What has been called the biggest cyber-criminal takedown in history, the FBI has recently arrested six Estonians running a botnet “click-jacking” ring. It may actually sound more insidious than it actually is, but the hackers were collecting fraudulent commissions from advertising websites by redirecting traffic to them from botnets infecting people’s computers. What truly astounding is the size of this endeavor; the botnet infected four million computers in 100 different countries. The size and scope of the hackers network is what makes the bust so newsworthy.
The botnet worked by infecting Windows computers with malware called a DNSChanger, which manipulated users’ browser settings and redirected their computers to advertising websites. The websites, in compensation for the increased traffic, would pay the Estonians in commission for each person redirected. With 4 million computers in their “click-jacking” network, that’s a lot of commissions. In fact, the vast majority of the users probably never suspected that anything was wrong (other than a ton of pop-up ads and randomly be diverted to an advertising website, which they have thought nothing of), and this Estonian group may not have been caught. However, two years ago the malware was detected on a NASA computer network, which alerted the FBI to the group’s activities. So began the sting dubbed “Operation Ghost Click”. The FBI began investigating the Estonian IT company that was functioning as a front business and now, after almost two years of cyber-police work, six Estonian nationals are in custody. On Russian national involved in the syndicate is still at large.
Trend Micro, a U.S. security firm that provided some of the intel for the FBI during Operation Ghost Click, has posted some tips for diagnosing and eradicating the malware DNSChanger if you believe your computer may be infected.
Though this is the largest cyber-crime operation ever uncovered, it should be noted that there are many others on going, many of which are being investigated. However, cybersecurity has become a major focus of governments and companies across the globe as hackers continually find news ways of running criminal (or criminal mischief) abuses of computer networks. Operation Ghost Click came about because of the accidental infection of a NASA network. It makes one consider the number of similar cybercrime operations that have not come under law enforcement’s radar that continue to infect and manipulate individuals online activities, ones that may be otherwise undetectable to the millions of untrained computer users out there. Not every virus is a Stuxnet style game ender, and in fact, those are the least profitable.