ie8 fix

Between the Lines

Larry Dignan, Andrew Nusca and Rachel King

FBI shutters $14m major click-jacking fraud; 4 million computers affected

By | November 10, 2011, 2:47am PST

Summary: A massive click-jacking fraud led millions of users being served ads when seemingly accessing popular websites, which raked in over $14 million in online advertising revenue.

The FBI has been successful in closing a botnet of four million infected computers that led to a DNS malware scam, raking in over $14 million from online advertising clicks along the way.

The two-year investigation — dubbed ‘Operation Ghost Click’ — found that hackers were paid for the number of times users clicked on links from adverts, or how often adverts were displayed on sites, officials said.

Using malware known as ‘DNSChanger’, forcing machines to rely on rogue DNS servers, hackers pointed web searches to fraudulent IP addresses for over 15,000 domains.

This resulted in many popular websites, from iTunes to Amazon, not displaying the content that was meant to, and instead large advertisements were displayed, or rerouted to money-generating sites. The malware also prevented access to anti-virus sites to prevent the removal of the malware.

Both PCs and Macs were infected, The Register said. The BBC meanwhile said that the case was thought to be the “first case of its kind” because the suspects had set up their own DNS servers, rather than relying on infected others.

According to Trend Micro, on 8th November, the botnet was taken down with industry partners, including the anti-malware company, and the FBI after datacenters in New York and Chicago were raided. Thought to be the biggest cyber-criminal takedown in history, the scheme was thought to have been discovered over five years ago,

Seven men, including six Estonians and one Russian, who remains at large, were charged for the fraud which spread to more than 100 countries, and infected even high level government networks like NASA. Reports show that NASA was the first to discover the malicious software.

Estonia’s embassy in the U.S. worked closely with the FBI on the investigation that led to the arrest.

In April 2007, a cyberattack on Estonia’s critical national infrastructure shut the country down for days; an attack that was blamed on Russia. Russia denied any involvement.

Related:

Kick off your day with ZDNet's daily e-mail newsletter. It's the freshest tech news and opinion, served hot. Get it.

Topics

Zack Whittaker, a criminologist who studied at the University of Kent, Canterbury, is a journalist, writer and broadcaster.

Disclosure

Zack Whittaker

I worked briefly with Microsoft UK in 2006 but no longer have any connection with the company. Regardless, I remain impartial and unbiased in my views.

I don't hold any stock or shares, investments or industrial secrets in any company, but have signed confidentiality agreements with a number of UK and U.S. organisations, whose names I am not at liberty to disclose.

I was involved with Kent Union, the University of Kent's student union, undertaking voluntary, non-salaried, elected positions between early 2009 and mid-2010.

No other company, body, government department, non-governmental organisation or third sector organisation employs me or pays me a salary in any capacity whatsoever.

As a freelance journalist, whenever expenses are given and taken by a company that is not CBS Interactive, these will be disclosed in each relevant post to ensure transparency.

I currently work with a UK law enforcement unit, but this is an entirely separate position which bears no connection to other work.

(Updated: 23rd October 2011)

Biography

Zack Whittaker

Zack Whittaker, criminologist who studied at the University of Kent, UK, is a journalist, writer and broadcaster.

After studying criminology at university, though still in his early-20's, he has already had a series unconventional work and voluntary positions. He has worked with researchers studying neurological illnesses like Tourette's syndrome (which he suffers from), has given lectures on the nature of disabilities in the public community, and occasionally ends up speaking on television and radio discussing the events of the day.

He first had academic work published at the age of 22, then still an undergraduate, and has been cited by a wide range of publications: from CNN, the Huffington Post, AllThingsDigital, The Atlantic Wire and CBS News.

27
Comments

Join the conversation!

Just In

RE: FBI shutters $14m major click-jacking fraud; 4 million computers affected
Rick Sos 21st Nov
@rmhesche lol. If I cover my eyes you can't see me. They can and do get infected. Rarely but it happens.
0 Votes
+ -
If
guihombre 10th Nov
This is another reason I'm against the 'cyber war' propaganda nonsense. Suppose that this was promoted as a 'Russian' cyberwar attack, or an 'Estonian' cyber-war attack. It would then be taken out of the hands of law enforcement and thus, normal national co-operation between Russian and US police would not work.

