Menu
An HTTPS hijacking click-fraud botnet infects almost 1 million computers

An HTTPS hijacking click-fraud botnet infects almost 1 million computers

The malware replaces search results with ones from an affiliate program

Over the past two years, a group of cybercriminals has infected almost 1 million computers with malware that hijacks search results, even when they're served over encrypted HTTPS connections.

The click-fraud botnet earns its creators money through Google's AdSense for Search program, according to researchers from security firm Bitdefender. The affiliate program, intended for website owners, allows them to place a Google-powered custom search engine on their websites to generate revenue when users click on ads displayed in the search results.

Instead of doing that, this botnet's operators intercept Google, Bing, and Yahoo searches performed by users on their own computers and replace the legitimate results with those generated by their custom search engine. They do this using a malware program that Bitdefender products detect as Redirector.Paco.

Since mid-September 2014, Redirector.Paco has infected more than 900,000 computers worldwide, mainly from India, Malaysia, Greece, the U.S., Italy, Pakistan, Brazil, and Algeria, the Bitdefender researchers said in a blog post Monday.

The malware is included in modified installers for well-known programs, such as WinRAR, Connectify, YouTube Downloader, Stardock Start8, and KMSPico, which are distributed on the Internet. Once installed on a computer, Redirector.Paco modifies its Internet Settings to use a Web proxy server specified by the attackers in a PAC (Proxy auto-config) file.

There are two variants of the malware: one where the PAC file and proxy are hosted on a remote server and one where they are hosted on the local computer. In both cases, the malware installs a self-generated root certificate in the computer's certificate store in order to generate rogue certificates for Google, Yahoo, and Bing that would be accepted by the victim's browser.

This is essentially a man-in-the-middle attack. The proxy establishes a connection with the real search engine, replaces the results with those from the attackers' custom search engine, re-encrypts the page with a self-generated SSL certificate for the domain name, and then serves it to the user's browser. The domain certificate is signed by the now trusted rogue root certificate installed on the computer, so it is accepted without errors.

For the version where the PAC file and proxy are stored on a remote server, this whole process introduces a noticeable delay and the user will often see messages like “waiting for proxy tunnel” or “downloading proxy script” in the browser's status bar, the Bitdefender researchers said.

The other version, which is written in .NET, installs the man-in-the-middle proxy server locally on the computer, so its impact on the browsing experience is not as noticeable. The HTTPS interception functionality is provided by a third-party .NET library called FiddlerCore.

Unlike Superfish, an ad-injecting program that was shipped on some Lenovo laptops in 2014, Redirector.Paco installs unique root certificates on every infected computer, the Bitdefender researchers said.

This means other attackers can't extract the certificate's private key from one infected computer and then use it to launch man-in-the-middle attacks against all users affected by the malware.


Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Featured

Slideshows

Kiwi channel comes together for another round of After Hours

Kiwi channel comes together for another round of After Hours

The channel came together for another round of After Hours, with a bumper crowd of distributors, vendors and partners descending on The Jefferson in Auckland. Photos by Maria Stefina.​

Kiwi channel comes together for another round of After Hours
Consegna comes to town with AWS cloud offerings launch in Auckland

Consegna comes to town with AWS cloud offerings launch in Auckland

Emerging start-up Consegna has officially launched its cloud offerings in the New Zealand market, through a kick-off event held at Seafarers Building in Auckland.​ Founded in June 2016, the Auckland-based business is backed by AWS and supported by a global team of cloud specialists, leveraging global managed services partnerships with Rackspace locally.

Consegna comes to town with AWS cloud offerings launch in Auckland
Veritas honours top performing trans-Tasman partners

Veritas honours top performing trans-Tasman partners

Veritas honoured its top performing partners across the channel in Australia and New Zealand, recognising innovation and excellence on both sides of the Tasman. Revealed under the Vivid lights in Sydney, Intalock claimed the coveted Partner of the Year 2017 (Pacific) award, with Data#3 acknowledged for 12 months of strong growth across the market. Meanwhile, Datacom took home the New Zealand honours, with Global Storage and Insentra winning service provider and consulting awards respectively. Dicker Data was recognised as the standout distributor of the year, while Hitachi Data Systems claimed the alliance partner award. Photos by Bob Seary.

Veritas honours top performing trans-Tasman partners
Show Comments