Obviously, cyber crooks wouldn’t do what they do if there wasn’t any money in it. Thanks to some black-hat search engine optimization and a little rogueware (a.k.a. scareware), some are making almost $11,000 a day, according to FinJan’s first Cybercrime Intelligence Report for 2009.
Rogueware/scareware describe the technique of scaring web surfers into downloading a fake anti-virus program by telling them their machine is infected with a virus. When users pay to download the program all they really get is taken and phished.
How effective is this malware technique? FinJan’s Malicious Code Research Center, which tracked on rogueware affiliate network, says the installation rate was between 7 and 12 percent, though just shy of two percent actually paid $50 for it. Most of what is collected gets fed back to affiliates, earning on average 9.6 cents per referral.
While that seems like low rent, FinJan counted the number of referrals over a 16 day period at 1.8 million unique users, all of them duped by affliates’ SEO savvy.
Yuval Ben-Itzhak
“Cybercriminals keep on looking for improved methods to distribute their malware and rogueware. Since they make money by trading stolen data or selling rogue software, they are looking for new and innovative techniques all time. To increase the distribution reach of their rogueware, they successfully turned to SEO,” said FinJan CTO Yuval Ben-Itzhak.
This crew targets especially typos and misspelled popular or trendy keywords (obbama, liscense, Gogle, mobile fone) and compromise well known, search engine trusted sites by injecting those keywords on them and adding links. The search engines ranks sites from that site highly, and users don’t hesitate to click through to them.
But along with the keywords is often a script that redirects unsuspecting users to a different doorway page, where they are told their machine is infected and prompted to scan and download. These PHP scripts also dynamically generate keywords and the doorway pages for them.
FinJan said this technique has driven as much as half a million Google searches to a compromised site.