So the most effectively way of dealing with this cyber hacking stuff: arresting the people involved, is ruled out as soon as the agenda gets hijacked by the cyber-war propaganda, and you're left with stupid 'war' tools that are the same tools the hackers use, i.e. DDNS, or hacking.

-------
USA: One man one vote.
GOP: One dollar one vote.
And, hey, the party that's being bought is is the democratic party, with Obama getting into the presidency as a result of the billion dollar campaign in 2008. Can't buy an office for less money when it comes to the democrats, and so, if they can't buy a vote, they'll get the votes they need through fraud. Fraud is a lot cheaper and an easier way for democrats to get elected. Besides, no money has to be paid to dead voters before they "cast their votes".

Meanwhile, wake up. You apparently are not smart enough yet to recognize when you are being duped.
@adornoe@... I agreed with you all the way up to "And,hey". his post made no sense at all, and now neither does yours. This is not a Political Site and therefore not the place to argue Politics.

Update...
@adornoe ...Thanks for the heads up on the political site, you are right, but I came here to read about the clickjacking and not the extra political points of view.
political comments at the end of his post. No political comments should ever go uncontested, especially when they're completely untrue.

BTW, ZDNet is a subdivision of CBS, a highly political news and information source, with a heavily liberal viewpoint.

I used to feel the same as you, a few years ago, but, ZDNet made it very clear that they're into politics and discussions of government issues.

So, don't make the mistake of assuming that this "tech site" is not for politics.
@ a1slipkid:
I agree completely. Some people would be better off hanging out on the Fox News website. I'm here to review information on click-jacking and instead I get political drivel.
@guihombre you should add to your tagline:
USA: One unemployed on welfare and Medicaid many votes
This is why I am so against online advertising, and have no quarrels barring ads via NoScript and AdBlock on Firefox, even on legit sites I frequent. I could guarantee that if running Firefox with those two addons enabled became mandatory, malware would drop off the face of the Earth. Eliminating ads all together eliminates quite a few attack vectors.
@Cylon Centurion The way advertising should be run on site is have the site post the ads and monitor them. But no they use third parties to sell and maintain ads and that is where the weakness is in my opinion. I'm sure ads are big business and I know Ads will never go away. But some of these ads are over controlling. I was on a popular business site and watching some news video. I wanted to go back to the home page but a ad had started to play and it would not let me navigate anywhere until the ad was finished. Now that is just wrong.
@jscott418

Yes, that is wrong, you should be able to navigate.

I spent many years developing software to deliver ads like that (not any more though) - and lack of navigation at least by the back button would have caused instant rejection of the ad.

Taking over the page is acceptable (to most of the ad-industry and publishers) but should have a close box.

Blocking links on the page except for short periods of time when the user is interacting with the ad is also a no-no, but some sites do allow it, they shouldn't.

I don't like most internet advertising either.

One of the reasons I got into it was because what was around was bad, so for a while I was improving it, one of the things I introduced was ads with close boxes. The ability to close the ad turned out to be useful to the advertisers, as I invented statistics on the closing.

There is a form of ads before/after video streams, or sometimes in the middle, that do not allow you to play the content until the ad has played. These seem to be a necessary evil for now. These at least are in the player on the page, and not stopping any navigation.
@Cylon Centurion
One of the privacy tracking lists available to use with IE 9 includes most of the analytics sites. Not sending those sites any information is the first step in getting back to worthwhile organic search.
@mswift@...

Analytics if used would have picked up the fraud and told the advertiser that the clicks were garbage.

So many people have conspiracy theories about how the whole ad industry does things, and block the solutions and not the problem.
@Cylon Centurion

The ads were not the attack vector quoted, the ads were the revenue stream.

The problem is with your blocking ads that you are just asking Journalists to work for news organisations with no revenue stream. how do expect that to be sustainable?

For now it is not such an issue as older publications have print revenue. As the readership stops reading print their revenue is rapidly dissapearing.

Right now the revenue from online is low, as the cost per impresssion is way too low.

