Russian Hackers Run Record-Breaking Online Ad-Fraud Operation

'Methbot' is a sophisticated cybercrime scheme that has hit major US advertisers and publishing brands and pilfered millions of dollars per day.


Cybercriminals out of Russia are behind a newly discovered massive online advertising fraud operation hiding in plain site that steals up to $5 million per day from big-name US advertisers by posing as some 6,000 major US media sites including The Huffington Post, Fortune, ESPN, CBS Sports, and Fox News, and generating fake ad impressions.

Researchers at White Ops recently spotted the so-called "Methbot" operation pilfering anywhere from $3 million to $5 million per day in what they say is the largest and most profitable online ad fraud operation in history. Methbot has been operating for three years under cover by a Russian cybercrime group that White Ops has dubbed "AFK14," with a unique twist: its own internal botnet infrastructure runs and automates the click-fraud rather than the traditional ad fraud model of infecting unsuspecting consumers to do the dirty work.

Sponsor video, mouseover for sound

US advertisers in October alone lost a whopping $17.7 million to the criminal hackers, according to White Ops, and AFK13 made some $10.6 million.

AFK13, which is based in Russia, also employs data centers in Dallas and Amsterdam, to run its botnet via spoofed IP addresses that help them evade blacklists. The cybercrime gang created its own Web browser in order to better hide its tracks, as well as its own HTTP library.

"This is the largest operation ever discovered in digital ad fraud," says Eddie Schwartz, president and COO of White Ops, an ad fraud detection firm, which published its findings on AFK13 and its Methbot infrastructure today. "This one is unique in that they went to the trouble of writing their own browser code … They game everything across the entire value chain" of online advertising, he says.

The Methbot network basically drives video and other ad impressions that appear to be humans clicking on them. But video ad "watching" is actually via its botnet of automated Web browsers of more than a half-million Internet addresses using phony IP registrations posing as large ISPs such as Verizon, Comcast, AT&T, Cox, and CenturyLink.

The botnet generates phony impressions for up to 300 million of these ads daily and sends them via 6,111 Internet domains posing as actual ad inventory on brand-name websites, according to White Ops.  

"Ad companies are losing because they're paying the bill" for phony impressions, White Ops' Schwartz says.

Methbot until recently was able to operate under the radar because the Russian cybergang behind it has apparently studied how to avoid detection, including reverse-engineering and duping ad-fraud measures and spoofing fraud verification data so the advertiser sees Methbot's ad impressions as legit, even though they're phony.

AFK13's Methbot has tallied some 200 million to 300 million phony video-ad impressions daily, making an average of $13.04 per CPM, or around $4 million in phony ad inventory revenue each day.

The Russian hackers even have built the bots to imitate mouse movements and social media login information so they appear to be human-generated activity. "They're making the traffic look like residential humans," Schwartz says.

He says the forged and compromised domains made them appear legit to the advertising exchange services that broker ad space inventory for publishers. The exchanges were fooled into believing they were handing the subsequent ad impressions to the publishers, but that phony yet billable traffic instead went to Methbot.

'Hacking' 카테고리의 다른 글

A Cybersecurity Christmas Story  (0) 2016.12.27
Brute-Force Botnet Attacks Now Elude Volumetric Detection  (0) 2016.12.27
How to tell if an email is forged  (0) 2016.09.09
Jessica  (0) 2016.03.11
CSD ExecGuide  (0) 2016.01.13
Posted by CEOinIRVINE
l

World's Greatest Hacker Says Obama's BlackBerry Can Be Breached

Friday, February 13, 2009
By Joshua Rhett Miller

There's a new "holy grail" for hackers — President Obama's super-secure BlackBerry.

Despite warnings from his advisers, the president insisted on keeping his beloved PDA, which now has specially designed superencrypting security software.

But that just makes cracking into it more challenging — and, yes, it can be done, says the world's most famous hacker.

"It's a long shot, but it's possible," Kevin Mitnick told FOXNews.com. "You'd probably need to be pretty sophisticated, but there's people out there who are."

• Click here to visit FOXNews.com's Cybersecurity Center.

• Got tech questions? Ask our experts at FoxNews.com's Tech Q&A.

Mitnick served nearly five years in prison after pleading guilty to charges of wire and computer fraud for hacking into computer systems at some of the country's largest cell-phone and computer companies during the 1990s.

With his hacking days behind him, he now heads Mitnick Security Consulting.

"If I was the attacker, I would look to Obama's close circle of friends, family and associates and try to compromise their machines at home," Mitnick said. "The objective would be to get Obama's e-mail address on the BlackBerry."

Mitnick said someone with access to Obama is much more likely to be targeted by hackers because their networks, particularly those used at their homes, would be much less secure than those used by the commander-in-chief.

Once armed with Obama's coveted e-mail address, a hacker could theoretically send an e-mail to Obama in an attempt to lure him to a Web site that has previously been breached in order to transfer "malicious code," Mitnick said.

Obama administration officials declined to comment Friday.

RELATED STORIES

White House Press Secretary Robert Gibbs told reporters last month that only a small circle of associates and senior aides would be allowed to exchange e-mails with the president.

