Cent, five cent, ten cent, dollar: hitting botnets where it really hurts

ABSTRACT

Spyware, Adware, Bots. In each case, there is significant evidence that there is an increasing financial motivation behind the writing and distribution of these programs. In this paper, the concept of using our knowledge of these financial motivators to combat malicious software is introduced. Can attacks on business models actually provide relief that technology alone cannot? Can we deploy our technology differently, in order to receive direct benefits of this indirect attack on revenue streams? Our conclusion is that not only is this a possible solution, but that it may be an extremely effective one. This is illustrated by a description of our business model attack generator, MARK - the Multihost Adware Revenue Killer. Using MARK, we demonstrate simple but effective attacks against Malicious-code generated revenue streams. However, the creation and deployment of MARK raises thorny legal and ethical questions, as the impact of the technology is widespread and could easily be targeted at legitimate online marketing models. Do the ends justify the means?

REFERENCES

• 1: Frederick B. Cohen , Dr Frederick Cohen, A Short Course on Computer Viruses, John Wiley & Sons, Inc., New York, NY, 1994
• 2: Doubleclick. Doubleclick: Digital advertising, 2006. Downloaded April 2006 from http://www.doubleclick.com/us/.
• 3: R. Ford, M. Wagner, and J. Michalske. Gatekeeper II: New approaches to generic virus prevention. In Proceedings of the 14^th International Virus Bulletin Conference, Chicago, IL, 2004. Virus Bulletin.
• 4: S. Gordon. The generic virus writer II. In Proceedings of the 6^th International Virus Bulletin Conference, Brighton, UK, 1996. Virus Bulletin.
• 5: Nir Kshetri, The Simple Economics of Cybercrimes, IEEE Security and Privacy, v.4 n.1, p.33, January 2006 [doi>10.1109/MSP.2006.27]
• 6: C. C. Mann. How click fraud could swallow the Internet. Wired, 14.01, 2006.
• 7: Bill McCarty, Botnets: Big and Bigger, IEEE Security and Privacy, v.1 n.4, p.87-90, July 2003 [doi>10.1109/MSECP.2003.1219079]
• 8: David Moore , Vern Paxson , Stefan Savage , Colleen Shannon , Stuart Staniford , Nicholas Weaver, Inside the Slammer Worm, IEEE Security and Privacy, v.1 n.4, p.33-39, July 2003 [doi>10.1109/MSECP.2003.1219056]
• 9: A. Moshchuk, T. Bragin, S. D. Gribble, and H. M. Levy. A crawler-based study of Spyware on the Web. In Proceedings of the 13^th Annual Network and Distributed System Security Symposium, San Diego, CA, 2006. (NDSS 2006).
• 10: Peter Szor, The Art of Computer Virus Research and Defense, Addison-Wesley Professional, 2005

INDEX TERMS

Primary Classification:
  C. Computer Systems Organization
  C.2 COMPUTER-COMMUNICATION NETWORKS
      C.2.0 General
          Subjects: Security and protection (e.g., firewalls)

Keywords:
adware, business models, malicious code, spyware, virus, worm