Sites such as this have blogs because a blog results in multiple page impressions per viewer per page. Controversial articles create extra blog viewings and that is why there are articles on websites designed to bring out the crazies in frenzies of hate postings.

Journalism is being replaced in many cases by intentionally incorrect opinion pieces, because that pays better, and because the work is done by the audience.

Eliminating ads altogether will not improve the world unless an alternative revenue stream is available. For now you are just helping to drive the death of quality journalism.

Hopefully subscription models will work and quality will return, a freebie mentality doesn't help as it takes work to create good content, and costs money to get it to the reader.

The large ad serving networks have systems in place to try to stop malware in ads, and require the same from those they work with. The smaller networks may not have the resources.

What is an issue is pay-per-click ad revenue models, which is part of the problem here. The pay-per-click model is easy to manipulate, and click-fraud is something that Google puts effort into stopping.

A bot that calls a page on your website and clicks on the ad - or at least simulates that to the ad-server is relatively easy to create. The user does not need to see the page or the site even. The reason for the botnet is to get a variety of IP addresses so the ad-server does not reject them as repeats from the same user.

The site that was never actually visited then gets credited for the unique impression and even more for the unique click. (Unique being a unique supposed viewer seeing/clicking)
becoming opinion pieces themselves, and the subscribers saw through that.

When I read the NY Times or the St Pete Times, the "news" was tainted with the reporter's opinions or his/her biases. If the column had been categorized as opinion or commentary, then I could accept that, but, NO!, the opinions weren't found just in the commentary sections, and thus, myself and many millions of people, opted to go elsewhere to get the "news" and left the opinionated press behind.

The one good thing about the "news" sources on the internet is that, it's coming from a huge variety of sites, including the sites from the original subscription models. So, people will test them out, and if they like the content, then, whatever the site, the reader/viewer, will return for more. Returning for more from the biased media is not an option, and they've killed themselves by becoming proponents and supporters of one side or the other. The people have spoken, and the old form of subscription news/information sources is disappearing. The NY Times and the St Pete Times, for examples, have alienated at least half of their potential audience by becoming advocates of left-wing causes. They chose that path, willingly, and thought that people wouldn't notice, or didn't care if people did notice. So, I say, "good riddance" to them.
@ adornoe - below

I am not saying that subscription models will work or will necessarily give the right quality.

What I am saying is that cutting the revenue stream and viewing content is not in anyone's best interests ultimately.

I would rather not have subscription models either.

I also am aware that Rupert Murdoch has jumped onto the subscription bandwagon, and his right wing press has severely messed up democracy in at least 3 countries including the US.

Cable (subscription model) has allowed Murdoch to dominate news and mostly spread false information, and alienate the thinking members of the community.

I see you are anti left-wing, so you fail to mention Fox and the majority of the media being dominated by right-wing propaganda.

Newspapers shouldn't be left wing or right wing, they should be newspapers. And they shouldn't try to be populist either.

If a story is true and should be told int he interests of the people, yet it alienates half the readers then those readers are somewhat childish and need to be able to tolerate fact that contradicts their prejudices. So your statement about alienation says more to me about you and the readers than about the paper.

Why do you say 'chose the path willingly' as if they have comitted a sin, rather than relevant fact which is that all papers no matter if they are right wing or accurate ( joke) are suffering from loss of revenue from the move away from print to online.

(You spun this into an attack on left-wing papers, so I spun back a bit)
0 Votes
+ -
@richardw66
The internet has been a very disruptive technology. The problem seems to be that the information people want appears to be free but behind the scenes there are expenses that new sources are paying for as well as the cost of equipment. I dislike ads but am willing to ignore them when I can. I used to have a subscription to a newspaper as well as magazines and did not mind the cost of subscription; if the online news agencies went to a subscription model then I would be willing to pay for one or two and get my news and iformation from those sources.

Thanks for the info
understand what I did say.

I am not saying that subscription models will work or will necessarily give the right quality.

I'm not arguing against subscription models. What I'm saying is that, they're killing themselves, and rightly so, because of their very partisan political reporting. A balanced and fair subscription model could work, but that's not the choice the mainstream media chose.

