used by permission from flattop341 Flickr photostream

Trend Micro and the FBI are very pleased to announce today the dismantling of a criminal botnet, in what is the biggest cybercriminal takedown in history.
 
This concerted action against an entrenched criminal gang is highly significant and represents the biggest cybercriminal takedown in history. Six people have been arrested through multinational law enforcement cooperation based on solid intelligence supplied by Trend Micro and other industry partners. more than 4 million victims in over 100 countries have been rescued from the malign influence of this botnet and an infrastructure of over 100 criminal servers has been dismantled with minimal disruption to the innocent victims.
 
If you are worried that you might have been a victim of this criminal activity, the FBI have made an online tool available which will allow you to check if your DNS server settings have been tampered with.
 
First you will need to discover what your current DNS server settings are:
 
On a PC, open the Start menu by clicking the Start button or the Windows icon in the lower left of your screen, in the  Search box type “cmd” and hit return (for Windows 95 users, select “Start“, then “Run“).This should open a black window with white text. In this window type “ipconfig /all” and hit return. Look for the entry that reads “DNS Servers” and note down the numeric addresses that are listed there.
 
On a Mac (yes they can be victims too), click on the Apple icon in the top left of your screen and select “System Preferences“, from the Preferences panel select the “Network” icon. Once this window opens, select the currently active network connection on the left column and over on the right select the DNS tab. note down the addresses of the DNS servers that your computer is configured to use.
 
You can check to see if these addresses correspond to servers used by the criminals behind Operation Ghost Click by using this online tool provided by the FBI, simply enter the IP addreses, one by one and click the “check ip” button.
 
If you feel that you computer may have been infected, you can visit Trend Micro’s HouseCall for a free scan and clean-up and notify the FBI by submitting this form. You should also contact your Internet Service Provider for advice on restoring your legitimate DNS settings.
 
Ongoing updates on this threat can be found on our Operation Ghost Click landing page.
 

Tweet from the New York Times after they fell victim to criminal ads

  
Web site owners use trusted content networks to provide advertisements for their websites, and criminals are actively targeting this trust relationship as it represents a weak link in the chain of content control. Criminals create shell companies to place advertisements that hide malicious content in ads that are subsequently placed with high profile advertising networks. These malvertisements are then syndicated across many hundreds of web sites silently infecting as many victims as possible, as these examples illustrate.
  
Malvertisments, as they are referred to, have become increasingly common over the past few years and continue to be a growing problem. The potential number of victims available to criminals through a syndicated ad will often far outstrips the potential return for compromising an individual website. Internet users are unknowingly putting themselves at risk when they visit legitimate websites, which happen to be carrying malvertisements, designed to invisibly and automatically infect them through drive-by downloads. A drive-by download usually involves a chain of events; the victim visits a website which in this case is carrying a malvertisement, the malvertisement will contain content (most often JavaScript or Adobe Flash) which will be automatically executed by the browser. The purpose of the JavaScript is to automatically and invisible redirect the browser to a server hosting exploits (commonly a criminal exploit kit such as Yes!, Eleonore or Phoenix for example) these exploits are then used to push out the final malicious payload of the criminal’s choosing. In some cases exploits for technologies such as Adobe Flash are embedded directly within the malvertisements and this has the same end result of delivering a malicious payload. Once infected, your PC is compromised or your virtual wallet lifted in a number of ways; from pushing fake security software which attempts to fool the you into believing that your PC is infected with any number of entirely bogus malware which only this (paid-for) application can remove, to criminals stealing your personal or financial details and/or obtaining remote access to your PC.
  
So where does the responsibility lie? Is it with the web site that is hosting the malicious adverts, the network distributing them, or the consumer who visits the website? Really the responsibility, as well as the potential for damage, is shared. Web site owners and ad-networks alike suffer embarrassing brand damage when their customers are infected and the victim of course suffers the pain of information or identity theft and financial loss.
  
It is certainly true to say that if the right checks and balances were in place the problem would largely cease to exist, at least on legitimate websites. Clients of ad-networks should be applying pressure to their provider of choice to ensure that the appropriate checks are made before the advert goes out. Ideally, automated systems need to be in place at the advertising content providers, to run the ads through a sandbox before they are released into the public domain, checking for any kind of active or malicious code. Third party providers should perform specific checks to verify URLs and detect any unexpected or unwanted behaviour such as automated redirections, even if not malicious no web user wants to be bounced off to a third party website simply as a result of rendering an ad in their browser and no website owner would want their visitors stolen in this way either!
  
In the meantime, Internauts should ensure that they have the appropriate anti-malware software installed on their PC to minimise the risk. Free options include tools such as Browser Guard, which blocks exploit attempts and detects malicious JavaScript, stopping it from executing. When choosing anti-malware software, it’s important not to focus purely on software that will scan for bad files, but also that will stop PCs (and not just browsers) from connecting to malicious destinations.
 

“Hello,

Thanks, it should be fixed.

Cheers “

 
Security vendors have often been the target of both malicious and mischievous hackers and without fail, honesty and transparency have always been the best policy in the aftermath of such an event.
 
