New York Times ad scam linked to new botnet

There has been a spike in click fraud thanks to a new botnet that is eluding the most sophisticated filters of search engines, web publishers and ad networks, according to a web security company.

Click Forensics, which provides services to monitor ad campaigns for click fraud, said that the botnet's architects had figured out a way to mask it particularly well as legitimate search ad traffic.

The company is calling this the "Bahama botnet" because initially it was redirecting traffic through 200,000 parked domains in the Bahamas, although it now is using sites in Amsterdam, the UK and Silicon Valley.

Click fraud affects marketers who spend money on pay-per-click (PPC) advertising on search engines and web pages. It happens when a person or a machine clicks on a PPC ad with malicious intent or by mistake.

For example, a competitor may click on a rival's PPC ads in order to drive up their ad spending. Also, a rogue web publisher may click on PPC ads on its site to trigger more commissions, which is probably what's behind the Bahama botnet.

Click fraud also includes non-malicious activity that nonetheless yields a click of little or no value to the advertiser, such as when someone clicks on an ad by mistake or two consecutive times.

Click Forensics has been warning recently that click fraud scammers are increasingly resorting to botnets, which are networks of computers that have been secretly compromised for a variety of malicious tasks.

The Bahama botnet is masking the source of its clicks to convince click-fraud filters they are coming from high-quality, legitimate sources, such as US libraries and schools. The botnet is also altering the "interval and breadth" of the attacks from the compromised PCs, according to Click Forensics.

In a piece of extremely bad news for advertisers running PPC campaigns, Click Forensics has seen worst-case scenarios in which as much as 30 percent of a monthly ad budget is swallowed by Bahama botnet click-fraud traffic.

Ordinary users' PCs are made part of the Bahama botnet with malware. Click Forensics found links to the malware in search results for queries about the non-existent Facebook Fan Check virus.

Last week, security company Sophos and Facebook both warned that malicious hackers were setting up malware-infested websites that falsely claimed to remove a non-existent virus from a new Facebook application called Fan Check.

False rumours spread that Fan Check infected PCs with malware, so scammers tried to capitalise on the concern that many Facebook members had about the application.

As Facebook members used popular search engines to find antivirus information about Fan Check, they got results that pointed to sites that offered false virus removal kits and instead infected their computers with malware.

Click Forensics also said the botnet malware is "extremely similar" to the "scareware" program found in malicious ads that The New York Times was tricked into serving up on its website last weekend. Before the Times eliminated them, the ads displayed pop-up messages falsely telling users their PCs were infected so they would buy a fake anti-virus program.

Click Forensics is in contact with major search engines, ad network providers, advertisers, publishers and security companies regarding the Bahama botnet and ways to address it.

Neither Google nor Yahoo, which operate the two largest search engines and PPC ad networks, immediately responded to a request for comment.