An HTTPS hijacking click-fraud botnet infects almost 1 million computers

The malware replaces search results with ones from an affiliate program

Over the past two years, a group of cybercriminals has infected almost 1 million computers with malware that hijacks search results, even when they're served over encrypted HTTPS connections.

The click-fraud botnet earns its creators money through Google's AdSense for Search program, according to researchers from security firm Bitdefender. The affiliate program, intended for website owners, allows them to place a Google-powered custom search engine on their websites to generate revenue when users click on ads displayed in the search results.

Instead of doing that, this botnet's operators intercept Google, Bing, and Yahoo searches performed by users on their own computers and replace the legitimate results with those generated by their custom search engine. They do this using a malware program that Bitdefender products detect as Redirector.Paco.

Since mid-September 2014, Redirector.Paco has infected more than 900,000 computers worldwide, mainly from India, Malaysia, Greece, the U.S., Italy, Pakistan, Brazil, and Algeria, the Bitdefender researchers said in a blog post Monday.

The malware is included in modified installers for well-known programs, such as WinRAR, Connectify, YouTube Downloader, Stardock Start8, and KMSPico, which are distributed on the Internet. Once installed on a computer, Redirector.Paco modifies its Internet Settings to use a Web proxy server specified by the attackers in a PAC (Proxy auto-config) file.

There are two variants of the malware: one where the PAC file and proxy are hosted on a remote server and one where they are hosted on the local computer. In both cases, the malware installs a self-generated root certificate in the computer's certificate store in order to generate rogue certificates for Google, Yahoo, and Bing that would be accepted by the victim's browser.

This is essentially a man-in-the-middle attack. The proxy establishes a connection with the real search engine, replaces the results with those from the attackers' custom search engine, re-encrypts the page with a self-generated SSL certificate for the domain name, and then serves it to the user's browser. The domain certificate is signed by the now trusted rogue root certificate installed on the computer, so it is accepted without errors.

For the version where the PAC file and proxy are stored on a remote server, this whole process introduces a noticeable delay and the user will often see messages like “waiting for proxy tunnel” or “downloading proxy script” in the browser's status bar, the Bitdefender researchers said.

The other version, which is written in .NET, installs the man-in-the-middle proxy server locally on the computer, so its impact on the browsing experience is not as noticeable. The HTTPS interception functionality is provided by a third-party .NET library called FiddlerCore.

Unlike Superfish, an ad-injecting program that was shipped on some Lenovo laptops in 2014, Redirector.Paco installs unique root certificates on every infected computer, the Bitdefender researchers said.

This means other attackers can't extract the certificate's private key from one infected computer and then use it to launch man-in-the-middle attacks against all users affected by the malware.

Join the CSO newsletter!

Error: Please check your email address.

More about GoogleLenovoStardockWinRARYahoo

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts

Market Place