IT Security: HTTPS hijacking click-fraud botnet infects almost 1 million computers

Share This

The malware replaces search results with ones from an affiliate program.

Over the past two years, a group of cybercriminals has infected almost 1 million computers with malware that hijacks search results, even when they’re served over encrypted HTTPS connections.

he click-fraud botnet earns its creators money through Google’s AdSense for Search program, according to researchers from security firm Bitdefender. The affiliate program, intended for website owners, allows them to place a Google-powered custom search engine on their websites to generate revenue when users click on ads displayed in the search results.

nstead of doing that, this botnet’s operators intercept Google, Bing, and Yahoo searches performed by users on their own computers and replace the legitimate results with those generated by their custom search engine. They do this using a malware program that Bitdefender products detect as Redirector.Paco.

Since mid-September 2014, Redirector.Paco has infected more than 900,000 computers worldwide, mainly from India, Malaysia, Greece, the U.S., Italy, Pakistan, Brazil, and Algeria.

The malware is included in modified installers for well-known programs, such as WinRAR, Connectify, YouTube Downloader, Stardock Start8, and KMSPico, which are distributed on the Internet. Once installed on a computer, Redirector.Paco modifies its Internet Settings to use a Web proxy server specified by the attackers in a PAC (Proxy auto-config) file.

There are two variants of the malware: one where the PAC file and proxy are hosted on a remote server and one where they are hosted on the local computer. In both cases, the malware installs a self-generated root certificate in the computer’s certificate store in order to generate rogue certificates for Google, Yahoo, and Bing that would be accepted by the victim’s browser.

This is essentially a man-in-the-middle attack. The proxy establishes a connection with the real search engine, replaces the results with those from the attackers’ custom search engine, re-encrypts the page with a self-generated SSL certificate for the domain name, and then serves it to the user’s browser. The domain certificate is signed by the now trusted rogue root certificate installed on the computer, so it is accepted without errors.

For the version where the PAC file and proxy are stored on a remote server, this whole process introduces a noticeable delay and the user will often see messages like “waiting for proxy tunnel” or “downloading proxy script” in the browser’s status bar.

The other version, which is written in .NET, installs the man-in-the-middle proxy server locally on the computer, so its impact on the browsing experience is not as noticeable. The HTTPS interception functionality is provided by a third-party .NET library called FiddlerCore.

This means other attackers can’t extract the certificate’s private key from one infected computer and then use it to launch man-in-the-middle attacks against all users affected by the malware.