Menu
Sefnit click fraud malware drops Tor for SSH, Facebook researchers say

Sefnit click fraud malware drops Tor for SSH, Facebook researchers say

The malware program that flooded the Tor network with new clients last year is back, but now uses SSH for command and control

Security researchers from Facebook have identified a new variant of the Sefnit click fraud malware program that uses SSH for command and control instead of the Tor anonymity network.

The threat, which is also known as Mevade, infected millions of computers last year and caused a sudden spike in Tor usage.

Sefnit is a family of malware programs that has been used to defraud advertisers by generating rogue ad clicks since at least 2011, according to an analysis in September by researchers from the Microsoft Malware Protection Center.

In mid-August, a Sefnit variant called Mevade caused the number of daily users on the Tor anonymity network to rise from around 500,000 to over 3 million because it used a Tor Hidden Service -- a website accessible only from inside the Tor network -- as a command-and-control (C&C) server.

Unlike older Sefnit variants that hijacked user clicks on search results, Mevade used a different click fraud technique that involved transforming infected computers into proxies for routing fraudulent ad click traffic.

It's not clear how well Tor worked as a C&C channel for Mevade's authors given that traffic over the anonymity network can be slow, especially when overcrowded with clients. Poor performance might explain why a new version of Sefnit recently analyzed by researchers at Facebook no longer relies on Tor.

Instead, the new variant uses the Plink (PuTTY link) command-line network connection tool to access C&C servers over the SSH (Secure Shell) protocol, the Facebook Security Team said Monday in a blog post that contains details about the new threat.

The use of Plink further indicates that Sefnit's authors have a tendency to repurpose legitimate software for their goals. This behavior was previously observed with Tor and 3proxy, a free proxy server program.

"This post references additional files, domains and artifacts, including the SSH functionality in channel.dll," the Facebook researchers said. "We hope these details and indicators help security teams audit their assets for signs of Sefnit."

Read more: Purple WiFi partners with Wavelink

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags online safetyMicrosoftsecuritymalwareFacebook

Featured

Slideshows

Reseller News launches inaugural Hall of Fame lunch

Reseller News launches inaugural Hall of Fame lunch

Reseller News welcomed 2015 and 2016 inductees - Darryl Swann, Dave Rosenberg, Gary Bigwood, Keith Watson, Mike Hill and Scott Green - to the inaugural Reseller News Hall of Fame lunch, held at the French Cafe in Auckland. The inductees discussed how the channel can collectively work together to benefit New Zealand, the Kiwi skills shortage and the future of the industry. Photos by Maria Stefina.

Reseller News launches inaugural Hall of Fame lunch
Educating from the epicentre - Why distributors are the pulse checkers of the channel

Educating from the epicentre - Why distributors are the pulse checkers of the channel

​As the channel changes and industry voices deepen, the need for clarity and insight heightens. Market misconceptions talk of an “under pressure” distribution space, with competitors in that fateful “race for relevance” across New Zealand. Amidst the cliched assumptions however, distribution is once again showing its strength, as a force to be listened to, rather than questioned. Traditionally, the role was born out of a need for vendors and resellers to find one another, acting as a bridge between the testing lab and the marketplace. Yet despite new technologies and business approaches shaking the channel to its very core, distributors remain tied to the epicentre - providing the voice of reason amidst a seismic industry shift. In looking across both sides of the vendor and partner fences, the middle concept of the three-tier chain remains centrally placed to understand the metrics of two differing worlds, as the continual pulse checkers of the local channel. This exclusive Reseller News Roundtable, in association with Dicker Data and rhipe, examined the pivotal role of distribution in understanding the health of the channel, educating from the epicentre as the market transforms at a rapid rate.

Educating from the epicentre - Why distributors are the pulse checkers of the channel
Kiwi channel reunites as After Hours kicks off 2017

Kiwi channel reunites as After Hours kicks off 2017

After Hours made a welcome return to the channel social calendar last night, with a bumper crowd of distributors, vendors and resellers descending on The Jefferson in Auckland to kickstart 2017. Photos by Maria Stefina.

Kiwi channel reunites as After Hours kicks off 2017
Show Comments