[ISN] Botnet implicated in click fraud scam

[InfoSec News]

http://www.theregister.co.uk/2006/05/15/google_adword_scam/

By John Leyden
15th May 2006 

Botnets are being used for Google Adword click fraud, according to
security watchers.

The SANS Institute has uncovered evidence that networks of compromised
PCs are being used to click on banner ads, generating revenue for
unscrupulous publishers.

Pay-per-click schemes such as Google Adsense have programs to detect
fraudulent clicks and suspend publishers implicated in click fraud. In
an effort to disguise bogus visits, these publishers have begun hiring
botnets to slip under the radar of fraud detection programs.

The "bottom line is that the advertiser pays in exchange for a bot
visiting him", the SANS Institute reports [1].

Generating traffic from a small number of machines (numbered in the
hundreds) makes the traffic generated from compromised machines look
innocuous. In return for helping click fraud scammers keep a low
profile, botnet owners rake in a percentage from the scam.

The ruse came to light after security experts in the SANS Institute's
Internet Storm Centre investigated malicious software on a hacker's
website. Control panels on the site, designed to facilitate the
control of compromised machines infected with malware, were left open.  
This allowed security experts to analyse the actions of the botnet
operator behind the site.

"The botnet was 115 bots in size at the early time of the day I was
looking at it and most were under 15 clicks each," a handler at SANS
Institute reports in a diary entry [2] filed last weekend.

The institute has reported the site and its findings to Google. ®

[1] http://isc.sans.org/diary.php?storyid=1334
[2] http://isc.sans.org/diary.php?storyid=1334