Last night the Google AdWords blog announced a paper they published named The Anatomy of Clickbot.A. The paper was rewritten by Neil Daswani, Michael Stoppelman, and the Google Click Quality and Security Teams. Here is the abstract:
This paper provides a detailed case study of the architecture of the Clickbot.A botnet that attempted a low-noise click fraud attack against syndicated search engines. The botnet of over 100,000 machines was controlled using a HTTP-based botmaster. Google identified all clicks on its ads exhibiting Clickbot.A-like patterns and marked them as invalid. We disclose the re- sults of our investigation of this botnet to educate the security research community and provide information regarding the novelties of the attack.
Related Topics: Legal: Clickfraud
“The Clickbot.A botnet was first publicly reported by Swa
Frantzen, an incident handler at SANS [4], in mid-May 2006.
At the time, based on a screenshot of the botmaster administration
console obtained by Frantzen (similar to the one shown
in Figure 2), the bot client was believed to have been running
on just over 100 machines. Frantzen was able to obtain access
to the botmaster administration console because it was not protected
by a password, HTTP authentication, or IP whitelisting.”
I was anticipating a far more exciting discovery.
It’s a good start but there is a lot more out there and they really need to demonstrate that they have a handle on this.