Feeds:
Posts
Comments

Archive for the ‘Click Fraud’ Category

Chances are all of you have had to endure those pesky pop-up and online ads informing you that your computer is vulnerable to outside threats and that you must immediately update the machine’s security system.  Turns out that more often than not, those ads themselves are the threat.

The FBI and Department of Justice this week announced that a collaborative effort titled Operation Trident Tribunal has exposed and disrupted two separate ‘scareware’ international cyber crime operations.  Combined, the scams affected at least one million individuals, with losses totaling more than $70 million.

The first case, far and away the bigger of the two, was investigated by the FBI’s Seattle office.  It involved a scam that directed individuals to a website advertising a free virus scan.  Visiting the site itself, however, would infect the user’s computer with malicious software that manifested itself in the form of a never-ending stream of pop-up ads claiming the computer had been infected by a virus.

Naturally, the only way a person could get rid of the so-called virus was to buy the anti-virus software advertised at a cost of $129.  The FBI estimates that 960,000 people fell victim to the ploy, at a cost of $72 million.

The second scam, which the FBI’s Minneapolis office took the lead on investigating, involved an international crime network that was running a version of the good old cybercrime standard, malvertising.

In this case, two scammers created a fake advertising agency and then ran an advertisement for a hotel chain on the site of a prominent Minneapolis newspaper.  Once the ad went live, though, the pair altered the computer code contained within the ad itself to ensure that anyone who clicked on it would be infected with devious software that launches scareware.  This scam netted victim losses of more than $2 million.

The FBI had help on the latter case thanks to cooperative efforts from agencies in the UK, Canada, Germany, France, the Netherlands, Ukraine, Latvia, Cyprus, Lithuania, Romania, and Sweden.  Though the alleged perpetrators of the scheme have been arrested, and more than 40 computers, serves and bank accounts seized, the investigation will continue.

Of course, this episode again gives us the opportunity to remind you all just how important it is to stay diligent when browsing the web.  The FBI itself is warning computer users to keep an eye out for security alerts that don’t seem quite right, even if they contain names that seem legit (such as Virus Shield, Virus Remover, etc):

“Upon closer inspection, some elements aren’t fully functional.  For instance, to appear authentic, you may see a list of reputable icons—like software companies or security publications—but you can’t click through to go to those actual sites,” the FBI says.

Cybercrime is still as rampant as ever, even with busts like this taking a small chunk out of the overall problem.  It’s up to you to keep yourself protected!  As always, leave us your thoughts and comments!

Read Full Post »

We’re not sure who’s in charge of cyber security over at Sony but it’s probably safe to say that he or she will be looking for a new job soon, if they aren’t doing so already.

Just as the company was starting to recover from the high-profile attack on its Playstation gaming network a few weeks ago that exposed the personal information of more than 100 million individuals, Sony-Ericsson’s Canadian e-commerce site was hacked yesterday with stunning ease, forcing it offline.

The Canada hack exposed the personal data, notably user names, passwords and email accounts, of at least 2,000 Sony e-tail customers.  Visitors Wednesday to ca.eshop.sonyericsson.com, which hawks Sony Ericsson cell phones and accessories, were informed that the site was down.  Others were diverted to the company’s U.K.-based e-commerce site to make purchases instead.

Earlier this week, Sony online properties in both Japan and Greece were attacked as well and now news emerges that its site based in Thailand also has been shut down after it experienced unauthorized intrusions and the presence of malicious code that could spam user email accounts was found.

And you though YOU were having a bad week!?

The apparent culprit of Wednesday’s hack is a self-described “Lebanese grey-hat hacker” named Idahc.  Unlike the other attacks, Idahc was able to compromise both Sony Canada’s online store and customer database though both he and Sony claim that credit card information was not touched.

He did, however, post nearly 1,000 of the records he accessed online and a file containing some of that data was put on The Hacker News, a site that tracks cyber attacks. Included with the file was a message from Idahc himself:

“I hacked the database of ca.eshop.sonyericsson.com with a simple sql injection (LOL).  Hackers vs. Sony.  We are the winners.”

