Botnet keepers rake in adware cash

Posted by   Virus Bulletin on   Sep 11, 2006

Zombie herder makes $430 per day from single piece of adware.

According to research by the German Honeynet Project, a botnet controller who installed adware including DollarRevenue on compromised machines earned over $430 in a single day, just from the DollarRevenue software.

The zombie net in question was mostly created using the recently-patched MS06-040 vulnerability in Windows, and took control of 7,700 machines in a 24-hour period. DollarRevenue, based from a shadowy site in the Netherlands, pays per install on a sliding scale depending on the home country of the machine infected. The researchers calculated the botnet's income from installing the software by examining logs of infected hosts. The net was also used to install other adware products and hired out to send spam campaigns.

'Adware has long been a major source of income for those who hijack other people's computers,' said John Hawes, Technical Consultant at Virus Bulletin. 'Many of these adware firms run highly suspect operations, both ethically and legally, and much more needs to be done to prevent them from making crime pay.'

Details of the research can be found on the Honeynet Project's 'honeyblog'.

Find out more about how money is made in the digital underworld at the Virus Bulletin conference (11-13 October, Montréal), where Guillaume Lovet (Fortinet) will present his paper 'Dirty money on the wires: the business models of cyber criminals'.

See the full programme here or click here to register now.

Posted on 11 September 2006 by Virus Bulletin

 Tags

twitter.png
fb.png
linkedin.png
hackernews.png
reddit.png

 

Latest posts:

In memoriam: Prof. Ross Anderson

We were very sorry to learn of the passing of Professor Ross Anderson a few days ago.

In memoriam: Dr Alan Solomon

We were very sorry to learn of the passing of industry pioneer Dr Alan Solomon earlier this week.

New paper: Nexus Android banking botnet – compromising C&C panels and dissecting mobile AppInjects

In a new paper, researchers Aditya K Sood and Rohit Bansal provide details of a security vulnerability in the Nexus Android botnet C&C panel that was exploited in order to gather threat intelligence, and present a model of mobile AppInjects.

New paper: Collector-stealer: a Russian origin credential and information extractor

In a new paper, F5 researchers Aditya K Sood and Rohit Chaturvedi present a 360 analysis of Collector-stealer, a Russian-origin credential and information extractor.

VB2021 localhost videos available on YouTube

VB has made all VB2021 localhost presentations available on the VB YouTube channel, so you can now watch - and share - any part of the conference freely and without registration.

We have placed cookies on your device in order to improve the functionality of this site, as outlined in our cookies policy. However, you may delete and block all cookies from this site and your use of the site will be unaffected. By continuing to browse this site, you are agreeing to Virus Bulletin's use of data as outlined in our privacy policy.