The US FBI and the Estonian police have disabled a botnet of more than 4m infected PCs as part of “Operation Ghost Click”, in which six Estonians and one Russian have been charged with a number of cybercrime offences relating to fake adverts and misdirected web links.
People trying to get to the US Internal Revenue Service and to Apple’s iTunes store would instead be redirected to fake sites, and normal web pages would be served ads via the botnet instead of the proper advertisers.
The scam, begun in 2007, earned about $14m (£8.7m) and infected computers in more than 100 countries with malware called “DNSChanger” which would alter the DNS settings on the machine so that requests to visit particular sites would instead be redirected to others serving ads from the criminals’ partners. Both Windows PCs and Apple Macintosh machines could be affected.
Users of infected machines who searched for Apple’s iTunes store and clicked on the link at the top of a search page to “iTunes.apple.com” would instead be directed to “www.idownload-store-music.com”, which purported to be selling Apple software. People trying to reach the US IRS page were redirected to a page for H&R Block, a US tax preparation company. The suspects allegedly received a fee for each visitor to the H&R Block site.
The scammers set up a fake internet advertising agency which contacted online advertisers and extracted a commission for every click on their ads or visit to their website.
Six Estonians were arrested on Tuesday, Manhattan US attorney Preet Bharara said, while the seventh person, a Russian citizen, remains at large. Each of the accused faces five criminal charges including conspiracy to commit wire fraud and computer intrusion, which in the US carries a maximum 30-year prison sentence.
One defendant faces an additional 22 money laundering counts. (Wired has a link to the 62-page indictment in PDF form.)
The US space agency Nasa was the first to discover the malware: about 130 of the 500,000-odd infected machines in the US belonged to Nasa, said Paul Martin, the US space agency’s inspector general, speaking to reporters.
In a blog post about the indictment and takedown, Feike Hacquebord of the security company Trend Micro says:
The cybercrime group that was controlling every step from infection with Trojans to monetizing the infected bots was an Estonian company known as Rove Digital. Rove Digital is the mother company of many other companies like Esthost, Estdomains, Cernel, UkrTelegroup and many less well known shell companies. Rove Digital is a seemingly legitimate IT company based in Tartu with an office where people work every morning. In reality, the Tartu office is steering millions of compromised hosts all over the world and making millions in ill-gained profits from the bots every year.”
Esthost, a reseller of webhosting services, was in the news in the fall of 2008 when it went offline at the time its provider Atrivo in San Francisco was forced to go offline by actions of private parties. Around the same time a domain registrar company of Rove Digital, called Estdomains, lost its accreditation from ICANN because the owner, Vladimir Tsastsin, was convicted of credit card fraud in his home country, Estonia.
These actions were the result of public pressure that arose from the suspicion that Esthost was mainly serving criminal customers. Rove Digital was forced to stop the hosting services offered by Esthost, but it continued with its criminal activities. In fact those behind Rove Digital learned their lesson, and they spread the C&C infrastructure all over the world and moved a great deal of the servers previously hosted at Atrivo to the Pilosoft datacenter in New York City where they already had some servers running.
As part of the investigation, Trend Micro says it discovered the public SSH keys of a number of Rove Digital employees on copies of hard drives used for command and control (C&C) of the botnet that it obtained in 2009.
“All of our findings indicate that Rove Digital is committing cybercrimes on a large scale indeed and is directly responsible for the large DNS Changer botnet,” noted Hacquebord.
“With that, we are very happy to report that a close collaboration between the FBI, Estonian police, Trend Micro and other industry partners resulted in a successful takedown of a dangerous botnet. Such a collaboration also led to the arrest of the bad actors responsible for the botnet, despite the fact that the takedown of Rove Digital was complicated and took a lot of effort.
“Trend Micro successfully identified the C&C infrastructure of Rove Digital and backend infrastructure at an early stage and continued to monitor the C&C until November 8 2011. Other industry partners did a tremendous job by making sure that the takedown of the botnet happened in a controlled way, with minimal inconvenience for the infected customers.”