Microsoft, Symantec take down Bamital click-fraud botnet
The botnet infected as many as 8 million computers over the past two years, the companies said
IDG News Service - Microsoft and Symantec have dismantled a botnet that took over millions of computers for criminal activities such as identity theft and click fraud.
The Bamital botnet threatened the US$12.7 billion online advertising industry by generating fraudulent clicks on Internet ads, which fund many of the free online services available to consumers, the companies said.
As many as 8 million computers were infected with Bamital over the past two years, wrote Richard Domingues Boscovich, assistant general counsel for Microsoft's Digital Crimes Unit, in a blog post Wednesday.
It's the sixth botnet Microsoft has shut down in the past three years, and the second done in cooperation with Symantec, Boscovich wrote.
"Most if not all owners of Bamital-infected computers are unaware that their machines are infected," Microsoft said in a civil suit filed Jan. 31 in U.S. District Court for the Eastern District of Virginia.
The suit asked the court for permission to disrupt the botnet's command-and-control system. U.S. Marshals escorted investigators into Web-hosting facilities in Virginia and New Jersey, where they seized evidence and data, Boscovich wrote.
As in previous botnet-related lawsuits, Microsoft named 18 "John Doe" defendants, several of whom are listed as living in Russia, the U.S. and the U.K. The lawsuit will be amended when the defendants' real names are discovered.
The Bamital code caused users to be shuffled to malicious websites even if they clicked on legitimate search results returned by Microsoft's Bing search engine, as well as those of Yahoo and Google, according to the lawsuit.
By generating unintended clicks and visits, the botnet distorted the online advertising environment by making advertisers pay for clicks that were not genuine, the lawsuit says.
"Simply put, the ad owner paid for internet traffic that is of no use," it states.
Bamital could also steal personal information from computers and conduct distributed denial-of-service attacks, which disrupt websites by bombarding them with too much traffic.
An effort to clean up the infected computers is under way. When people with infected computers complete a search query, they're directed to a Web page from Microsoft and Symantec that explains how to remove the malicious software.
"We've found that cleanup efforts like this not only help clean people's computers, but they also take the very infrastructure the botnet needs to be impactful and profitable away from the cybercriminals," Boscovich wrote.
Send news tips and comments to email@example.com. Follow me on Twitter: @jeremy_kirk
- Deep Security +VMware vSphere with Operations Management Most midsize organizations are highly virtualized on VMware, and while this has produced significant savings, it also has created new challenges when it...
- 3 Questions to Ask Your DNS Host about Lowering DDoS Risks Neustar has had wide-ranging conversations with clients wanting to know how they can optimize protection as DDoS attacks increase in frequency and size.
- The Danger Deepens: 2014 Neustar Annual DDoS Attacks and Impact Report This report compares DDoS findings from 2013 to 2012, based on a survey of 440 North American companies, including 139 businesses delivering technology...
- DDoS Infographic: How Are Attacks Evolving? For the third consecutive year, Neustar surveyed businesses across major industries to track the evolution of DDoS attacks. Are they more frequent? Larger?...
- How to Use Crowd-Sourced Threat Intelligence to Stop Malware in its Tracks Threat sharing networks have been around for a long time, however they have typically been "invitation-only", available to only large companies, or those...
- An Incident Response Playbook: From Monitoring to Operations As cyber-attacks grow more sophisticated, many organizations are investing more into incident detection and response capabilities. In this webcast, learn how to develop... All Malware and Vulnerabilities White Papers | Webcasts