Welcome to WebmasterWorld Guest from 18.104.22.168
Miscreants have developed one of most sophisticated click fraud malware applications to date.
The Trojan code - dubbed FFsearcher by security firm SecureWorks - plugs into a Google API that allows webmasters to add a Google-powered search widget (called "Google Custom Search") to their website. In normal use, search results made via the widget are displayed alongside Google AdSense ads, with webmasters receiving a small fee every time a surfer follows an ad.
The malware hijacks this feature so that every search an infected user makes is performed through a search widget under their control, so that they get paid by Google every time a surfer clicks on a sponsored ad. Hackers have also worked out a means to pull off this sleight of hand without giving any indication to surfers that anything might be amiss. Google might find it hard to unravel instances of fraud.
Reported at The Register
Article contains links to screen shots of the exploit...
Might want to read the article, and follow up with the source document, with code, screen shots, and caveats in the regard as to whether Google will find this stuff "easy". Looks to be very clever.Might want to read the article, and follow up with the source document, with code, screen shots, and caveats in the regard as to whether Google will find this stuff "easy". Looks to be very clever.
I imagine they already have it figured out, but in case they're sitting around scratching their heads, here's what I would do:
Set up 5 to 10 test machines and infect them with the malware. Do some Google searches and click some ads. Find out which AdSense account(s) are involved and investigate their activity. Find out which domain names send traffic to those accounts. Investigate other AdSense accounts that receive traffic from those domains.
OK, I'll concede that it would take longer than 30 seconds to do all of that :) I think it would take a small team of techs maybe about a day, including an hour for lunch.