(For those of us unfamiliar with coding, an SQL injection is a technique that capitalizes on web programming errors by adding a hacker’s instructions into the data entry fields of a website.)

It seems that Mr. Idahc isn’t intent on stealing from Sony customers, just exposing the company’s blatant security failures.  And so far, there can be no doubt that he and his contemporaries are indeed doing just that, and with shocking ease. Sony hasn’t had much to say publicly about this recent round of attacks but this is obviously becoming a public relations nightmare for them before more cyber attacks ensue.

What are your thoughts? Getting a little antsy about Sony having your personal information?

Read Full Post »

E-commerce payment systems accounted for a sizable chunk of credit card fraud instances in 2010, with smaller merchants and retailers representing the biggest targets for criminals intent on stealing debit and credit card information according to a new report from Trustwave.

The web security firm’s report “Payment Card Trends and Risks for Small Merchants” says that 90 percent of all card-security compromises in e-commerce last year involved Level 4 merchants, which comprise the smallest of the four designations given to retailers by the likes of Visa and MasterCard.

“Taken at face value, this might surprise most readers,” says the report.  “Though there are attacks that target large, well-known businesses, many attackers look for vulnerable systems.  These attackers are often able to find common and easy-to-exploit vulnerabilities in the systems of Level 4 merchants because small businesses generally have devoted few resources to protecting those vulnerable assets.”

Level 4 retailers typically process less than 1 million total payment card transactions each year and less than 20,000 e-commerce transactions annually.

Trustwave’s report doesn’t provide any specific guidelines for how retailers can improve their security.  However, it does point out numerous failures on the part of smaller merchants to comply with the Payment Card Industry Data Security Standard, the industry’s collection of data security rules.

The report, for example, says that 98 percent of small merchants both fail to maintain the firewalls that are designed to protect payment information AND fail to regularly test how secure their card-protection systems are. Furthermore, 75 percent don’t protect that payment data that they store.

These failures, either on their own or collectively, most certainly heighten the chances that a smaller retailer can be the victim of cyber crime.

Overall, e-commerce payment systems accounted for 9 percent of the total security compromises in 2010.  Point-of-sale software used by brick and mortar merchants accounted for 75 percent of the compromises.  Employee workstations (11 percent) and ATMs (2 percent) were also part of the equation.

The lesson is quite clear though.  Smaller and mid-sized retailers must devote as much time and resources to payment system security as the big boys.  Consumers these days are more often than not looking for the best price available and will consider both large and small merchants as they do their research without the knowledge that the security protocols in place often differ between the two.

Leave us your comments below!

Read Full Post »

There was a time when online crime and click fraud seemed to exist outside the consciousness of most online shoppers. Those days appear to be long gone.

A new survey released by privacy research firm the Ponemon Institute and fraud prevention services provider ThreatMetrix says as much, with a whopping 85 percent of respondents indicating that they worry about becoming a fraud victim as a result of their online usage.

By comparison, 80 percent of those polled expressed similar concerns the last time the two entities ran a similar study.

Ponemon and ThreatMetrix polled 607 regular internet users for the latest survey, and included a wide range of  activities under its definition of “online fraud”, including credit card scams, identity theft, phishing, and spam as well as attacks that target personal information and account details under false pretenses.

“A lot of fraudulent activity goes unreported today, making it difficult for online businesses to fully understand the prominence and seriousness of the problem,” says Reed Taussig, ThreatMetrix CEO.  “With a rise in online transactions and activities across devices, more needs to be done to educate online merchants, banks, social outlets and other businesses on how to decrease fraudulent activity.”

With that increased awareness of the threat of online fraud comes a desire on the part of most web users to see more protections from e-tailers, even if that means giving up some of the privacy they enjoy while shopping online: almost three-quarters of those polled in the survey said they’d be okay with trusted online businesses placing cookies on their computers in order to authenticate them; 82 percent said they expect businesses to offer alternative authentication measures if cookies proved ineffective.