Thanks to Donna for the heads-up.

 “Warning!!! Your computer contains various signs of viruses and malware programs. Your system requires immediate anti virus check. Click to perform a quick and free scan of your PC”

You have? Well you’re not alone.
 
I want to share with you some research carried out by one of my colleagues in TrendLabs, Bob McArdle. I can’t mention any names for fear of prejudicing ongoing investigations, but to be honest the names are irrelevant as they change so often anyway. Over the course of a year one criminal gang, let’s just call them Company X, made over $180 million US dollars by selling malware to their victims in at least 30 different countries around the globe.
 
You would be forgiven for asking why people would pay for malicious software and the answer is of course, they had no idea it was malicious in the first place.
 
The gang creates very convincing looking fake security programs designed to fool the victim into believing that their computer is badly infected. These scareware programs are then distributed by creating web pages designed to rank very highly in search engine results for popular current search terms or newsworthy events. As soon as the malicious search result is clicked a pop-up message like the above appears and the infection chain begins.
 
Here is a video of one such scam in action related to this incident I blogged about a while ago.
 

 
So how did they make so much money? Well firstly while the scan on offer might be free, the bogus results always show the machine to be very badly infected when in fact no scan at all has taken place. The worried user is then prompted to pay for the full version of the “security” software so that the non-existent malware can be cleaned up. So now, you have given your credit card details to criminals, downloaded malware onto your PC and paid somewhere between $50 – $100 US dollars for the privilege. This game is a volume one – if the gang can redirect 100,000 searches and only 1% of them pay for the product – they net $50,000 US for a day’s work.
 
The second part of the business model involves these machines that the criminals have now infected. As the infected user surfs the web, the malicious software quietly replaces all of the ads the user sees with ads belonging to one of the gang’s affiliates, most often pushing fake pharmaceuticals and the like. The gang get a kickback of two or three cents every single time an advertisement is replaced. Logs from one of the gang’s servers showed about a million ads replaced per day, netting them another $25,000 US per day, and this was only one of the gang’s botnets. So that’s $25K per botnet, per day.
 
The third part of Company X’s business model revolved around customer support strangely enough. Company X’s biggest problem of course, was credit card refunds. Customers who realised that they had been scammed would contact their card provider demanding a refund. After a while the credit card provider would refuse to do business with Company X and Company X would need to create another fake subsidiary company, complete with Fake IDs for all of their directors. To combat this, these criminals decided to invest heavily in call centres – setting up call centres in the US, Asia and Eastern Europe.
 
You see the Rogue AV would regularly ask the users to update their version, paying a small fee to do so – and would annoy the user with pop-ups until they did so. A lot of customers complied, however others rang the support line demanding the product be fixed. Each Rogue AV had a couple of settings that could be altered so that the users would never be prompted for updates again – the staff at the call centres simply stepped the users through to this point, all for the modest fee of $20 for the phone call.
 
Think before you click, not all security software is created equal.

NYTimes Twitter posting

 

In the warning, the influential newspaper stated their belief that the pop-ups were the result of an “unauthorised advertisement”. From some online discussion it looks as though the problem may have been ongoing for upwards of 24 hours.

 

The pop-up window itself, (screen shot captured by quick-witted reader of All Things Digital) was the all-too-familiar sight of rogue antivirus software informing the NYTimes reader that their computer is infected with random, spurious, non-existent malware and promising “Full System Cleanup” for a fee of course.

Image courtesy of All Things Digital

 

The malicious software being punted in this case, is similar to what we were seeing in much of the black-hat SEO around the 9/11 attacks, as reported previously on the TrendLabs malware blog.

 

In this particular example, the malicious site and sofware is being hosted by a German provider, Hetzner AG, which has a colourful track record when it comes to spewing dodgy content, having hosted literally hundreds of malicious URLS.

 
Here’s a really simple tip to remember. If you *ever* see a browser pop-up window that arrives uninvited, telling you your PC is infected, ignore it, it is a scam. Close the window, empty your browser cache and to be on the safe side, run a real scanner like HouseCall. To be more fully protected in future, make sure you install an antimalware program that will also block malicious URLs, rather than simply looking for malicious files.

 

UPDATE: Troy Davis was fortunate enough to be able to examine the attack in real-time and provides an excellent code level analysis here.

 

UPDATE: The fake AV program being pushed in this attack was called Personal Antivirus and is very much a classic piece of scareware.

 

On install the application will start “scanning” your machine for problems. On a completely fresh installation of Windows Vista, it supposedly detected 38 threats.

 

Of course none of these imaginary threats can be removed until you pay to activate you copy of this useless software, not only giving away your cash but also of course all your credit card and personal details at the same time, double-whammy for the cybercrooks.

 

If you choose not to activate the software immediately you will then be served at random intervals with fake messages informing you of yet more detected problems, when you hit the “Block” button, you are again prompted to pay for the software, and so it continues…

 

For cleanup, use HouseCall or any other reputable security software, a helpful list of what is real (as opposed to FakeAV) can be found here.

 

If the software you are being punted isn’t on the list, then do not install it.