I want to reveal with you some of the findings that Asier Martinez and I made yesterday whilst investigating the BHSEO assault about the Icelandic Volcano and every one of the flight mess in Europe. As I explained yesterday, whenever you click among the malicious back links in the search consequence, you’ll get to the rogueware site. But what is your browser really doing? Well, this is the script that your browser executes:
As you can see, first it checks whether you are running Mac. If that’s your case, you will be redirected to a movie site, of course there’s a referral in the link, so they can get some extra cash. Otherwise it will check whether you are running Firefox, Chrome or other browser. This can be used to serve a different exploit depending on the victim’s system, even though in this case every one of the redirections will take you to the ######## av site shown in yesterday’s blog post. So if you are running Windows or Linux you will get the ######## av,
Office 2007 Keygen, but in Mac you could buy some movies…
Why are this pages in the top results? Well, lookup engines use different methods to decide which are the top positions,
Office 2010 Pro Key, and criminals try to abuse these systems. The next question that will come to your minds is: ok,
Windows 7 Home Premium, so Google, Yahoo & Microsoft are so stupid that they cannot realize that a web page is serving a ######## av? Well,
Windows 7 Home Basic Key, they can, and as soon as they realize they’ll try to block or mark that page as malicious. Anyway, they don’t see the problem on a first moment, and there is a good reason for that: criminals know, for example, when Google bot is accessing their page. In that case, they will show a web site that does not serve rogueware or any other malware.
In fact, if you type the malicious URL in your browser,
Office 2010 Serial, you don’t get to the ######## av site. This is not big news, the criminals are usually doing that, as they know that users will use Google and click on on any of your given results. And what kind of websites are the search engines indexing? Well, you can take a look at the following screenshots I took yesterday:
How are these web sites being created? They are created automatically using information obtained from the very same search engines