Botnet Flavor, Click Fraud Taste

By Jimmy Daniels
Contributing Writer, RealTechNews

Another Instant Messaging attack is making the rounds, this time the worm has been dubbed w32.Kmeth Worm and this time it’s not really a botnet, it’s good old fashioned click fraud, hey, maybe they should call it a clicknet? It starts with a malicious website being spammed through instant messages, user visits site, gets free malware, starts spamming, lather, rinse, repeat. Change all their homepages to a page with high paying click ads, filter the traffic to help bypass fraud filters and you’ve got one happy scumbag, unless he gets caught.

Typically, financially-driven malware tactics use botnets to fraudulently increase traffic to specific online advertisements. In this case, the hackers have very cleverly borrowed tactics from botnet-creators to create a bot-less network of hijacked PC users to drive traffic to sites populated with these specific Google AdSense advertisements.

Introducing the human factor into the scenario makes these ‘bot-less nets’ much more difficult to detect - even sophisticated auto-clickers can usually be detected over time, but the creator(s) of this infection is banking on human unpredictability to see them through. After all, unlike the Botnet clicker drones, there is no guarantee a real-life human will actually click one of those adverts - it’s a risk taken on the part of the creator, but all things considered, a small one as they have stacked the deck in their favor. Source: Greynets Blog

We Say: Another day, another IM exploit, be careful what you click on. More coverage here and here.