An HTTPS hijacking click-fraud botnet infects almost 1 million computers

The malware replaces search results with ones from an affiliate program

Over the past two years, a group of cybercriminals has infected almost 1 million computers with malware that hijacks search results, even when they're served over encrypted HTTPS connections.

The click-fraud botnet earns its creators money through Google's AdSense for Search program, according to researchers from security firm Bitdefender. The affiliate program, intended for website owners, allows them to place a Google-powered custom search engine on their websites to generate revenue when users click on ads displayed in the search results.

Instead of doing that, this botnet's operators intercept Google, Bing, and Yahoo searches performed by users on their own computers and replace the legitimate results with those generated by their custom search engine. They do this using a malware program that Bitdefender products detect as Redirector.Paco.

Since mid-September 2014, Redirector.Paco has infected more than 900,000 computers worldwide, mainly from India, Malaysia, Greece, the U.S., Italy, Pakistan, Brazil, and Algeria, the Bitdefender researchers said in a blog post Monday.

The malware is included in modified installers for well-known programs, such as WinRAR, Connectify, YouTube Downloader, Stardock Start8, and KMSPico, which are distributed on the Internet. Once installed on a computer, Redirector.Paco modifies its Internet Settings to use a Web proxy server specified by the attackers in a PAC (Proxy auto-config) file.

There are two variants of the malware: one where the PAC file and proxy are hosted on a remote server and one where they are hosted on the local computer. In both cases, the malware installs a self-generated root certificate in the computer's certificate store in order to generate rogue certificates for Google, Yahoo, and Bing that would be accepted by the victim's browser.

This is essentially a man-in-the-middle attack. The proxy establishes a connection with the real search engine, replaces the results with those from the attackers' custom search engine, re-encrypts the page with a self-generated SSL certificate for the domain name, and then serves it to the user's browser. The domain certificate is signed by the now trusted rogue root certificate installed on the computer, so it is accepted without errors.

For the version where the PAC file and proxy are stored on a remote server, this whole process introduces a noticeable delay and the user will often see messages like “waiting for proxy tunnel” or “downloading proxy script” in the browser's status bar, the Bitdefender researchers said.

The other version, which is written in .NET, installs the man-in-the-middle proxy server locally on the computer, so its impact on the browsing experience is not as noticeable. The HTTPS interception functionality is provided by a third-party .NET library called FiddlerCore.

Unlike Superfish, an ad-injecting program that was shipped on some Lenovo laptops in 2014, Redirector.Paco installs unique root certificates on every infected computer, the Bitdefender researchers said.

This means other attackers can't extract the certificate's private key from one infected computer and then use it to launch man-in-the-middle attacks against all users affected by the malware.

Join the newsletter!

Or
Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection
Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Essentials

Mobile

Victorinox Werks Professional Executive 17 Laptop Case

Learn more >

Sansai 6-Outlet Power Board + 4-Port USB Charging Station

Learn more >

Exec

Budget

Back To Business Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?