Botnet Chameleon
Huge Botnet Steals from Advertisers
Thursday, March 21, 2013 @ 04:03 PM gHale
A massive botnet that emulates human visitors is earning its creator over $6
million per month from online advertisers, researchers said.
Called Chameleon, the botnet has more than 120,000 hosts located in the U.S.,
running Microsoft Windows and accessing the Web through a Flash-enabled
Trident-based browser that executes JavaScript, said researchers at Web traffic
analytics firm spider.io.
RELATED STORIES
Ramnit Malware Back, Better
Born Again Botnet Much Stronger
Life of a Botnet: Growth in Spurts
Botnet Thriving after Six Years
“Chameleon is a sophisticated botnet,” the researchers said. “Bots generate
click traces indicative of normal users. Bots also generate client-side events
indicative of normal user engagement. They click on ad impressions with an
average click-through rate of 0.02 percent; and they surprisingly generate mouse
traces across 11 percent of ad impressions.”
The company has been tracking the botnet since last December, searching for
specific patterns typical of this bot activity, such as crashing and restarting
regularly, targeting a specific cluster of 202 websites, simulating the
visitation of a number of web pages across a number of websites.
Apart from its obvious sophistication, the botnet is also notable for the amount
of money it generates for its master, and for being the first one spotted to
affect display ad advertisers instead of text link ones.
Every month the botnet has been serving at least 14 billion ad impressions,
using at least 7 million distinct ad-exchange cookies, exchanged after each bot
crash.
“Despite the sophistication of each individual bot at the micro level, the
traffic generated by the botnet in aggregate is highly homogenous,” the
researchers said. “All the bot browsers report themselves as being Internet
Explorer 9.0 running on Windows 7. The bots visit the same set of websites, with
little variation. The bots generate uniformly random click co-ordinates across
ad impressions and the bots also generate randomized mouse traces.”
Spider.io compiled a blacklist of 5000 IP addresses of the worst bots
participating in the Chameleon botnet.
