Jump to content

Rogue security software: Difference between revisions

From Wikipedia, the free encyclopedia
Browse history interactively
← Previous editNext edit →
Content deleted Content added
VisualWikitext
m Reverted edits by 122.178.214.240 (talk) to last version by Webclient101
Line 14: Line 14:
Some rogue security software, however, propagate onto users' computers as [[drive-by download]]s which exploit [[vulnerability (computing)|security vulnerabilities]] in web browsers, pdf viewers, or email clients to install themselves without any manual interaction.<ref name="symantec-2" /><ref name="blog_adobe">{{cite web |url=http://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html |title=News Adobe Raeder and Acrobat Vulnerability |publisher=blogs.adobe.com |accessdate=25 November 2010}}</ref>
Some rogue security software, however, propagate onto users' computers as [[drive-by download]]s which exploit [[vulnerability (computing)|security vulnerabilities]] in web browsers, pdf viewers, or email clients to install themselves without any manual interaction.<ref name="symantec-2" /><ref name="blog_adobe">{{cite web |url=http://blogs.adobe.com/psirt/2009/12/new_adobe_reader_and_acrobat_v.html |title=News Adobe Raeder and Acrobat Vulnerability |publisher=blogs.adobe.com |accessdate=25 November 2010}}</ref>


More recently, malware distributors have been utilizing [[search engine optimization|SEO poisoning]] techniques by pushing infected URLs to the top of search engine results about recent news events. People looking for articles on such events on a search engine may encounter results that, upon being clicked, are instead redirected through a series of sites<ref name="fsecure">
More recently, malware distributors have been utilizing [[search engine optimization|SEO poisoning]] techniques by pushing infected URLs to the top of search engine results about recent news events.<ref name=AAA>{{cite news |url= http://www.spywareloop.com/news/rogue-security-software |title= Rogue Security Software in SpyWareLoop.com |author= Vincentas |newspaper=''Spyware Loop'' |date=13 July 2013 |accessdate=24 July 2013}}</ref> People looking for articles on such events on a search engine may encounter results that, upon being clicked, are instead redirected through a series of sites<ref name="fsecure">
{{Citation | last = Chu | first = Kian | last2 = Hong | first2 = Choon | title = Samoa Earthquake News Leads To Rogue AV | publisher = [[F-Secure]] | date = 2009-09-30 | url = http://www.f-secure.com/weblog/archives/00001779.html | accessdate = 2010-01-16}}</ref> before arriving at a landing page that says that their machine is infected and pushes a download to a "trial" of the rogue program.<ref name="eweek">{{Citation | last = Hines | first = Matthew | title = Malware Distributors Mastering News SEO | publisher = [[eWeek]] | date = 2009-10-08 | url = http://securitywatch.eweek.com/seo/malware_distributors_mastering_news_seo.html | accessdate = 2010-01-16}}</ref><ref name="sc-magazine">{{Citation | last = Raywood | first = Dan | title = Rogue anti-virus prevalent on links that relate to Haiti earthquake, as donors encouraged to look carefully for genuine sites | publisher = SC Magazine | date = 2010-01-15 | url = http://www.scmagazineuk.com/rogue-anti-virus-prevalent-on-links-that-relate-to-haiti-earthquake-as-donors-encouraged-to-look-carefully-for-genuine-sites/article/161431/ | accessdate = 2010-01-16}}</ref> A 2010 study by [[Google]] found 11,000 domains hosting fake anti-virus software, accounting for 50% of all malware delivered via internet advertising.<ref>{{cite journal|publisher=[[Google]]|url=http://krebsonsecurity.com/wp-content/uploads/2010/04/leet10.pdf|date=2010-04-13|accessdate=2010-11-18|author=Moheeb Abu Rajab and Luca Ballard|title=The Nocebo Effect on the Web: An Analysis of Fake Anti-Virus Distribution}}</ref>
{{Citation | last = Chu | first = Kian | last2 = Hong | first2 = Choon | title = Samoa Earthquake News Leads To Rogue AV | publisher = [[F-Secure]] | date = 2009-09-30 | url = http://www.f-secure.com/weblog/archives/00001779.html | accessdate = 2010-01-16}}</ref> before arriving at a landing page that says that their machine is infected and pushes a download to a "trial" of the rogue program.<ref name="eweek">{{Citation | last = Hines | first = Matthew | title = Malware Distributors Mastering News SEO | publisher = [[eWeek]] | date = 2009-10-08 | url = http://securitywatch.eweek.com/seo/malware_distributors_mastering_news_seo.html | accessdate = 2010-01-16}}</ref><ref name="sc-magazine">{{Citation | last = Raywood | first = Dan | title = Rogue anti-virus prevalent on links that relate to Haiti earthquake, as donors encouraged to look carefully for genuine sites | publisher = SC Magazine | date = 2010-01-15 | url = http://www.scmagazineuk.com/rogue-anti-virus-prevalent-on-links-that-relate-to-haiti-earthquake-as-donors-encouraged-to-look-carefully-for-genuine-sites/article/161431/ | accessdate = 2010-01-16}}</ref> A 2010 study by [[Google]] found 11,000 domains hosting fake anti-virus software, accounting for 50% of all malware delivered via internet advertising.<ref>{{cite journal|publisher=[[Google]]|url=http://krebsonsecurity.com/wp-content/uploads/2010/04/leet10.pdf|date=2010-04-13|accessdate=2010-11-18|author=Moheeb Abu Rajab and Luca Ballard|title=The Nocebo Effect on the Web: An Analysis of Fake Anti-Virus Distribution}}</ref>


Revision as of 10:21, 24 July 2013

Rogue security software is a form of Internet fraud using computer malware (malicious software) that deceives or misleads users into paying money for fake or simulated removal of malware (so is a form of ransomware)—or it claims to get rid of malware, but instead introduces malware to the computer.[1] Rogue security software has become a growing and serious security threat in desktop computing in recent years (from 2008 on).[2]

Propagation

Rogue security software mainly relies on social engineering (fraud) to defeat the security built into modern operating system and browser software and install itself onto victims' computers.[2] A website may, for example, display a fictitious warning dialog stating that someone's machine is infected with a computer virus, and encourage them through social engineering to install or purchase scareware in the belief that they are purchasing genuine antivirus software.

Most have a Trojan horse component, which users are misled into installing. The Trojan may be disguised as:

Some rogue security software, however, propagate onto users' computers as drive-by downloads which exploit security vulnerabilities in web browsers, pdf viewers, or email clients to install themselves without any manual interaction.[3][5]

More recently, malware distributors have been utilizing SEO poisoning techniques by pushing infected URLs to the top of search engine results about recent news events.[6] People looking for articles on such events on a search engine may encounter results that, upon being clicked, are instead redirected through a series of sites[7] before arriving at a landing page that says that their machine is infected and pushes a download to a "trial" of the rogue program.[8][9] A 2010 study by Google found 11,000 domains hosting fake anti-virus software, accounting for 50% of all malware delivered via internet advertising.[10]

Cold-calling has also become a vector for distribution of this type of malware, with callers often claiming to be from "Microsoft Support" or another legitimate organization.[11]

Operation

Once installed, the rogue security software may then attempt to entice the user into purchasing a service or additional software by:

  • Alerting the user with the fake or simulated detection of malware or pornography.[12]
  • Displaying an animation simulating a system crash and reboot.[2]
  • Selectively disabling parts of the system to prevent the user from uninstalling the malware. Some may also prevent anti-malware programs from running, disable automatic system software updates and block access to websites of anti-malware vendors.
  • Installing actual malware onto the computer, then alerting the user after "detecting" them. This method is less common as the malware is likely to be detected by legitimate anti-malware programs.
  • Altering system registries and security settings, then "alerting" the user.

Developers of rogue security software may also entice people into purchasing their product by claiming to give a portion of their sales to a charitable cause. The rogue Green antivirus, for example, claims to donate $2 to an environmental care program for each sale made.[13]

Some rogue security software overlaps in function with scareware by also:

  • Presenting offers to fix urgent performance problems or perform essential housekeeping on the computer.[12]
  • Scaring the user by presenting authentic-looking pop-up warnings and security alerts, which may mimic actual system notices.[14] These are intended to use the trust that the user has in vendors of legitimate security software.[2]

Sanction by the FTC and the increasing effectiveness of anti-malware tools since 2006 have made it difficult for spyware and adware distribution networks—already complex to begin with[15]—to operate profitably.[16] Malware vendors have turned instead to the simpler, more profitable business model of rogue security software, which is targeted directly at users of desktop computers.[17]

Rogue security software is often distributed through highly lucrative affiliate networks, in which affiliates supplied with Trojan kits for the software are paid a fee for every successful installation, and a commission from any resulting purchases. The affiliates then become responsible for setting up infection vectors and distribution infrastructure for the software.[18] An investigation by security researchers into the Antivirus XP 2008 rogue security software found just such an affiliate network, in which members were grossing commissions upwards of $USD150,000 over 10 days, from tens of thousands of successful installations.[19]

Countermeasures

Private efforts

Law enforcement and legislation in all countries were very slow to react to the appearance of rogue security software even though it simply uses new technical means to carry out mainly old and well-established kinds of crimes. In contrast, several private initiatives providing discussion forums and lists of dangerous products were founded soon after the appearance of the first rogue security software. Some reputable vendors also began to provide lists of rogue security software, for example Kaspersky.[20] In 2005, the Anti-Spyware Coalition was founded, a coalition of anti-spyware software companies, academics, and consumer groups.

