The FBI and its international partners have charged six individuals with conducting a sophisticated click-fraud scheme that netted them millions of dollars, the federal agency said.
The cyber-ring infected about 4 million computers in 100 countries with malware and pocketed at least $14 million by manipulating online advertisements, the FBI said Nov. 9. Six Estonian nationals were arrested in Estonia on Nov. 8. The seventh member of the gang, a Russian national, remains at large, according to the FBI.
The United States is trying to extradite the criminals to stand trial in New York, the FBI said. The U.S. Attorney’s office has charged the defendants with five counts of wire and computer intrusion crimes. One defendant has also been charged with 22 counts of money laundering.
The indictment, which was unsealed in New York on Nov. 8, “describes an intricate international conspiracy conceived and carried out by sophisticated criminals,” Janice Fedarcyk, assistant director in charge of the FBI New York office, said in a statement.
In “Operation Ghost Click,” the FBI spent two years tracking down the gang that was using DNSChanger, malware that manipulated online ads through clickjacking, which is a technique that allows fraudsters to trick Web users to go to Websites that they control or to click on ads that generate revenue for the fraud perpetrators.
Authorities have seized defendants’ computers, froze bank accounts, and seized hard drives from more than 100 rogue servers in data centers located in New York and Chicago that were suspected of being part of the command and control infrastructure.
At least 500,000 computers that had been infected were located in the United States, including systems belonging to NASA and other government agencies, as well as education institutions, nonprofit organizations, enterprises and home users.
The DNSChanger malware targeted the Domain Name System (DNS), a phone-book style directory system that translates domain names for Websites the user knows, such as Apple.com, into actual IP addresses belonging to the servers. Thanks to DNS, users don’t have to know the exact numeric address for each server. However, DNSChanger could change the DNS settings on compromised machines to point to malicious DNS servers instead of the one belonging to the network or the Internet service provider, according to the FBI.
When surfing the Web, users are directed by the malicious DNS servers to different servers. For example, if a user were trying to get to iTunes, the rogue server would send the user to a different server and try to sell Apple products. The defendants collected payments any time a user clicked on an advertisement on these fake sites, which mimicked Netflix, the Internal Revenue Service, ESPN, Amazon.com and others, the indictment said.
In another form of the campaign, the criminals hijacked search results and replaced advertisements on Websites, Paul Ferguson, senior threat researcher at Trend Micro, told eWEEK. Instead of loading ads from DoubleClick or other third-party advertising networks on the page the user had landed on, the malicious DNS servers served up ads from a network under their control, Ferguson said. As far as the user was concerned, the page was legitimate; it was just the ads that had been replaced, he said.
“They victimized legitimate Website operators and advertisers who missed out on income through click hijacking and ad replacement fraud,” the FBI’s Fedarcyk said.
There were several variations of the malware, according to Ferguson. The gang’s purpose was not to push more malware or steal information, but to monetize clickthroughs by stealing “traffic from legitimate advertisers,” Ferguson said.
The FBI has replaced the rogue DNS servers with legitimate servers, but users remain infected with the DNSChanger malware. The FBI has put up a site where users can check the DNS settings on their computers to figure out if they have been infected. Removing the malware itself is not difficult, but the challenge lies in identifying all the victims, he said, calling the effort “ongoing remediation.”
The legitimate servers will log connections and keep track of infected computers hitting the servers so that the FBI can provide the information to ISPs, who will notify users and help clean up the infection. Since DNS settings generally don’t expire for 120 days, the ISPs will be busy trying to clean up infected users over the next four months, Ferguson said.
