Posts tagged as:

ads

Donbot dumps fake AV spam – pitches gambling site instead

Donbot dumps fake AV spam – pitches gambling site instead

Botnets pitching online casinos

Donbot – aka Bachsoy and Buzus – is known to be capable of generating an incredible volume of spam. At its height in the summer of 2009, the swarm was noted as generating around 800 million spam messages a day from around 125,000 infected PCs.

This equates to around 1.3% of global spam volumes, although some reports have noted spikes reaching the 4.0% mark.

According to David Broome, a researcher with M86 Security, Donbot’s spam deluge paused recently for 15 minutes and came back with a gambling pitch.

The pitch, he says in his latest security blog, is one his security colleagues have seen for over a year on and off in their spam traps.

“It is designed to encourage the reader to gamble money on roulette with what is presented as a winning strategy. Conveniently, a link to an online casino is provided to the user in order to use this strategy and make easy money”, he reports.

Following the link, says Broome, leads to a web splash page where clicking any button on the page – including the language flags at the top – starts a download of Casino-Online.exe.


The WHOIS information for the casino domain lists it as having been registered at namecheap.com on the 24th of May 2011.

“So, if there was any doubt to the possible legitimacy of this casino, here’s the proof that it is in fact an illegitimate operation. The domains that lead to the casino software are changing regularly and being spammed out fresh”, he said.

After downloading the Casino-Online.exe binary and scanning it through the VirusTotal test site, 4 of 42 anti-virus packages detected it as various malware executables.

“When we ran the Casino-Online.exe in our environment and set up an account, no unusual traffic was seen going out. While it may not be malware in the traditional sense, it’s certainly operating in a highly dubious fashion. We normally advise against clicking links in spam messages, so downloading and executing arbitrary executable files is a definite no-no”, he said.

The information gathered during the account creation process, he explained, is quite thorough, which is also concerning given what data could be collected and used for future spam campaigns, or sold.

“Assuming the casino isn’t rigged, the odds are still stacked in favour of the house. Despite their description of the strategy, the odds for Red/Black in roulette are not actually 50/50, instead being 48.6/48.6/2.8 – the 2.8% being for the 0 that is also on the wheel”, he observes.

This means, he goes on to say, that regardless of a bet on red or black, you have a 51.4% chance of losing the bet.

Whilst this may seem reasonable odds, he adds, it gives the casino enough of a winning margin that – given enough time they will eventually come out on top.

“Using the strategy outlined in the spam message of multiplying a bet 2.5 times after every loss, it would take only 10 losses in a row for you to have lost $6,000, and 13 losses in a row for you to have lost just shy of $100,000″, he says.

“Without an unlimited bankroll you will surely come to grief at some point”, he adds.

from http://www.infosecurity-magazine.com/view/18297/donbot-dumps-fake-av-spam-pitches-gambling-site-instead/

{ Comments on this entry are closed }

Google, Yahoo, And MySpace Ads May Infect Computers

Infected Search?

Infected Search?

Antivirus company Avast alleges that ads served by companies such as Google, Yahoo! and Fox, and published on websites such as the New York Times and TechCrunch, have included bad software that could infect your computer.

Users don’t even have to click the ads to be affected. Their browser gets infected just from loading the ads. CNet has the story.

The report allegs these companies’ ad platforms include exploits that allow malicious hackers to run a JavaScript exploit called JS:Prontexi.

Prontexi is a Trojan horse targeting Windows machines that looks for further vulnerabilities in software such as Adobe’s Reader and Acrobat, Java, QuickTime and Flash. It pops up fake antivirus warnings to trick you into installing further malware. The malware started spreading in late December. Since then, Avast has found it has infected more than 2.6 million computers. Almost 530,000 of those were from Yield Manager and more than 16,300 from DoubleClick.

The worst affected are Yahoo!’s Yield Manager, Fox Audience Network’s Firmserve.com and Google’s DoubleClick. Together, these networks serve over 50% of all internet ads. DoubleClick has been the least affected and Google has been the fastest at tackling the problem, according to CNet and Avast.

A Yahoo representative confirmed the report and said it was investigating the situation, but didn’t provide much information. “We have identified the creatives in question and are working to make sure they been deactivated in our system,” the company said in a statement.

“Yahoo is deeply committed to providing a high-quality experience for users, advertisers, and publishers. We expect our members to support and abide by our standards and guidelines around acceptable ad content and behavior,” the statement said. “On the rare occasion that an ad is served that is in conflict with our expectations and guidelines we take action to remove it as quickly as possible.”

A Google spokesman said the company had discovered malware in ads from DoubleClick on its own and halted them. “In this case, we stopped several of the ads in question on the same day, independent of this report,” he said.

{ Comments on this entry are closed }