“Consumers expressed much more willingness to share data like Internet Service Providers, computer serial number, type and make, rather than information like date of birth and telephone number,” says Larry Ponemon, chairman of the Ponemon Institute.

The pool of respondents used in the survey was certainly a good one to speak on the issue of online fraud in general: 42 percent of those questioned said they have already been the victim of fraud before.

Unfortunately, their responses also make clear that most fraud victims don’t do much in response to being duped.  Only 19 percent of those who had suffered from fraudulent activities actually notified the involved online business directly of it, while the rest didn’t report the crimes at all.

Leave us your thoughts and comments below.

Read Full Post »

Nothing like some cyber crime to ruin the early part of your week, right?

The Internet Crime Complaint Center (IC3), a collaborative effort between the FBI and the National White Collar Crime Center (NW3C), has issued an alert for three different emerging online scams this week.

The three threats, involving social networking, online shopping and a fraudulent White House email chain, reflect both recent cyber crime trends and newer versions of existing online scams as well.  In the interest of keeping our readership abreast of the different threats out there on the web, we’re going to summarize each one and let you know what to look out for.

Let’s start, of course, with the online shopping-themed scam which is operating as what’s called a ‘receipt generator.’ Unlike most online shopping-centered fraud, this particular scam is employing software to actually steal from online sellers by generating fake receipts.

Standard operating procedure in the event of an issue with an online order is for the merchant to request a copy of the transaction’s receipt.  The executable file involved here generates what looks like a genuine sales receipt that is provided to a merchant at those times, complete with details such as the totals before tax, sales tax figures, etc. Since no one really expects anyone to take the time and effort to create a fake receipt, these fake receipts can easily be taken as the real deal.  Scammers using the receipt generator have been targeting retailers on Amazon’s marketplace, in particular, lately.

The second scam, described as a social engineering scheme, was originally discovered in December by the IC3 and revolves around the misspellings of an unnamed social networking site.  The misspelled domain name redirects users to sites that resemble the actual social networks in a practice called typosquatting.  Upon arriving at the fraudulent sites, users are posed a series of survey questions with the promise of free gifts as a reward, including gift cards and laptops. Predictably of course, when it’s time to redeem the ‘gift’, users are required to supply a host of personal information including their names, address, phone number and email addresses.  Many individuals spend countless hours filling out these surveys, unknowingly providing private information to unknown parties and will never receive anything.

Finally, we have the most creative of the bunch, the fraudulent holiday card from the White House.  Actually a malware campaign, it initially targeted government employees in an email with a link to a greeting card from the White House. Clicking on the link downloads a particularly tricky information-stealing Trojan that will disable a machine’s security notifications, firewall settings and software updates.  The malware embeds itself in a computer’s registry, meaning it can be executed every time a computer is restarted and has a very low anti-virus detection rate as well.

The text of the fake email looks like this:

From: sender@whitehouse.gov [mailto: sender@whitehouse.gov]
Sent: Wednesday, December 22, 2010 10:33 PM
To: recipient’s name
Subject: Merry Christmas, recipient’s name
Recipient’s name here,
As you and your families gather to celebrate the holidays, we wanted to take a moment to send you our greetings.  Be sure that we’re profoundly grateful for your dedication to duty and wish you inspiration and success in fulfillment of our core mission.
Greeting card:
hxxp://xtremedefenceforce.com/card/
hxxp://elvis.com.au/card/
Merry Christmas!
___________________________________________
Executive Office of the President of the United States
The White House
1600 Pennsylvania Avenue NW
Washington, DC 20500

Keep your eyes peeled for these scams and remember to keep your computer’s security system current and updated. Thoughts?  Leave us a comment below.

Read Full Post »

Adding to a growing list of why last year was such a good one for online retailers, a new report issued today says that fraud losses decreased in 2010, thanks in large part to merchants rejecting more suspect orders.

