Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

Guest Blog // Selected Security Content Provided By Sophos
What's This?
11/16/2009
06:08 AM
Graham Cluley
Graham Cluley
Security Insights
50%
50%

Promoting Fake Pharmaceutical Websites Pays Big Bucks

Is it any wonder that the criminal underground is embracing the Internet? The fortunes to be made through spam and search-engine poisoning are enormous.

Is it any wonder that the criminal underground is embracing the Internet? The fortunes to be made through spam and search-engine poisoning are enormous.Research published by Sophos today reveals the workings of secretive Russian crime networks who have created complex Webs of affiliates promoting Websites selling fake pharmaceuticals.

Naughty nurse Viagra spam

We're all familiar with spam email like the one shown above -- a sexily dressed nurse (somehow I doubt she's medically qualified) is encouraging you to buy Viagra and Cialis from her online store.

What is less well-known is that many of these email messages are not sent by the store itself, but by a network of commission-earning affiliates (known as the "Partnerka"), who use compromised botnet PCs, search engine optimization, and social networks to advertise their links.

And every time you buy goods via a site like this, they earn 40% of the proceeds.

In the past, some of the Partnerka affiliates have even held parties -- posting pictures and videos on the Web as they party the night away with fast cars and strippers.

I'll spare you those pictures, but here's a snapshot of a familiar young lady on a banner at just one such event:

Naughty nurse party banner

Affiliates to the Partnerka pharmaceutical Websites earn on average $16,000 per day -- that's almost $16 million a year. And if that figure is making your eyes pop out, then realize this: Some of the bad guys boast they are making a breathtaking $100,000 a day.

What's been interesting this year is that we've seen many of the spammers switch from focusing their main attention on folks seeking Cialis and Viagra to promote Tamiflu instead.

As fears rise about a Swine Flu outbreak, many people have turned to the Net hoping to find medications. As you can see in the following graph, panic can cause "Tamiflu" to rise in popularity on search engines:

Tamiflu global search volume

Searching on the Internet for drugs like this is, of course, plays straight into the hands of the cybercriminals. They are creating Websites that claim they will sell you the medication you are after -- but what guarantee do you have that the drugs will be safe? And given these guys have already proved themselves capable of criminal acts, such as spam and malware infection, do you really want to trust them with your credit card details?

If you're worried about Swine Flu, don't seek medication on the Internet. You'll only be encouraging spammers and criminal gangs to spread their misery even further.

Find out more about how the Partnerka works on the Sophos Website.

Graham Cluley is senior technology consultant at Sophos, and has been working in the computer security field since the early 1990s. When he's not updating his other blog on the Sophos website, you can find him on Twitter at @gcluley. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
GitHub Named in Capital One Breach Lawsuit
Dark Reading Staff 8/14/2019
The Mainframe Is Seeing a Resurgence. Is Security Keeping Pace?
Ray Overby, Co-Founder & President at Key Resources, Inc.,  8/15/2019
The Flaw in Vulnerability Management: It's Time to Get Real
Jim Souders, Chief Executive Officer at Adaptiva,  8/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5034
PUBLISHED: 2019-08-20
An exploitable information disclosure vulnerability exists in the Weave Legacy Pairing functionality of Nest Cam IQ Indoor version 4620002. A set of specially crafted weave packets can cause an out of bounds read, resulting in information disclosure. An attacker can send packets to trigger this vuln...
CVE-2019-5035
PUBLISHED: 2019-08-20
An exploitable information disclosure vulnerability exists in the Weave PASE pairing functionality of the Nest Cam IQ Indoor, version 4620002. A set of specially crafted weave packets can brute force a pairing code, resulting in greater Weave access and potentially full device control. An attacker c...
CVE-2019-5036
PUBLISHED: 2019-08-20
An exploitable denial-of-service vulnerability exists in the Weave error reporting functionality of the Nest Cam IQ Indoor, version 4620002. A specially crafted weave packets can cause an arbitrary Weave Exchange Session to close, resulting in a denial of service. An attacker can send a specially cr...
CVE-2019-8103
PUBLISHED: 2019-08-20
Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation ...
CVE-2019-8104
PUBLISHED: 2019-08-20
Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation ...