Targeting The Source: FAKEAV And Malicious Domains

[webfact]

Targeting the Source: FAKEAV and Malicious Domains

In order to monetize their malicious activities, botnet operators, spammers, and those behind blackhat search engine optimization (SEO) campaigns create accounts with a network of FAKEAV affiliates.

These affiliates supply URLs to landing pages that display false antivirus scanners and that attempt to scare users into installing rogue antivirus software. If users purchase the fake product, the FAKEAV affiliate's client (e.g., a botmaster) receives a portion of the income generated.

This post analyzes the operations of one FAKEAV affiliate, which has been a past supplier of the KOOBFACE botnet as well as a prolific blackhat SEO operation.

Between March 7 and April 19, 2011, 890 domain names were collected from the source URL that this FAKEAV affiliate provides to its clients. This figure reflects the .com, .org, and .net domains and does not include domains such as co.cc that were also collected. We then found that the majority of the domain names are propagated a day after they are registered. A significant number of domains are distributed on the same day they are registered.

30 domains propagated in negative days (3.3 percent)

246 domains propagated on the same day (27.6 percent)

588 domains propagated the next day (66.0 percent)

13 domains propagated after two days (1.4 percent)

1 domain propagated after three days (0.1 percent)

3 domains propagated after seven days (0.3 percent)

Interestingly, some domains were propagated prior to registration. This fact, combined with the number of incremental domains (the same domains with incremented numbers appended), indicates that FAKEAV affiliates have an automated domain registration system. They registered an average of 20 domains a day.

However, there were also fluctuations in the number of domains registered. For example, 44 domains were registered on March 27 while only one was registered on April 17. Typically, the affiliate registers domains with two or three different registrars each day. However, on March 31, they registered domains across seven different registrars.

They also used 127 different email addresses to register the domains. However, when privacy protection email messages are removed, the attackers used 39 unique Yahoo! Mail addresses for 559 domains. On average, each address was used to register 14 domains. The highest total for a single email address was 44 domains and the lowest was one. Typically, the email addresses are used on a single day with a single registrar and are not reused. This FAKEAV affiliate is limiting the risk of discovery by spreading the registration of their malicious domains across multiple registrars and email addresses.

FAKEAV variants are distributed through an affiliate model in which a centralized location feeds malicious URLs and binaries to clients who propagate these links through their own methods. These affiliates have the capacity to register numerous domain names using different email addresses. They are also quickly propagated after registration. Thus, identifying the source of the FAKEAV domains and not just the botnets that distribute them is important in combating this threat.

-- The Nation 2011-06-04

[tombkk]

Can somebody please translate this into English: What do I have to do to protect myself from fake anit-virus software?Why do I care how many domains some bad guys create using Yahoo addresses, will that make my computer vulnerable? What do I have to watch out for?

[redsquare]

I have a sneaky feeling The Nation just cut & paste the article in it's entirety from a post on Trend Micros Blog on May 5th.

[Supernova]

Can somebody please translate this into English: What do I have to do to protect myself from fake anit-virus software?

Do your homework. Before installing AV or any other software for that matter, take the time to research the product and read reviews.

See also:

How To Protect Yourself From Fake Antivirus Programs

[BB1950]

Can somebody please translate this into English: What do I have to do to protect myself from fake anit-virus software?Why do I care how many domains some bad guys create using Yahoo addresses, will that make my computer vulnerable? What do I have to watch out for?

Don't click on any links offering a free virus scan or a PC tuneup, unless you know that link is 100% legitimate! Some links appear to be legitimate, but they are not. Some can even fool people who are aware of the tricks. I was even fooled by the Antivirus 2009 when it first appeared. So be very very careful what you click.

You don't have to be concerned how many domains or email accounts the bad guys create. It's how they try to avoid from being detected. The OP just shows some of the extent of which the bad guys go to, to share with their partners in crime. It also shows just how difficult it is to prevent.

Edited June 4, 2011 by BB1950

[FOODLOVER]

Skynet is a highly advanced artificial intelligence. Once Skynet becomes self-aware, it is destined to trigger the nuclear holocaust of Judgment Day and deploy an army ofTerminators against humanity.

To avoid this don't click on links that you are not sure of. Don't ever download free scans!

[Puccini]

I have a sneaky feeling The Nation just cut & paste the article in it's entirety from a post on Trend Micros Blog on May 5th.

That's what they did. It would have been decent of The Nation to cite the source:

blog.trendmicro.com/targeting-the-source-fakeav-and-malicious-domains/

Edited June 4, 2011 by Puccini

[tombkk]

Skynet is a highly advanced artificial intelligence. Once Skynet becomes self-aware, it is destined to trigger the nuclear holocaust of Judgment Day and deploy an army ofTerminators against humanity.

To avoid this don't click on links that you are not sure of. Don't ever download free scans!

Thanks for the illustrated explanation!

I won't click on any "free scan" or unkown anti-virus. I am quite happy with avast! Home, which is free and has warned me several times. I have been virus free since using it.

[newermonkey]

I have a sneaky feeling The Nation just cut & paste the article in it's entirety from a post on Trend Micros Blog on May 5th.

That's what they did. It would have been decent of The Nation to cite the source:

blog.trendmicro.com/targeting-the-source-fakeav-and-malicious-domains/

My feeling is that the person forwarding or plagiarizing the article just wants to look important. The information contained in the article is in fact quite useless and looks like its been taken out of context from a series of technical reports from recent research. The info would have been useful to readers on this forum if there had been some more specific data such as what form the threats are appearing in Thailand, perhaps a sample email one would expect from such fraudsters, etc...

I doubt many viewers here will understand much of what was written so the artical becomes a scaremongering peice without offering any practical advice so people can be on guard against fake or malicious software.

[happyjune]

It stood out as plagiarized, as it didn't have the usual Nation special Gram-mer added