Though the overall fraud rate for online retailers from the U.S. and Canada held steady at 0.9 percent for the second consecutive year, the report from CyberSource reveals that total losses from fraud last year totaled $2.7 billion for U.S. retailers.

That’s a significant drop from the $3.3 billion reported in 2009.

“E-commerce sales are picking up but fraud managers are keeping up with increased fraud volume,” says Doug Schwegman, director of worldwide market intelligence at CyberSource, a Visa subsidiary that provides fraud prevention and payment processing services to web merchants.

According to CyberSource, the rate of fraud in the report is defined as the percentage of all accepted orders that eventually turn out to be fake.  The company conducted the survey in September and October, polling 334 merchants in North America and another 200 from the United Kingdom.

Overall sales throughout 2010 were up across most e-commerce channels, but the report says a greater commitment on the part of web merchants to reject suspicious orders is the main reason for the decrease in total fraud.  North American retailers rejected 2.7 percent of all 2010 orders, up slightly from 2.4 percent in 2009.  It was the first increase in rejected orders in two full years but still far short of the 4 percent rejection rate that was reported in 2008.

U.K. retailers didn’t enjoy as strong of a year as their North American counterparts in this critical area—the overall fraud rate across the pond increased to 1.9 percent from 1.6 in 2009, though the U.K. rejection rate did actually increase to 5 percent, up 0.04 percent from the previous year.

CyberSource says the higher rate in the U.K. is due to criminals moving more activities to the country as a result of tougher prevention tactics elsewhere in the world, and also because many U.K. retailers are likely to accept cross-border transactions, many of which often turn out to be fraudulent.

Seems like it’s better to be in North America if you’re a merchant dealing with fraud right now, doesn’t it?  As always, leave us your thoughts and comments.

Read Full Post »

With the 2010 holiday shopping season now in the rear view mirror, a move by the state of Illinois has served as a reminder that one of the biggest issues facing the e-commerce industry—internet taxation—certainly isn’t going to disappear from the forefront in 2011.

The state has announced the formation of a new amnesty program for consumers who owe unpaid taxes on past Internet purchases.  It is believed to be the first such consumer-focused program ever launched by any state in the country but certainly may not be the last if it proves to be fruitful.

The program will go live officially on January 1st and run through October 15 of next year.

Under the terms of the amnesty offering, Illinois will waive all penalties and interest on payments that consumers make to the state to cover “use” taxes on purchases made between June of 2004 and this past December from internet retailers, catalog companies and any other merchants that did not collect sales taxes on those transactions.

Use taxes, which the Illinois program is focused on, are not often mentioned in the larger debate over internet taxation and most consumers are neither aware of them or pay them at all.   They’re typically levied by states like Illinois IN LIEU of traditional sales taxes and they get their name from the fact that individuals are expected to pay, in any given state, for the right to use products they buy from web and catalog merchants that do not collect sales taxes on purchases.

Though they go by a different moniker, use taxes still boil down to a form of internet taxation much like we’ve seen in places like Colorado and North Carolina.  While the state argues that the Illinois’ Use Tax Amnesty program is an effort to raise awareness of consumers’ use-tax responsibility, the broader goal of the program is to recoup some of the estimated $150 million in uncollected tax revenue out there every year.

Several other states that take part in the Streamlined Sales Tax Project, which we have chronicled a few times before, have previously offered amnesty programs to retailers for uncollected sales taxes in the past.  Illinois, however, is the first state to target consumers with an amnesty program of this type.

It’s not the lone step the state is taking to address use/sales tax awareness.  Taking a cue from several other states, Illinois is also going to require taxpayers, beginning this year, to estimate their own use tax liability on their state tax returns.   State residents will have a choice when filing returns this year to either use a template worksheet to roughly calculate their liability or choose to pay roughly $3 for every $10,000 of adjusted gross income.

It’s been fairly quiet on the internet taxation front lately but this news out of Illinois is sure to get the debate fired up once again, particularly if we see more states rolling out similar tax proposals in the New Year.

