The Underground Economy of Fake Antivirus Software
Published 27 July 2012
Brett Stone-Gross, Ryan Abman, Richard A. Kemmerer, Christopher Kruegel, Douglas G. Steigerwald, Giovanni Vigna
Citations113
Generate an AI Snapshot to get a quick, structured summary of this paper.
Study Snapshot
ObjectiveStudy objective
MethodsResearch methodology
PopulationPopulation studied
Sample sizeSample sizes
OutcomesStudy outcomes here
ResultsStudy results comes here
LimitationsResearch study limitations comes here
A concise AI-generated summary of the paper will appear here once you click Generate AI Snapshot.
TL;DR
An economic model is presented that demonstrates that fake AV companies are actively monitoring the refunds (chargebacks) that customers demand from their credit card providers, which can potentially be leveraged by vigilant payment processors and credit card companies to identify and ban fraudulent firms.
Abstract
Fake antivirus (AV) programs have been utilized to defraud millions of computer users into paying as much as one hundred dollars for a phony software license. As a result, fake AV software has evolved into one of the most lucrative criminal operations on the Internet. In this paper, we examine the operations of three large-scale fake AV businesses, lasting from three months to more than two years. More precisely, we present the results of our analysis on a trove of data obtained from several backend servers that the cybercriminals used to drive their scam operations. Our investigations reveal that these three fake AV businesses had earned a combined revenue of more than $130 million dollars. A particular focus of our analysis is on the financial and economic aspects of the scam, which involves legitimate credit card networks as well as more dubious payment processors. In particular, we present an economic model that demonstrates that fake AV companies are actively monitoring the refunds (chargebacks) that customers demand from their credit card providers. When the number of chargebacks increases in a short interval, the fake AV companies react to customer complaints by granting more refunds. This lowers the rate of chargebacks and ensures that a fake AV company can stay in business for a longer period of time.9pc]First author has been considered as the corresponding author. Please check. However, this behavior also leads to unusual patterns in chargebacks, which can potentially be leveraged by vigilant payment processors and credit card companies to identify and ban fraudulent firms.
Keywords
Computer Science
Why phishing works
1,286 Citations2006Rachna Dhamija, J. D. Tygar +1 more
This paper provides the first empirical evidence about which malicious strategies are successful at deceiving general users by analyzing a large set of captured phishing attacks and developing a set of hypotheses about why these strategies might work.
You've been warned
610 Citations2008Serge Egelman, Lorrie Faith Cranor +1 more
Using a model from the warning sciences, how users perceive warning messages is analyzed and suggestions for creating more effective warning messages within the phishing context are offered.
Your botnet is my botnet
581 Citations2009Brett Stone-Gross, Marco Cova +6 more
This paper reports on efforts to take control of the Torpig botnet and study its operations for a period of ten days, which provides a new understanding of the type and amount of personal information that is stolen by botnets.
Detection and analysis of drive-by-download attacks and malicious JavaScript code
574 Citations2010Marco Cova, Christopher Kruegel +1 more
A novel approach to the detection and analysis of malicious JavaScript code is presented that uses a number of features and machine-learning techniques to establish the characteristics of normal JavaScript code and is able to identify anomalous JavaScript code by emulating its behavior and comparing it to the established profiles.
All your iFRAMEs point to Us
480 Citations2008Niels Provos, Panayiotis Mavrommatis +2 more
The relationship between the user browsing habits and exposure to malware, the techniques used to lure the user into the malware distribution networks, and the different properties of these networks are studied.
The ghost in the browser analysis of web-based malware
422 Citations2007Niels Provos, Dean McNamee +3 more
This work identifies the four prevalent mechanisms used to inject malicious content on popular web sites: web server security, user contributed content, advertising and third-party widgets, and presents examples of abuse found on the Internet.
An Inquiry into the Nature and Causes of the Wealth of Internet Miscreants
331 Citations2007Jason Franklin, Vern Paxson +2 more
Lecture notes in computer scienceLearning More about the Underground Economy: A Case-Study of Keyloggers and Dropzones
220 Citations2009Thorsten Holz, Markus Engelberth +1 more
This work investigates keylogger-based stealing of credentials via dropzones, anonymous collection points of illicitly collected data, and presents an empirical study of this phenomenon, giving many first-hand details about the attacks that were observed during a seven-month period between April and October 2008.
Behind phishing: an examination of phisher modi operandi
212 Citations2008D. Kevin McGrath, Minaxi Gupta
The anatomy of phishing URLs and domains, registration ofphishing domains and time to activation, and the machines used to host the phishing sites are examined.
Anomaly Based Web Phishing Page Detection
211 Citations2006Ying Pan, Xuhua Ding
The idea is to examine the anomalies in Web pages, in particular, the discrepancy between a Web site's identity and its structural features and HTTP transactions, which demands neither user expertise nor prior knowledge of the Web site.
Lecture notes in computer scienceOn the Effectiveness of Techniques to Detect Phishing Sites
170 Citations2007Christian Ludl, Sean Mcallister +2 more
Over a period of three weeks, the effectiveness of the blacklists maintained by Google and Microsoft with 10,000 phishing URLs was tested, and the existence of page properties that can be used to identify phishing pages were explored.