Many of the private initiatives were at first more or less informal discussions on general Internet forums, but some were started or even entirely carried out by individual people. The perhaps most famous and extensive one is the Spyware Warrior list of rogue/suspect antispyware products and websites by Eric Howes,[21] which has however not been updated since May 2007. The website recommends checking the following websites for new rogue anti-spyware programs, most of which are however not really new and are "simply re-branded clones and knockoffs of the same rogue applications that have been around for years"[22]

In December 2008, the US District Court for Maryland—at the request of the FTC—issued a restraining order against Innovative Marketing Inc, a Kiev-based firm producing and marketing the rogue security software products WinFixer, WinAntivirus, DriveCleaner, ErrorSafe, and XP Antivirus.[23] The company and its US-based web host, ByteHosting Internet Hosting Services LLC, had their assets frozen, were barred from using domain names associated with those products and any further advertisement or false representation.[24]

Law enforcement has also exerted pressure on banks to shut down merchant gateways involved in processing rogue security software purchases. In some cases, the high volume of credit card chargebacks generated by such purchases has also prompted processors to take action against rogue security software vendors.[25]

See also

References

  1. ^ "Symantec Report on Rogue Security Software" (PDF). Symantec. 2009-10-28. Retrieved 2010-04-15.
  2. ^ a b c d "Microsoft Security Intelligence Report volume 6 (July - December 2008)". Microsoft. 2009-04-08. p. 92. Retrieved 2009-05-02.
  3. ^ a b Doshi, Nishant (2009-01-19), Misleading Applications – Show Me The Money!, Symantec, retrieved 2009-05-02
  4. ^ Doshi, Nishant (2009-01-21), Misleading Applications – Show Me The Money! (Part 2), Symantec, retrieved 2009-05-02
  5. ^ "News Adobe Raeder and Acrobat Vulnerability". blogs.adobe.com. Retrieved 25 November 2010.
  6. ^ Vincentas (13 July 2013). "Rogue Security Software in SpyWareLoop.com". Spyware Loop. Retrieved 24 July 2013. {{cite news}}: Italic or bold markup not allowed in: |newspaper= (help)
  7. ^ Chu, Kian; Hong, Choon (2009-09-30), Samoa Earthquake News Leads To Rogue AV, F-Secure, retrieved 2010-01-16
  8. ^ Hines, Matthew (2009-10-08), Malware Distributors Mastering News SEO, eWeek, retrieved 2010-01-16
  9. ^ Raywood, Dan (2010-01-15), Rogue anti-virus prevalent on links that relate to Haiti earthquake, as donors encouraged to look carefully for genuine sites, SC Magazine, retrieved 2010-01-16
  10. ^ Moheeb Abu Rajab and Luca Ballard (2010-04-13). "The Nocebo Effect on the Web: An Analysis of Fake Anti-Virus Distribution" (PDF). Google. Retrieved 2010-11-18. {{cite journal}}: Cite journal requires |journal= (help)
  11. ^ "Warning over anti-virus cold-calls to UK internet users". BBC News. Retrieved 7 March 2012.
  12. ^ a b "Free Security Scan" Could Cost Time and Money, Federal Trade Commission, 2008-12-10, retrieved 2009-05-02
  13. ^ CanTalkTech - Fake Green AV disguises as security software with a cause
  14. ^ "SAP at a crossroads after losing $1.3B verdict". Yahoo! News. 24 November 2010. Retrieved 25 November 2010.
  15. ^ Testimony of Ari Schwartz on "Spyware" (PDF), Senate Committee on Commerce, Science, and Transportation, 2005-05-11
  16. ^ Leyden, John (2009-04-11). "Zango goes titsup: End of desktop adware market". The Register. Retrieved 2009-05-05.
  17. ^ Cole, Dave (2006-07-03), Deceptonomics: A Glance at The Misleading Application Business Model, Symantec, retrieved 2009-05-02
  18. ^ Doshi, Nishant (2009-01-27), Misleading Applications – Show Me The Money! (Part 3), Symantec, retrieved 2009-05-02
  19. ^ Stewart, Joe (2008-10-22), Rogue Antivirus Dissected - Part 2, SecureWorks
  20. ^ Rogue security software
  21. ^ http://www.spywarewarrior.com/rogue_anti-spyware.htm
  22. ^ http://www.bleepingcomputer.com/virus-removal/ BleepingComputer.com: Spyware & Malware Removal Guides
  23. ^ Ex Parte Temporary Restraining Order RDB08CV3233 (PDF), United States District Court for the District of Maryland, 2008-12-03, retrieved 2009-05-02
  24. ^ Lordan, Betsy (2008-12-10), Court Halts Bogus Computer Scans, Federal Trade Commission, retrieved 2009-05-02
  25. ^ Krebs, Brian (2009-03-20), "Rogue Antivirus Distribution Network Dismantled", Washington Post, retrieved 2009-05-02
Retrieved from "https://en.wikipedia.org/w/index.php?title=Rogue_security_software&oldid=565596450"