As always, we welcome your comments!

Read Full Post »

Even we admit that we’re starting to sound like a broken record here at Junkie when the topic of click fraud comes up.  But don’t blame us for being repetitive!  Even though we’re always thinking positive thoughts and hoping for the best, click fraud data continues to disappoint every three months or so.

The second quarter of 2010 isn’t any different.  In fact, it’s now to the point where the leading click fraud trends are consistently heading in the WRONG direction when analyzed in the big picture, offering no relief in sight for beleaguered web advertisers and marketers.

Anchor Intelligence, our most-trusted source for comprehensive data on click fraud, reports that second quarter fraud actually moderately decreased, down to 28.9 percent from 29.2 percent in the first three months of 2010.

We’d suggest a celebration for this 0.3 percent reduction, except for one glaring problem:  the Q2 rate actually represents a 26 percent increase in fraud compared to the same quarter just a year ago.

What’s happened in 12 short months that makes this possible?  As usual, Anchor cites the “dramatic” growth of botnets in both scale and volume around the globe as the main culprits.  The “exploitation by malicious hosts” of security vulnerabilities in the Internet infrastructure of many countries is also to blame.

Vietnam (37.3 percent), Australia (36.4 percent) and the U.S. (34 percent) continue to lead the rankings around the world for the highest attempted click fraud rates.  But India isn’t far off, after recording a dramatic jump in click fraud from 21.8 percent in Q1 to 31.7 percent in the second quarter.

“Click fraud attempts are not going to go away any time soon.  Cybercriminals will simply reallocate their attempts from well protected ad networks and search engines to those that do not have a fortified line of defense,” says Ken Miller, CEO of Anchor Intelligence.  “Fraudsters are efficient.  Once they stop receiving payments from one set of targets, they’ll simply find another set that is likely to pay out.”

Talk about doom and gloom! Is there anything good to take away from Anchor’s quarterly report?

Anchor did report that search engines and advertising networks that process more than 1 million daily ad clicks were experiencing some decreases in click fraud in the second quarter, attributed mostly to their partnerships with networks that have amped up click fraud defenses and/or don’t bill for fraudulent clicks.  Firm numbers on those decreases aren’t available, however.

We’ve been reporting that same rough news about click fraud every quarter for quite awhile now. So it’s time for you, our readers, to have a say.   Give us your ideas and thoughts on how to turn this click fraud mess around.  What drastic strategic steps do you think need to be implemented? Or is it just a lost cause?  Leave a comment and let’s get an open discussion going here!

Read Full Post »

Give the folks at Microsoft (MSFT) credit. When they say they’re serious about cracking down on click fraud, they really mean it.

Just a few months after taking legal action against a number of hackers and click-fraud perpetrators, the software giant has filed two more lawsuits against parties it claims are now engaged in a whole new form of click fraud that Microsoft has uncovered.

One suit filed in the U.S. District Court for the Western District of Washington charges RedOrbit.com president Eric Ralls and ten others with engaging in click laundering, a term Microsoft has created to describe a new method of boosting the number of ad clicks on a web site. RedOrbit, which at one time was an approved site on Microsoft’s AdCenter network, is accused in the suit of using botnets and “parked sites” to dramatically increase the number of clicks on ads on the RedOrbit site.  Unlike conventional click fraud methods, however, RedOrbit directed click traffic to its own servers, where it could replace traffic reference information with a code to make it appear as though the traffic came directly to the approved RedOrbit page.

“What was at one point thought to be highly or almost impossible to do, we have uncovered it is technically possible to do,” said Richard Boscovich, an attorney in Microsoft’s digital crimes unit. “This is the first time we’ve seen this occur.”

The term “parked sites” refer to web pages with little or no value that generally are composed only of long lists of links.

Microsoft claims it discovered the new phase of click fraud in early 2009 after noticing that hits from RedOrbit.com jumped astronomically—from an average of 75 per day to nearly 10,000. Microsoft appears pretty confident that RedOrbit perpetrated the fraud, since it was the one and only company that stood to profit from the activity the resulted in such a massive increase in clicks.

