Date:03/05/12
The Flashback Trojan that infected Apple Mac computers could have made more than $10,000 (£6,200) a day for its creators, suggests research.
Analysis of the malicious software by security firm Symantec showed it was built to hijack Google searches. On infected machines the malware watched for specific keywords.
When they were spotted, the Trojan re-directed users to sites that its creators were being paid to funnel people towards. In early April, it was revealed that up to 500,000 Apple Mac computers had been infected by malicious software called Flashback.
The malware targeted a vulnerability in the Java software that is used in Windows machines, Apple computers and many others. Macs were the biggest victims because Apple did not patch the loophole in its version of Java for several weeks after the vulnerability became known.
Twitter used
The Symantec analysis has revealed why the malware was created and how much cash it might have generated for its creators. By reverse engineering the software, Symantec has discovered that it lurked on infected machines waiting until a user searched on Google for certain words such as "toys".
If a user clicked on an advert related to that search, they would never reach the site they wanted but were re-directed to others showing ads and links. Symantec engineers found that Flashback's creators would be paid 0.008 cents every time a user was re-directed. Other malicious programs that managed to infect 25,000 victims have been seen to generate about $450 per day for their creators.
"Considering the Flashback Trojan measures in the hundreds of thousands, this figure could sharply rise to the order of $10,000 per day," wrote the Symantec researchers.
Further analysis of Flashback by Russian security firm Dr Web, which sounded the alarm about the malware, has revealed how it was controlled. Its creators seem to have used Twitter as the command-and-control system for the huge number of machines that it infected.
Compromised machines were programmed to regularly search Twitter for messages containing particular strings of letters. These would direct infected machines to visit particular websites to get updates or receive further instructions.
Flashback 'hijacked' Google keyword searches
The Flashback Trojan that infected Apple Mac computers could have made more than $10,000 (£6,200) a day for its creators, suggests research.Analysis of the malicious software by security firm Symantec showed it was built to hijack Google searches. On infected machines the malware watched for specific keywords.
When they were spotted, the Trojan re-directed users to sites that its creators were being paid to funnel people towards. In early April, it was revealed that up to 500,000 Apple Mac computers had been infected by malicious software called Flashback.
The malware targeted a vulnerability in the Java software that is used in Windows machines, Apple computers and many others. Macs were the biggest victims because Apple did not patch the loophole in its version of Java for several weeks after the vulnerability became known.
Twitter used
The Symantec analysis has revealed why the malware was created and how much cash it might have generated for its creators. By reverse engineering the software, Symantec has discovered that it lurked on infected machines waiting until a user searched on Google for certain words such as "toys".
If a user clicked on an advert related to that search, they would never reach the site they wanted but were re-directed to others showing ads and links. Symantec engineers found that Flashback's creators would be paid 0.008 cents every time a user was re-directed. Other malicious programs that managed to infect 25,000 victims have been seen to generate about $450 per day for their creators.
"Considering the Flashback Trojan measures in the hundreds of thousands, this figure could sharply rise to the order of $10,000 per day," wrote the Symantec researchers.
Further analysis of Flashback by Russian security firm Dr Web, which sounded the alarm about the malware, has revealed how it was controlled. Its creators seem to have used Twitter as the command-and-control system for the huge number of machines that it infected.
Compromised machines were programmed to regularly search Twitter for messages containing particular strings of letters. These would direct infected machines to visit particular websites to get updates or receive further instructions.
Views: 1040
©ictnews.az. All rights reserved.
Similar news
- Mobile operators of national market to reduce roaming tariffs
- Iran vows to unplug Internet
- China Targeting Telecoms in Corruption Probe
- Bangladesh to use electronic voting system for next elections
- Philippine IT sector to launch five-year digital strategy plan
- Russian Premier Vladimir Putin meets ITU Secretary-General Hamadoun Touré
- US lawmakers propose to regulate use of geolocation data
- Unlimited mobile data plans dying as telcos gear up for cloud future
- Europe at risk of falling behind US and Asia on 4G use
- Netherlands first to regulate on net neutrality
- Korean Co Takes Aim At Display Patents
- Regulators, Banks Look for IT Hires After Breakdowns
- Electron transactions spreading
- Schools in remote rural areas will connect to the single database via network without SIM
- Obama to Personally Tweet From Twitter Account
