Symantec: Rogue Security Software is Big Business for Crooks
The bogus ads are everywhere. A pop-up tells you: "Your computer may be infected" and urges you to download security software that will scan your computer for viruses, protect it from future infection or both. The problem is most of these products are scams that give you software which is useless. In some cases, the software is even dangerous because it downloads malicious code onto your computer.
The threat from these "scareware" tactics is growing, according to the results of a report released Monday by Symantec Corp. The Report on Rogue Security Software reveals that cybercriminals are profiting from a highly organized affiliate-based business model that rewards scammers for selling bogus security programs to users caught off-guard by persuasive online scare tactics.
Read how the New York Times fell prey to one of these scams earlier this year.
In research conducted from July, 2008 until June, 2009, Symantec detected more than 250 distinct rogue security software programs. The top five reported rogue security applications are SpywareGuard 2008, AntiVirus 2008, AntiVirus 2009, SpywareSecure, and XP AntiVirus, according to the report.
The research finds the creators of rogue security software typically use an affiliate-based, pay-per-install model to distribute their misleading applications. Through this model, affiliates can earn between $0.01 and $0.55 for every successful installation. The highest prices are paid for installations by users in the U.S. first, followed by the U.K., Canada, and Australia, said Symantec.
To increase the likelihood of duping users, rogue security software creators design their programs so that they appear as credible as possible, utilizing advertisements, pop-up windows, and notification icons that mimic legitimate security software programs. In addition, these programs are often distributed on websites that appear credible and enable the user to download the illegitimate software. Some malicious sites actually use legitimate online payment services to process credit card transactions and others return an email message to the victim with a receipt for purchase; complete with serial number and customer service number.
Symantec officials said the estimated purchase price for consumers who download these rogue products ranges from $30 to $100.
"Not only can these rogue security programs cheat the user out of money, but the personal details and credit card information provided during the purchase can be used in additional fraud or sold on black market forums," according to a release from Symantec. "Scammers may also use the personal information gained from the victim to commit fraud and/or identity theft."
Some rogue security software actually installs malicious code that puts the user at risk of attack from additional threats.
"Installing these programs can lower the security posture of a computer while claiming to strengthen it," said Symantec. "For example, they may instruct the user to lower or disable any existing security settings while registering the bogus software or prevent the user from accessing legitimate security websites after installation. This, in turn, leaves users exposed to the very threats the rogue software promised to protect against."
CSO
Sign up for ITworld's Daily newsletter
Follow ITworld on Twitter @IT_world
On Twitter now
scareware
Powered by Twitter
Esther Schindler
If the comments are ugly, the code is ugly
claird
SVG a graphics format for 21st century
pasmith
Take Chrome OS for a test spin
Sandra Henry-Stocker
Solaris Tip: Have Your Files Changed Since Installation?
jfruh
Android fragments vs. the iPhone monolith
mikelgan
What Gizmodo missed about the Pro WX Wireless USB disk drive
Sidekick: The Good News & the Bad News
Either way you look at it Microsoft Data Center management did not follow standards or best practices in this failure. In which case it makes me wonder more about the outsourcing of corporate data much less personal data.
- mburton325
Join the conversation here
Quick, practical advice for IT pros. Made fresh daily.
Want to cash in on your IT savvy? Send your tip to tips@itworld.com. If we post it, we'll send you a $25 Amazon e-gift card.













