Worm automates Google AdSense fraud
435651
Click-fraud menace spreads using IM Virus writers have crafted a malware threat that serves up expensive Google AdSense web pages related to mesothelioma, a rare cancer caused by exposure to asbestos.â¦
765105
Science & environment: The auction site has been the target of a hacker called Vladuz, whose actions are causing concern.
191059
A serious flaw in Google's desktop software could be used to wreak havoc on a victim's PC.
24644
The Santy worm with variants continues spreading on the Internet taking advantage of search engines, including Google, AOL, Yahoo to identify exploitable Web pages.
41332
InfoWorld - Google's Orkut social networking site appeared to have been hit by a relatively harmless worm, but one that demonstrated the continuing vulnerability of Web applications.
760665
Google Inc. appears to be doing reasonably well protecting advertisers from scam artists preying upon the Internet's largest marketing network, but it remains unclear how much the system is being bilked under a ruse known as click fraud, according to an independent report filed in court Friday.
108964
Virus writers have grafted a network sniffer into the latest variant of the SDBot worm series.
83605
Search engine's actions should halt the worm's spread, antivirus vendors say.
759015
A civil suit filed in Florida by Dell and its Alienware subsidiary is giving insight into the enormous sums of money that can be made by creating Web pages full of advertising links.In October, Dell sued a group of domain registrars, alleging the companies bought more than 1,100 domain names with trademark-infringing characteristics, such as &quot;dellbatterrogram.com&quot; in order to put advertising links on the pages.The practice, known as&#160;typosquatting, is illegal. It&#39;s intended to draw unwitting Web surfers to pages with URLs (uniform resource locators) that are similar to legitimate sites, and then redirect them to other sites. The owners of these Web sites get revenue from advertising referral programs every time a link is clicked.The defendants -- Belgiumdomains, Capitoldomains, Domaindoorman, Netrian Ventures, iHoldings.com, Juan Pablo Vazquez, and 10 unnamed defendants -- deny the claims. Dell contends the businesses, most of which are registered outside the U.S., are shell companies engaged in collusion.Dell sought a court order in November to freeze their assets so the money from their operations wouldn&#39;t disappear. Last month, the court amended the freeze order, and contained in the details of the new order are clues to just how much money the defendants may be raking in.Google, whose AdSense advertising-placement program was used to monetize the domains, was ordered to hold in a special account the first $1 million collected on behalf of the defendants each month. The second $1 million that accrues in the account every month will be given to the defendants. If more than $2 million accrues in one month, the money is split between the defendants and the Google account.Google takes a cut of AdSense revenue, which shows that it in part benefits from this kind of abuse of the Internet. However, Google recently announced it will not allow AdSense campaigns on &quot;kited&quot; domains.Kiting is a technique used by some rogue registrars to avoid having to pay the fee for using a domain. The domain is repeatedly registered and unregistered within a five-day Add-Grace Period. The grace period, which applies to a handful of TLDs (Top Level Domains) was intended to let people get a refund of their domain registration fee if they made a spelling mistake.Kiting often goes hand in hand with another abusive practice, &quot;domain tasting.&quot; A domain name is registered and monitored during the grace period to see if it gets sufficient traffic to pay for its registration fee. The domain owners then get refunds on the sites with low traffic. However, the Internet Corporation for Assigned Names and Numbers&#160;(ICANN) is considering keeping a $0.20 fee&#160;it normally refunds as part of the registration process in order to stop tasting.Dell has accused the typosquatter defendants in its lawsuit of both practices and is claiming their profits as well as $100,000 per infringing domain used.Google&#39;s antikiting policy doesn&#39;t apply to domain tasting, meaning the company will still potentially benefit from Web sites intended merely for advertising. A Google spokesman said Tuesday, however, that Web sites are supposed to have legitimate content in order to be accepted into AdSense.Other information in the court documents shed light on the economics of monetizing domain names. Dell contends the defendants control some 1 million domain names, and believes they also have used at least 64 million other unique domain names.When the court froze the defendants&#39; assets in November, it also froze their ability to stop renewing domain names that weren&#39;t producing enough revenue to justify the registration fees. Since the defendants controlled so many domain names, the automatic renewal of those names -- likely around 3,000 domains a day -- cost them $20,000 per day.However, the defendants successfully petitioned the court to cancel domains that were generating less than $8 a year in revenue.&quot;These [figures] tell us that there&#39;s lots of money in tasting, and it&#39;s a game of huge volume,&quot; wrote John Levine, a consultant and author of &quot;The Internet for Dummies&quot; on his blog.The Dell case continues in U.S. District Court for the Southern District of Florida.&#160;
724391
Security experts warn of banner ads with a bad attitude--and a link to malicious code. Also: Phishers, be gone.
293673
Santy worm, which used Google to bring down bulletin board pages, now uses AOL and Yahoo search.
