Symantec finds rogue AV to be well-oiled profit machine

An examination into the rogue anti-virus marketplace has revealed a well-organised racket that resembles the adware and spyware industry of several years ago.

A year-long study by Symantec researchers, released this week and titled "Report on Rogue Security Software", concluded that the success of fake anti-virus software (also known as 'scareware') is fueled by an affiliate model that earns them between one and 55 US cents per successful installation.The highest fees are paid if victims come from the United States, UK, or Canada.

These affiliates advertise the bogus solutions through websites, legitimate or malicious, or through advertisements, according to the report. Often, the scammers "poison" search results so that their sites appear near the top of search results for popular terms.

Meanwhile, the scareware creators earn between $US30 and $US100 from victims who agree to pay for the software in hopes of resolving fake claims that their PCs are infected, the report said.

By all accounts, rogue AV makers, master affiliates -- such as TrafficConverter.biz, which served as major rogue AV distribution point until being dismantled earlier this year -- and their individual affiliates are earning quite a bit of money, Vincent Weafer, vice president of Symantec Security Response, told SCMagazineUS.com.

According to data garnered from Symantec customers over the last financial year, there were 250 distinct families of rogue security programs, resulting in 43 million attempted downloads. The most common counterfeit applications carry legitimate-sounding names, such as SpywareGuard 2008, AntiVirus 2008, AntiVirus 2009, SpywareSecure, and XP AntiVirus.

Weafer said the rogue AV market has become a global enterprise, drawing many parallels to the adware/spyware markets in which there is a well-organised distribution model that features a number of players.

"It's the gift that keeps on giving," he said. "It's just very effective, if you go out and scare people. The message that 'you're infected and you need to take care of it' now seems to get a lot of people."

Weafer added that the danger to victims is not only that the rogue AV maker steals their credit card information when they purchase the fake product. By installing the program, the criminal also gains control over that victim's PC, allowing him to install additional malware at any time.

Users should be careful to avoid tricks in which "someone is screaming at you that you're infected," Weafer said.

He said authorities must increase their enforcement of rogue AV operations.

"Follow the money," Weafer said. "If you can disrupt their money supply, it makes it less attractive."

See original article on scmagazineus.com