The underground economy of spam: a botmaster's perspective of coordinating large-scale spam campaigns
154 Citations2011Brett Stone-Gross, Thorsten Holz +2 more
A comprehensive analysis of a large-scale botnet from the botmaster's perspective is presented, that highlights the intricacies involved in orchestrating spam campaigns such as the quality of email address lists, the effectiveness of IP-based blacklisting, and the reliability of bots.
A layout-similarity-based approach for detecting phishing pages
145 Citations2007Angelo P. E. Rosiello, Engin Kirda +2 more
An extension of the AntiPhish system (called DOMAntiPhish) is presented, which leverages layout similarity information to distinguish between malicious and benign web pages and significantly reduces the false alarm rate.
A view on current malware behaviors
144 Citations2009Ulrich Bayer, Imam Habibi +3 more
The Anubis analysis results for almost one million malware samples are evaluated, trends and evolution of malicious behaviors over a period of almost two years are studied, and the influence of code polymorphism on malware statistics are examined.
An inquiry into the nature and causes of the wealth of internet miscreants
129 Citations2007
Using a seven month trace of logs collected from an active underground market operating on public Internet chat networks, this paper measures how the shift from “hacking for fun” to “ hacking for profit” has given birth to a societal maturity mature enough to steal wealth into the millions of dollars in less than one year.
Studying Malicious Websites and the Underground Economy on the Chinese Web
117 Citations2008Jianwei Zhuge, Thorsten Holz +4 more
This chapter provides a detailed overview of this underground black market, shows that the amount of virtual assets traded on this underground market is huge, and proves that a significant amount of websites within China’s part of the Web contain some kind of malicious content.
FIRE: FInding Rogue nEtworks
92 Citations2009Brett Stone-Gross, Christopher Kruegel +3 more
Fire is presented, a novel system to identify and expose organizations and ISPs that demonstrate persistent, malicious behavior and can be used to pinpoint and to track the activity of rogue organizations, preventing criminals from establishing strongholds on the Internet.
MADOC (University of Mannheim)Monkey-Spider: Detecting Malicious Websites with Low-Interaction Honeyclients
65 Citations2008Ali İkinci, Thorsten Holz +1 more
The Monkey-Spider project is introduced, utilizing it as a client honeypot, and the challenge in such an approach is portrayed and the system is evaluated as a high-speed, Internetscale analysis tool to build a database of threats found in the wild.
An Empirical Analysis of the Current State of Phishing Attack and Defence
64 Citations2007Tyler Moore, Richard Clayton
Empirical data is analyzed on actual phishing website removal times and the number of visitors that the websites attract, and it is concluded that website removal is part of the answer to phishing, but it is not fast enough to completely mitigate the problem.
Lecture notes in computer scienceAn Analysis of Rogue AV Campaigns
63 Citations2010Marco Cova, Corrado Leita +3 more
A longitudinal analysis of the rogue antivirus threat ecosystem, focusing on the structure and dynamics of this threat and its economics, is presented, using a large dataset of characteristics ofRogue antivirus domains and of the servers that host them.
USENIX conference on Large-scale exploits and emergent threatsThe nocebo effect on the web: an analysis of fake anti-virus distribution
61 Citations2010Moheeb Abu Rajab, Lucas Ballard +3 more
It is shown that the Fake AV threat is rising in prevalence, both absolutely, and relative to other forms of web-based malware, and how these characteristics have changed over time.
Dissecting one click frauds
56 Citations2010Nicolas Christin, Sally S. Yanagihara +1 more
It is shown that the rise in the number of these frauds is fueled by high expected monetary gains in return for very little risk, and gives an interesting window on the economic dynamics of some online criminal syndicates.
Conducting cybersecurity research legally and ethically
31 Citations2008Aaron J. Burstein
These issues are explained by explaining the areas of law that are most generally applicable to cybersecurity researchers and offering guidelines for evaluating ethical issues that arise in this area of research.
THE PARTNERKA - WHAT IS IT, AND WHY SHOULD YOU CARE?
28 Citations2009Dmitry Samosseiko
This presentation will expose the most popular Russian ‘partnerka’ networks and their relation to spam and malware, and reveal some ‘insider’ statistics and information, show the tools used for ‘black SEO’ (search engine optimizations), and explain its terminology and techniques.
Munich Personal RePEc Archive (Ludwig Maximilian University of Munich)IRBs and security research: myths, facts and mission creep
25 Citations2008Simson Garfinkel
It is argued that a strict interpretation of regulations has the potential to stymie security research.
Towards Community Standards for Ethical Behavior in Computer Security Research
24 Citations2009David Dittrich, Michael Bailey +1 more
To beective, the authors must find ways to balance societal needs and the ethical issues surrounding their research, by breaking something that people rely on today.
Lecture notes in computer scienceA Framework for Understanding and Applying Ethical Principles in Network and Security Research
22 Citations2010Erin Kenneally, Michael Bailey +1 more
An intellectual framework for understanding and applying ethical principles in networking and security research rooted in the guidance suggested by an ongoing Department of Homeland Security working group on ethics is presented.
Peering through the iframe
16 Citations2011Brett Stone-Gross, Marco Cova +2 more
This paper examines in depth one drive-by-download campaign, that is, the coordinated efforts used to spread malware, and focuses on the Mebroot campaign, which is periodically monitored and infiltrated over several months, by hijacking parts of its infrastructure and obtaining network traces at an exploit server.