116333
Google acted quickly to block Santy.A, a worm that targeted the company&#39;s popular Internet search engine. Antivirus experts say this threat has passed, but predict that it may be just
405731
A security researcher demonstrates a way to use cross site scripting to remotely spam an internal network printer.
744902
A worm that has the capability to using webcams to spy on users is circulating across the Net.
365486
A security company has identified a Trojan horse program that replaces Google text advertisements on Web pages with ads from another source, depriving Google of revenue and potentially causing problems for end users.Google may be powerless to stop the trick since it involves the modification of an internal PC file, called the hosts file, that is used to match domain names of Web sites with IP (Internet protocol) addresses, said Romanian security company BitDefender.When a person visits a Web site, the browser checks the hosts file to see if it has an IP address for a particular domain name. If the hosts file is corrupted or hijacked, the browser can be directed to fetch a different Web page than the one the user intended to.Modifying the hosts file can be done for legitimate reasons. For example, PC users can change the hosts to block banner ads served from known ad networks. When a Web page tries to contact an ad server, the request is diverted by the hosts file and no ad appears.BitDefender said in an advisory this particular malware directs a browser to download advertisements from a different server than Google&#39;s ad server.BitDefender named the malware Trojan.Qhost.WU and said it is not spreading fast and poses a &quot;medium&quot; risk of damage. It did not say how the Trojan is being circulated, and company representatives did not return a call for comment.Besides costing Google ad revenue, there is a danger that those replacement advertisements could contain links to sites with malicious software, BitDefender said. Web site owners who buy ads through Google, as well as Google itself, can lose out on both Web traffic and revenue if people are diverted from its ads.There is not much that Google can do for those who download the malware. However, security products such as BitDefender&#39;s can detect and remove it.Without commenting on the Trojan specifically, Google said it removes Web sites from its search index that contain malware.&quot;We have canceled customer accounts that display ads re-directing users to malicious sites or that advertise a product violating our software principles,&quot; the company said in a statement.
616136
(InfoWorld) - The social networking site MySpace.com is under what one computer security analyst calls an "amazingly virulent" attack caused by a worm that steals log-in credentials and spreads spam that promotes adware sites. The worm is infecting MySpace profiles with such efficiency that an informal scan of 150 found that close to a third were infected, said Christopher Boyd, security research manager at FaceTime Communications. MySpace, owned by News Corp., is estimated to have at least 73 million registered users. The worm works by using a cross-scripting weaknessÂ found around two weeks agoÂ in MySpace and a feature within Apple Computer's QuickTime multimedia player. The exploit starts with a user who visits a MySpace profile infected with an embedded QuickTime movie. The movie loads JavaScript code that overlays a row of menu options on a MySpace profile with a bogus menu. A QuickTime function, called the HREF track, can direct the player to use JavaScript commands to load Web pages into a browser frame or window. The JavaScript feature in QuickTime has legitimate uses, "but there are a lot of legitimate uses for technology that can be misused," said Ross Paul, senior product manager with Websense Inc. If an option in the bogus menu is clicked, the user is directed to a fake log-in page hosted on another server where the person's log-in details are captured. Websense has posted a screenshot of the fake log-in page. MySpace's "seemingly random tendency" to expire user sessions or log out users makes it less noticeable to victims that an attack is under way, according to a Nov. 16 advisory by the Computer Academic Underground . Additionally, the worm places an embedded QuickTime movie on the user's profile, which will then repeat the infection process for anyone who visits the profile. The worm has another malicious function. Once a profile is infected, the worm sends spam to other people in the user's contact list. Those spam messages contain a file that appears to be a movie but instead is a link to a pornographic site that also hosts adware from Zango, Boyd said. Zango, formerly 180 Solutions,Â settled last monthÂ with the U.S. Federal Trade Commission for $3 million over complaints it didn't properly ask the consent of users before its adware was installed. Boyd said he's heard anecdotal stories of users removing the worm's JavaScript manually from their profile, but the worm reappears after some time if one of their friend's profiles is infected. Several variants of the worm have also appeared, he said. While some of the Web sites hosting the malicious QuickTime movie have been taken down, others have appeared, Boyd said. The Firefox 2.0 browser was flagging some of the bogus log-in sites as phishing sites, Boyd said. However, phishing sites can be active for several hours before they are flagged, he said. MySpace officials in London couldn't immediately comment Monday morning.ADVERTISEMENTNEW IT SERVICES FROM IBM: EASIER TO BUY AND IMPLEMENTDiscover a simpler, more cost-effective way to get the solutions your company needs to grow more flexible and efficient.
49498
THE PROBLEM with phpBB software, which we reported on this time yesterday is over. And it&#39;s thanks to Google, it appears. F-Secure said that the Santy worm, which defaced web sites and used a Google search