The second lawsuit covers another case of potential click laundering on sites affiliated with HelloMetro.   Twenty unnamed individuals are cited in the suit and Microsoft hopes to reveal the identities of those involved during the discovery process.  The twin suits could be just the beginning of an aggressive legal strategy by Microsoft to shut down those they believe are guilty of click laundering.

“We believe that although these are the only two cases we’ve identified, based on our traffic quality team, they think it’s a much bigger problem,” said Boscovich, who also noted that the company has already implemented countermeasures to stop any more attempts at click laundering.  What those steps are, however, remain a secret to the general public.  Microsoft’s willingness to pursue legal action against fraudsters should also serve as a deterrent to others who are pursuing fraudulent action on pay-per-click advertising models.

Nevertheless, there is a consensus building among many in the industry that advertising platform operators like Microsoft and Google (GOOG) will need to begin working in tandem to combat click fraud in all forms.  Fraudulent activity continues to grow, causing an increasing mistrust on the part of advertisers in the pay per click model, which would certainly affect the bottom lines of web advertising leaders.

We’ll keep close tabs on these and other click fraud lawsuits. As always, feel free to leave us your thoughts in the comment section below!

Read Full Post »

Anchor Intelligence has released its report on Q1 2010 traffic quality and as expected, click fraud has increased yet again across the web.

Anchor is reporting a fraud rate of 29.2 percent for the first three months of this year, building on the 25.7 percent click fraud rate over the final quarter of 2009, and representing an almost 14 percent increase.  That’s also a 34 percent increase in click fraud from the first quarter of 2009.

According to the report, the continued rise in click fraud is largely due to the dramatic growth of botnets in both scale and volume around the world and we’re inclined to agree.  Click fraud rates have been rising steadily for as long as Ecommerce Junkie has been writing about it and it’s no coincidencethat botnets have become an increasingly larger menace over that time period as well.

The report from Anchor also includes data on traffic quality rates by country, with Vietnam (35.4 percent), Australia (35.2 percent) and the U.S. (35 percent) rounding out the top three for highest rates of click fraud among 30 countries across the globe.  Again, botnets and click-fraud rings are likely the biggest cause of fraudulent traffic in these countries.  The United Kingdom has been hit especially hard by botnet activity over the last six months, with click fraud rates rising to 32 percent there this quarter after only 18 percent in Q4 2009.

“As Internet usage has grown in countries lacking appropriate cybersecurity measures, more and more computers have become infected with malware and used as click fraud zombies,” said Ken Miller, CEO of Anchor Intelligence.  “Through this report, we hope to convey the importance of advertising with ad networks and search engines that partner with third-parties such as Anchor to certify their traffic quality.”

Admittedly, it has been a rough few months for cyber security overall, which probably also explains the continued rise in fraud.  There have been recent reports from McAfee and Google on a rise in cyber attacks against blogs in Vietnam that were critical of certain mining efforts.  And of course, we had more than thirty companies (including Google) who were victims of cyber security breaches originating out of China back in December and January.

Despite the fact that the U.S. economy is beginning to rebound, businesses continue to tread cautiously when it comes to their online advertising operations and click fraud is a big reason why.  We’ve heard instances of advertisers being charged extra for multiple clicks from the same web user in certain cases, which is just one example of how damaging and unfair the wrong kind of advertising activity can be to retailers and other web marketers.  As always, we strongly recommend that you do your research before embarking on an online advertising campaign.  Once you have a campaign going, we also suggest parsing the clicks and data from your traffic server logs yourself instead of relying on the third parties you’re advertising with who may offer tracking software or tools as part of their packages.

We’ll keep tabs on click fraud data and cyber security news as it arises.  Leave us your thoughts and comments below.

Read Full Post »

Older Posts »

Follow

Get every new post delivered to your Inbox.

%d bloggers like this: