researchers' attempts to investigate the URL.

"Ad-clicking Trojans are nothing new and in an analysis of W32.Xpaj.B last August a botnet measuring in the region of 25,000 infections could generate the author up to $450 per day," point out the researchers.

"Considering the Flashback Trojan measures in the hundreds of thousands, this figure could sharply rise to the order of $10000 per day," they concluded.






Spotlight

USBdriveby: Compromising computers with a $20 microcontroller

Posted on 19 December 2014.  |  Security researcher Samy Kamkar has devised a fast and easy way to compromise an unlocked computer and open a backdoor on it: a simple and cheap ($20) pre-programmed Teensy microcontroller.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  
DON'T
MISS

Fri, Dec 19th
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //