Cyber Crime and Cyber Terrorism

FIGURE 17.9
The money theft.

---

248
CHAPTER 17
Responding to cyber crime and cyber terrorism
The bot then retrieves a new list of advertisements from ZeroAccess’s command 
and control (C&C) server every day. The ZeroAccess botnet reportedly clicks 140 
million ads a day. As this is essentially click fraud, it has been estimated that the bot-
net is costing up to USD 900,000 of daily revenue loss to legitimate online advertis-
ers. Click fraud has been on the rise as the online advertisement vendors realistically 
have no way to differentiate between a legitimate click and a fraudulent one.
ZeroAccess is one of today’s most notable botnets. It was first discovered by 
researchers back in 2010, when it drew a lot of attention for its capability for termi-
nating all processes related to security tools, including those belonging to antivirus 
products. When too many researchers focused on this self-protection capability how-
ever, ZeroAccess’s authors decided to drop the feature and focus more on improving 
its custom peer-to-peer (P2P) network protocol, which is unique to ZeroAccess. Four 
distinct variants have been observed (
Neville and Gibb, 2013
) (
Figure 17.10
):
After the change, ZeroAccess became easier to spot by antivirus products, yet 
it continued to spread like wildfire around the world due to the improved P2P tech-
nique. This success can be largely attributed to its affiliate program, a well-known 
marketing strategy widely used by many e-commerce websites. Essentially, a busi-
ness owner with an e-commerce site can promote commissions to other site owners 
to help drive customers to it (and hopefully eventually make a purchase). The website 
owners are then compensated for providing these customer leads.
Adopting this concept, ZeroAccess’ author or operator(s) has managed to dis-
tribute the program to a large number of machines with the help of its enlisted part-
ners. The ZeroAccess team advertises the malware installer in Russian underground 
forums, actively looking for distributor partners. Their objective was to seek other 
cybercriminals who are more capable in distributing the malware and do so more ef-
ficiently. The malware distributors generally consist of experienced affiliates, each of