Menu
Sefnit click fraud malware drops Tor for SSH, Facebook researchers say

Sefnit click fraud malware drops Tor for SSH, Facebook researchers say

The malware program that flooded the Tor network with new clients last year is back, but now uses SSH for command and control

Security researchers from Facebook have identified a new variant of the Sefnit click fraud malware program that uses SSH for command and control instead of the Tor anonymity network.

The threat, which is also known as Mevade, infected millions of computers last year and caused a sudden spike in Tor usage.

Sefnit is a family of malware programs that has been used to defraud advertisers by generating rogue ad clicks since at least 2011, according to an analysis in September by researchers from the Microsoft Malware Protection Center.

In mid-August, a Sefnit variant called Mevade caused the number of daily users on the Tor anonymity network to rise from around 500,000 to over 3 million because it used a Tor Hidden Service -- a website accessible only from inside the Tor network -- as a command-and-control (C&C) server.

Unlike older Sefnit variants that hijacked user clicks on search results, Mevade used a different click fraud technique that involved transforming infected computers into proxies for routing fraudulent ad click traffic.

It's not clear how well Tor worked as a C&C channel for Mevade's authors given that traffic over the anonymity network can be slow, especially when overcrowded with clients. Poor performance might explain why a new version of Sefnit recently analyzed by researchers at Facebook no longer relies on Tor.

Instead, the new variant uses the Plink (PuTTY link) command-line network connection tool to access C&C servers over the SSH (Secure Shell) protocol, the Facebook Security Team said Monday in a blog post that contains details about the new threat.

The use of Plink further indicates that Sefnit's authors have a tendency to repurpose legitimate software for their goals. This behavior was previously observed with Tor and 3proxy, a free proxy server program.

"This post references additional files, domains and artifacts, including the SSH functionality in channel.dll," the Facebook researchers said. "We hope these details and indicators help security teams audit their assets for signs of Sefnit."

Read more: Purple WiFi partners with Wavelink

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags online safetyMicrosoftsecuritymalwareFacebook

Featured

Slideshows

Tight lines as Hooked on Lenovo catches up at Great Barrier Island

Tight lines as Hooked on Lenovo catches up at Great Barrier Island

​Ingram Micro’s Hooked on Lenovo incentive programme recently rewarded 28 of New Zealand's top performing resellers with a full-on fishing trip at Great Barrier Island for the third year​ in a row.

Tight lines as Hooked on Lenovo catches up at Great Barrier Island
Inside the AWS Summit in Sydney

Inside the AWS Summit in Sydney

As the dust settles on the 2017 AWS Summit in Sydney, ARN looks back an action packed two-day event, covering global keynote presentations, 80 breakout sessions on the latest technology solutions, and channel focused tracks involving local cloud stories and insights.

Inside the AWS Summit in Sydney
Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day

Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day

Ingram Micro hosted its third annual Cure Kids Charity Golf Tournament at the North Shore Golf Club in Auckland. In total, 131 resellers, vendors and Ingram Micro suppliers enjoyed a round of golf consisting of challenges on each of the 18 sponsored holes, with Team Philips taking out the top honours.

Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day
Show Comments