427 Botnet fm qxd

www.syngress.com
68
Chapter 2 • Botnets Overview
427_Botnet_02.qxd 1/9/07 9:49 AM Page 68

---

by Security activist Ben Edelman, major adware/spyware companies are in
retreat. DirectRevenue is down to a couple of dozen employees and has lost
many of their largest accounts.
The botherder is well positioned to conduct click fraud attacks against
advertisers and adware companies that pay commissions for affiliates to drive
customers to advertising clients’ Web sites. Business offerings like the Google
Adsense program do not advertise their algorithm for paying click commis-
sions but they do pay, or actually, Google advertising customers have the
option of paying, for this service. Google employs an algorithm to try to
detect click fraud. Google tells its customers that they are not charged for
fraudulent clicks but there is no way to gauge the effectiveness of their fraud
detection efforts.
Ransomware
In an online article titled “Script Kiddies Killing The Margins In Online
Extortion,” published in the online magazine 
TechDirt Corporate Intelligence
(www.techdirt.com), the author (who goes by Mike) claims that the going
rate to decrypt online ransoms of files has been between $50 and$100.The
Zippo ransomware Trojan demanded $300 be paid to an e-gold account for
the password to decrypt ransomed files.The codebreakers at Sophos deter-
mined the password was:
C:\Program Files\Microsoft Visual Studio\VC98
The Arhiveus ransomware Trojan encrypts all of the files in the My
Documents folder with a 30-character password. Sophos has determined this
password to be:
mf2lro8sw03ufvnsq034jfowr18f3cszc20vmw 
Without the password, victims were forced to make a purchase from one of
three online drug stores.
The Ransom A Trojan is a budget ransomware package. It encrypts the
user’s data, and then instructs the user to wire $10.99 to a Western Union
CIDN. Once the CIDN number is entered in the ransomware, the software
promises to remove itself and restore access to the data.