Google Click Fraud via Malware

A Google gadget assists

[tangor]

Moderators... if in wrong location, please move:

Miscreants have developed one of most sophisticated click fraud malware applications to date.

The Trojan code - dubbed FFsearcher by security firm SecureWorks - plugs into a Google API that allows webmasters to add a Google-powered search widget (called "Google Custom Search") to their website. In normal use, search results made via the widget are displayed alongside Google AdSense ads, with webmasters receiving a small fee every time a surfer follows an ad.

The malware hijacks this feature so that every search an infected user makes is performed through a search widget under their control, so that they get paid by Google every time a surfer clicks on a sponsored ad. Hackers have also worked out a means to pull off this sleight of hand without giving any indication to surfers that anything might be amiss. Google might find it hard to unravel instances of fraud.

Reported at The Register

[theregister.co.uk...]

Article contains links to screen shots of the exploit...

[tim222]

I know there have been similar malware applications in the past, although I don't know exactly how they were dealt with. But it seems almost pointless to use AdSense in conjunction with malware. It will take Google approximately 30 seconds to figure out which account is doing this and then shut them down. I'm surprised that it doesn't completely divert the searcher away from Google, off to a more dubious source of revenue.

[tangor]

Might want to read the article, and follow up with the source document, with code, screen shots, and caveats in the regard as to whether Google will find this stuff "easy". Looks to be very clever.

[IanCP]

Looks to be very clever

That well maybe BUT it's going to have a very short life.

[tim222]

Might want to read the article, and follow up with the source document, with code, screen shots, and caveats in the regard as to whether Google will find this stuff "easy". Looks to be very clever.Might want to read the article, and follow up with the source document, with code, screen shots, and caveats in the regard as to whether Google will find this stuff "easy". Looks to be very clever.

I imagine they already have it figured out, but in case they're sitting around scratching their heads, here's what I would do:

Set up 5 to 10 test machines and infect them with the malware. Do some Google searches and click some ads. Find out which AdSense account(s) are involved and investigate their activity. Find out which domain names send traffic to those accounts. Investigate other AdSense accounts that receive traffic from those domains.

OK, I'll concede that it would take longer than 30 seconds to do all of that :) I think it would take a small team of techs maybe about a day, including an hour for lunch.