Welcome to WebmasterWorld Guest from 54.205.17.36

Forum Moderators: incrediBILL & martinibuster

Message Too Old, No Replies

Google Click Fraud via Malware

A Google gadget assists

     
1:54 am on Jul 2, 2009 (gmt 0)

Senior Member from US 

WebmasterWorld Senior Member tangor is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Nov 29, 2005
posts:7153
votes: 442


Moderators... if in wrong location, please move:

Miscreants have developed one of most sophisticated click fraud malware applications to date.

The Trojan code - dubbed FFsearcher by security firm SecureWorks - plugs into a Google API that allows webmasters to add a Google-powered search widget (called "Google Custom Search") to their website. In normal use, search results made via the widget are displayed alongside Google AdSense ads, with webmasters receiving a small fee every time a surfer follows an ad.

The malware hijacks this feature so that every search an infected user makes is performed through a search widget under their control, so that they get paid by Google every time a surfer clicks on a sponsored ad. Hackers have also worked out a means to pull off this sleight of hand without giving any indication to surfers that anything might be amiss. Google might find it hard to unravel instances of fraud.

Reported at The Register

[theregister.co.uk...]

Article contains links to screen shots of the exploit...

2:25 am on July 2, 2009 (gmt 0)

Senior Member

WebmasterWorld Senior Member 5+ Year Member

joined:Aug 3, 2007
posts:724
votes: 0


I know there have been similar malware applications in the past, although I don't know exactly how they were dealt with. But it seems almost pointless to use AdSense in conjunction with malware. It will take Google approximately 30 seconds to figure out which account is doing this and then shut them down. I'm surprised that it doesn't completely divert the searcher away from Google, off to a more dubious source of revenue.
4:12 am on July 2, 2009 (gmt 0)

Senior Member from US 

WebmasterWorld Senior Member tangor is a WebmasterWorld Top Contributor of All Time 10+ Year Member Top Contributors Of The Month

joined:Nov 29, 2005
posts:7153
votes: 442


Might want to read the article, and follow up with the source document, with code, screen shots, and caveats in the regard as to whether Google will find this stuff "easy". Looks to be very clever.
4:49 am on July 2, 2009 (gmt 0)

Senior Member from AU 

WebmasterWorld Senior Member 10+ Year Member Top Contributors Of The Month

joined:Aug 22, 2003
posts:2097
votes: 118


Looks to be very clever

That well maybe BUT it's going to have a very short life.

3:33 pm on July 2, 2009 (gmt 0)

Senior Member

WebmasterWorld Senior Member 5+ Year Member

joined:Aug 3, 2007
posts:724
votes: 0


Might want to read the article, and follow up with the source document, with code, screen shots, and caveats in the regard as to whether Google will find this stuff "easy". Looks to be very clever.Might want to read the article, and follow up with the source document, with code, screen shots, and caveats in the regard as to whether Google will find this stuff "easy". Looks to be very clever.

I imagine they already have it figured out, but in case they're sitting around scratching their heads, here's what I would do:

Set up 5 to 10 test machines and infect them with the malware. Do some Google searches and click some ads. Find out which AdSense account(s) are involved and investigate their activity. Find out which domain names send traffic to those accounts. Investigate other AdSense accounts that receive traffic from those domains.

OK, I'll concede that it would take longer than 30 seconds to do all of that :) I think it would take a small team of techs maybe about a day, including an hour for lunch.