Chris Soghoian, a student fellow at Harvard University's Berkman Center for Internet and Society, agreed that the most likely route to Obama's BlackBerry would be to trick the president into visiting a pirated Web site.

"These are attacks when you visit a Web site, and within seconds, it hacks into your computer and forces it to download viruses," Soghoian said. "In many cases, people get infected by using out-of-date browsers."

Soghoian said he suspected that the likely culprit wouldn't be a hacker who targets computers for notoriety or fiscal gain, but rather a foreign government looking for classified information.

"By and large, the people who are going to do it for reputation aren't going to have the skills to get into Obama's BlackBerry," Soghoian said. "The real threat is not some dude in an Internet café in Russia; it's a team of 60 hackers working for the Chinese government. The threat is state-sponsored espionage."

The possibility of hackers competing to hack into Obama's BlackBerry is an "ongoing danger," according to Bill Brenner, senior editor at CSO Magazine, a publication for security professionals.

"There's no question there are hackers out there who would love to break into his BlackBerry," Brenner told FOXNews.com. "At any given time, you have countless people trying to hack into a politician's BlackBerry, Paris Hilton's cell phone and the Department of Defense's computer network.

"If somebody were to break in," he said, "they'd have big bragging rights, and it's definitely a big target. I would imagine to some people it would be a holy grail."

So far, officials with the Obama administration have been tight-lipped on details regarding his BlackBerry.

Some have even questioned if it is indeed a BlackBerry — or rather a Sectera Edge, an ultra-secure smartphone approved by the National Security Agency.

"Nobody has really said with certainty what device he is actually using," said Randy Sabett, a partner at Sonnenschein Nath & Rosenthal LLP and a former NSA employee. "That right there is an important subtlety. The less information known, the better."

Research In Motion, the Canadian company that manufactures the BlackBerry and routes most BlackBerry e-mail through its own servers, did not respond to repeated requests for comment.

Obama administration officials likely considered the potential risks involved, Mitnick said, and instructed the commander-in-chief to keep his communications bland.

"The question is, what intelligence would you get? He probably has a rule that nothing classified is discussed," Mitnick said. "If he's discussing anything classified, I can guarantee you it's encrypted using an advanced algorithm."

Mitnick, who eluded authorities for three years before being apprehended by the FBI in North Carolina in 1995, warned any potential hacker to consider the consequences before acting.

"The government would go after them full force," he said.

Still, the potential threat to national security remains real, however small.

"There's no such thing as 100 percent security, and anyone who tells you otherwise isn't being honest," Brenner said. "And when you're the president, there's always the danger of someone trying to get to you."

Posted by CEOinIRVINE
l
  Washington Post Staff Writers
Thursday, September 18, 2008; Page A04

A group of computer hackers said yesterday that they had accessed a Yahoo e-mail account of Alaska Gov. Sarah Palin, the Republican vice presidential nominee, publishing some of her private communications to expose what appeared to be her use of a personal account for government business

The hackers posted what they said were personal photos, the contents of several messages, the subject lines of dozens of e-mails and Palin's e-mail contact list on a site called Wikileaks.org. That site said it received the electronic files from a group identifying itself only as "Anonymous."

"At around midnight last night some members affiliated with the group gained access to governor Palin's email account, 'gov.palin@yahoo.com' and handed over the contents to the government sunshine site Wikileaks.org," said a message on the site.

Rick Davis, the campaign manager for Republican presidential nominee John McCain, issued a statement yesterday afternoon condemning the incident.

"This is a shocking invasion of the Governor's privacy and a violation of law," he said. "The matter has been turned over to the appropriate authorities and we hope that anyone in possession of these e-mails will destroy them. We will have no further comment."

The episode focuses attention on Palin's use of her personal e-mail account as lawmakers in Alaska look into whether she fired the state's public safety commissioner, Walter Monegan, because he refused to take action against her brother-in-law, a state trooper at the time.

Palin has been criticized in recent days for using a personal e-mail account to conduct state business. An Alaska activist has filed a Freedom of Information Act request seeking disclosure of e-mails from another Yahoo account Palin used, gov.sarah@yahoo.com.

That account appears to have been linked to the one that was hacked.

Both accounts appear to have been deactivated. E-mails sent to them yesterday were returned as undeliverable.

Andrée McLeod, who filed the FOIA request, said yesterday evening that Palin should have known better than to conduct state business using an unsecured e-mail account.

"If this woman is so careless as to conduct state business on a private e-mail account that has been hacked into, what in the world is she going to do when she has access to information that is vital to our national security interests?" she asked.

McLeod's Anchorage attorney, Donald C. Mitchell, said Palin declined to comply with a public records request in June to divulge 1,100 e-mails sent to and from her personal accounts, citing executive privilege.

'Politics' 카테고리의 다른 글

Palin Attuned More to Public Will, Less to Job's Details  (0) 2008.09.20
McCain Reverts to Tax Attack  (0) 2008.09.19
McCain  (0) 2008.09.17
Bright Ideas [Obama]  (0) 2008.09.17
Palin aide says Obama backers politicizing Alaska investigation  (0) 2008.09.16
Posted by CEOinIRVINE
l