Microsoft, Symantec take down Bamital click-fraud botnet

The botnet infected as many as 8 million computers over the past two years, the companies said
  • Jeremy Kirk (IDG News Service)
  • — 07 February, 2013 00:08

Microsoft and Symantec have dismantled a botnet that took over millions of computers for criminal activities such as identity theft and click fraud.

The Bamital botnet threatened the US$12.7 billion online advertising industry by generating fraudulent clicks on Internet ads, which fund many of the free online services available to consumers, the companies said.

As many as 8 million computers were infected with Bamital over the past two years, wrote Richard Domingues Boscovich, assistant general counsel for Microsoft's Digital Crimes Unit, in a blog post Wednesday.

It's the sixth botnet Microsoft has shut down in the past three years, and the second done in cooperation with Symantec, Boscovich wrote.

"Most if not all owners of Bamital-infected computers are unaware that their machines are infected," Microsoft said in a civil suit filed Jan. 31 in U.S. District Court for the Eastern District of Virginia.

The suit asked the court for permission to disrupt the botnet's command-and-control system. U.S. Marshals escorted investigators into Web-hosting facilities in Virginia and New Jersey, where they seized evidence and data, Boscovich wrote.

As in previous botnet-related lawsuits, Microsoft named 18 "John Doe" defendants, several of whom are listed as living in Russia, the U.S. and the U.K. The lawsuit will be amended when the defendants' real names are discovered.

The Bamital code caused users to be shuffled to malicious websites even if they clicked on legitimate search results returned by Microsoft's Bing search engine, as well as those of Yahoo and Google, according to the lawsuit.

By generating unintended clicks and visits, the botnet distorted the online advertising environment by making advertisers pay for clicks that were not genuine, the lawsuit says.

"Simply put, the ad owner paid for internet traffic that is of no use," it states.

Bamital could also steal personal information from computers and conduct distributed denial-of-service attacks, which disrupt websites by bombarding them with too much traffic.

An effort to clean up the infected computers is under way. When people with infected computers complete a search query, they're directed to a Web page from Microsoft and Symantec that explains how to remove the malicious software.

"We've found that cleanup efforts like this not only help clean people's computers, but they also take the very infrastructure the botnet needs to be impactful and profitable away from the cybercriminals," Boscovich wrote.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Tags: symantec, security, Microsoft, Exploits / vulnerabilities, malware

Confirmed: hackers can use Heartbleed to steal private SSL keys

READ THIS ARTICLE
DO NOT SHOW THIS BOX AGAIN [ x ]
Comments are now closed.
CSO Corporate Partners
  • Webroot
  • Trend Micro
  • NetIQ
rhs_login_lockGet exclusive access to CSO, invitation only events, reports & analysis.
CSO Directory

Email Security and Data Protection

Encrypt your sensitive email

Latest Jobs
Security Awareness Tip

Incident handling is a vast topic, but here are a few tips for you to consider in your incident response. I hope you never have to use them, but the odds are at some point you will and I hope being ready saves you pain (or your job!).


  1. Have an incident response plan.

  2. Pre-define your incident response team 

  3. Define your approach: watch and learn or contain and recover.

  4. Pre-distribute call cards.

  5. Forensic and incident response data capture.

  6. Get your users on-side.

  7. Know how to report crimes and engage law enforcement. 

  8. Practice makes perfect.

For the full breakdown on this article

Security ABC Guides

Warning: Tips for secure mobile holiday shopping

I’m dating myself, but I remember when holiday shopping involved pouring through ads in the Sunday paper, placing actual phone calls from tethered land lines to research product stock and availability, and actually driving places to pick things up. Now, holiday shoppers can do all of that from a smartphone or tablet in a few seconds, but there are some security pitfalls to be aware of.