The Underground Economy of Fake Antivirus Software
The Underground Economy of Fake Antivirus Software
复制标题
DOI：
10.1007/978-1-4614-1981-5_4
复制
发表时间：
2011-06
期刊：
影响因子：
--
通讯作者：
Brett Stone-Gross;Ryan Abman;R. Kemmerer;Christopher Krügel;D. Steigerwald
中科院分区：
文献类型：
--
作者：
Brett Stone-Gross;Ryan Abman;R. Kemmerer;Christopher Krügel;D. Steigerwald
假冒防病毒 (AV) 程序已被用来欺骗数百万计算机用户，让其支付高达一百美元的费用来购买假冒软件许可证。结果，假冒反病毒软件已演变成互联网上最有利可图的犯罪活动之一。在本文中，我们研究了三个大规模假冒 AV 企业的运营情况，持续时间从三个月到两年多。更准确地说，我们展示了对从网络犯罪分子用来推动诈骗活动的多个后端服务器获得的大量数据的分析结果。我们的调查显示，这三个假冒 AV 企业的总收入超过 1.3 亿美元。我们分析的一个特别重点是该骗局的金融和经济方面，其中涉及合法的信用卡网络以及更可疑的支付处理商。特别是，我们提出了一个经济模型，表明假冒反病毒公司正在积极监控客户向信用卡提供商要求的退款（退款）。当退款数量在短时间内增加时，假冒 AV 公司会通过给予更多退款来应对客户投诉。这降低了退款率，并确保假冒AV公司能够长期生存。9pc]第一作者已被视为通讯作者。请检查。然而，这种行为也会导致异常的退款模式，警惕的支付处理商和信用卡公司可能会利用这种模式来识别和禁止欺诈公司。
Fake antivirus (AV) programs have been utilized to defraud millions of computer users into paying as much as one hundred dollars for a phony software license. As a result, fake AV software has evolved into one of the most lucrative criminal operations on the Internet. In this paper, we examine the operations of three large-scale fake AV businesses, lasting from three months to more than two years. More precisely, we present the results of our analysis on a trove of data obtained from several backend servers that the cybercriminals used to drive their scam operations. Our investigations reveal that these three fake AV businesses had earned a combined revenue of more than $130 million dollars. A particular focus of our analysis is on the financial and economic aspects of the scam, which involves legitimate credit card networks as well as more dubious payment processors. In particular, we present an economic model that demonstrates that fake AV companies are actively monitoring the refunds (chargebacks) that customers demand from their credit card providers. When the number of chargebacks increases in a short interval, the fake AV companies react to customer complaints by granting more refunds. This lowers the rate of chargebacks and ensures that a fake AV company can stay in business for a longer period of time.9pc]First author has been considered as the corresponding author. Please check. However, this behavior also leads to unusual patterns in chargebacks, which can potentially be leveraged by vigilant payment processors and credit card companies to identify and ban fraudulent firms.