What I am saying is that cutting the revenue stream and viewing content is not in anyone's best interests ultimately.

The revenue stream could easily grow if the media sources would revert back to what they were supposed to be, and that is responsible journalism, where reporting the facts was their prime mission, and writing opinion and commentaries were secondary. What you find in reporting, in the last 60 years or so, is slanted and partisan and biased reporting, mixed in with what's supposed to be opinions. But, it's hard to distinguish between reporting and opinion writing lately.

I would rather not have subscription models either.

I wouldn't mind having them, but, they've killed themselves with their advocacy and partisan reporting, which has alienated the majority of their audience.

I also am aware that Rupert Murdoch has jumped onto the subscription bandwagon, and his right wing press has severely messed up democracy in at least 3 countries including the US.

And that's where you and I will ardently disagree. I see Rupert as a hero, and he created a source to balance the left-wing media that took partisanship to high-levels, to the point that, they might as well have been subsidiaries of the democratic party.

FOX has taken a huge lead in cable news viewers, and that's not by accident nor because of Rupert's "right-wing" media aspirations. Rupert provided a product which at least half of the population were in need of, and it was an attempt to balance the reporting that was heavily liberal leaning. In fact, FOX is what the other media organizations weren't providing to the people, and thus, they took a heavy lead in cable news reporting. You are, apparently, not used to seeing the other side of the issues, and anything that even remotely veers from your expected news presentation, will seem to be radically right-wing. You are used to the left-wing partisanship, and you can't even recognize how radical your views are to the other side of the political spectrum.
Cable (subscription model) has allowed Murdoch to dominate news and mostly spread false information, and alienate the thinking members of the community.

That's complete nonsense!

The cable news viewers migrated to FOX because they liked the product, and it has nothing to do with "subscriptions". What FOX and other Rupert properties are doing, is finally, presenting the other side of the news, and to a lot of people, the real truth about what's happening. But, like I said before, you can't recognize the difference because you've been stuck in that liberal bubble, where anything slightly different is going to be completely foreign and diabolical to you. "False" is in the eye of the beholder, especially when there are so many who won't know fact from fiction, because, they've been fed lies all their lives.

I see you are anti left-wing, so you fail to mention Fox and the majority of the media being dominated by right-wing propaganda.

I'm for the truth, and the truth can be presented by either left-wing or right-wing or down-the-middle news sources. But, my experience, even from the time that I was a liberal, tells me that, most of the media is highly partisan and favorable to the democrats and left-wingers. I would prefer a "fair and balanced" news source, and that's what the democrats never wanted, and that's what the majority of the mainstream avoided. Being partisan is not a way to present the news or the truth. What FOX did, was to present the other side, a side that was obviously not being represented by the majority of the media, whether subscriber based or not. FOX was a blessing that most news consumers welcomed, and people like you can't even begin to comprehend why it was needed and welcomed.

Newspapers shouldn't be left wing or right wing, they should be newspapers. And they shouldn't try to be populist either.

You know nothing of what you speak.

The majority of reporters and opinion and commentary columnists, are liberal, to the tune of around 90%, and there have been polls that show that, at election time, most journalists vote for democrats. That's not balance and nobody can expect non-partisan reporting from that type of journalist. The "populist" term has no bearing on the truth, and what is popular should be what people want, and they've demonstrated that their preference for "fair and balanced", even if you believe that FOX is evil and right wing. In actuality, a huge number of reporters and hosts on FOX are democrats, but, you and others want to keep that perception about FOX being "right wing". The facts aren't what you've been fed.

If a story is true and should be told int he interests of the people, yet it alienates half the readers then those readers are somewhat childish and need to be able to tolerate fact that contradicts their prejudices. So your statement about alienation says more to me about you and the readers than about the paper.

My statements about alienation of the readers/viewers are completely factual. No reader or viewer is going to leave a news source if they believed it to be providing the unbiased whole truth. The major news sources, like ABC/CBS/NBC/MSNBC/NYTimes/CNN and most others, have lost their readers/viewers, because people are able to determine that they're being lied to or not being represented. You are, obviously, very uninformed about the real facts on the ground about the media. Try to get educated about how things really are out there.
Why do you say 'chose the path willingly' as if they have comitted a sin,

Choosing the path of partisanship and advocacy is a big journalistic sin. Any media organization that does that, should be allowed to die. That kind of journalism is the same as could be found in the old USSR and in China and in Cuba, where the media was the mouthpiece of the government. That's what most of the media had become, and they needed to be destroyed, but, they destroyed themselves.

rather than relevant fact

You can't really be that naive.

Facts is not what the media has been reporting in the last 60 years or so, since they became mouthpieces for the liberal ideology.

which is that all papers no matter if they are right wing or accurate ( joke) are suffering from loss of revenue from the move away from print to online.

I'll take factual and accurate any time, but, that's not what we have right now with the majority of the media. Thus, subscriber-based or free on-line, I'll take the truth and real reporting before the garbage we've been getting for so many years from the main media sources.

(You spun this into an attack on left-wing papers, so I spun back a bit)

Hell, yeah! That's exactly what I meant to do.

The majority of the media is left-wing, and they've alienated the majority of their audiences, and, they've been killing themselves because of it, and if they do die because of their own doing, then "good riddance".

Now, there are things that can be done to bring back real journalism to the media sources. I think I have a means towards that, and it wouldn't be partisan, nor politically motivated, nor controlled by any organization or any one person. It would, however, finish off the left-wing and right-wing media sources as the main presenters of news/information/opinion/commentaries. Reporting would be balanced, fair, and the truth would be allowed to get out. It would be up to the people to decide what they want to read, and they could easily find any source and any ideology and they'd be able to find the balancing sources in order so they could see all sides of the arguments and issues.
@Cylon Centurion Wow, you are really clueless about what this is about? This has nothing to do with how ads are being displayed. Even if you somehow manage to block all advertisements, if your DNS somehow get hijacked (either locally by a malware or on a DNS server that your computer is pointing to), you will get redirect when you visit legitimate websites.
0 Votes
+ -
RE: Nook Tablet (photos)
tyuthfd 10th Nov
For some reason this article fails to mention that there is still no way to eliminate the malware that enabled this DNS poisoning to occur. Instead of fixing the problem, they have taken over the rogue DNS server IP addresses and replaced them with legitimate DNS servers.
@DAvenger

I was wondering about that.

I would hope that the information on the botnet is provided to the OS companies and the Anti-Virus companies so there is a fix provided.

The DNS changers I have seen are usually defeated quite simply, as long as the user knows to do it. Mostly it's just reset the DNS settings.

I suspect there is an even more sophisticated attack out there - I saw something I think was browser hijacking recently where the DNS settings were not obviously changed. I don't have enough info to be sure and resetting the browser returned things to normal, semed to be somehow cookie related which didn't make any sense to me.

All I know is the browser was going to the wrong sites, and I think it was after a certain site was visited, but clearing cookies seemed to correct the behaviour. It may have been a bug of some sort.
"Seven men, including six Estonians and one Russian, who remains at large..."

With a cool 2 mil each. Not a bad years wages.
and always wondering if that helicopter overhead is coming to get them, or if that black van down the street is not full of government agents waiting to arrest them, or always fearing that, their names and mug shots might be appearing on the news networks and in the newspapers.

Sometimes, it's best to be honest and not to have all those fears following you for life.
The network was discovered 5 years ago, but the investigation started only 2 years ago. ow
0 Votes
+ -
What?

Macs can't get infected!

.
@rmhesche lol. If I cover my eyes you can't see me. They can and do get infected. Rarely but it happens.

Join the conversation!

Formatting +
BB Codes - Note: HTML is not supported in forums
  • [b] Bold [/b]
  • [i] Italic [/i]
  • [u] Underline [/u]
  • [s] Strikethrough [/s]
  • [q] "Quote" [/q]
  • [ol][*] 1. Ordered List [/ol]
  • [ul][*] · Unordered List [/ul]
  • [pre] Preformat [/pre]
  • [quote] "Blockquote" [/quote]
ie8 fix

The best of ZDNet, delivered

ZDNet Newsletters

Get the best of ZDNet delivered straight to your inbox

Facebook Activity

White Papers, Webcasts, & Resources
ie8 fix