Fake Anti Virus Software: A New Business Model Emerges

Researchers from the Departments of Computer Science and Economics of the University of California (Santa Barbara) have recently released the results of their yearlong investigation into three fake anti virus companies (named Fake AV1, AV2 and AV3). They were able to infiltrate and monitor the backend servers of the three companies, all of which were controlled by East European cybercriminals. Summarised daily and yearly sales figures below.

	Total Sales per Day (USD)	Total Sales per Year (USD)	Infection¹ rate (no. users per day)	Infection¹ rate (no. users per year)	Purchase² rate (no. users per day)	Purchase² rate (no. users per year)	Average Selling Price (USD)	Conversion Rate³
Fake AV1	$123,288	$45,000,000	92,055	33,600,000	2,209	806,400	$55.80	2.4%
Fake AV2	$10,411	$3,800,000	13,562	4,950,000	285	103,950	$36.55	2.1%
Fake AV3	$132,603	$48,400,000	100,055	36,520,000	2,201	803,440	$60.24	2.2%
Total	$266,302	$97,200,000	205,672	75,070,000	4,695	1,713,790	$56.71	2.3%

Source: Extrapolation of data contained in the UCSB research report over both a yearly and daily basis.
¹ Infection refers to users who have installed the Fake Anti Virus software trial, but not necessarily purchased it.
² Purchase refers to users who have both installed the Fake Anti Virus software trial, and then purchased a license for it.
³ Conversion Rate refers to the number of purchases as a percentage of the number of infections.

They uncovered a sophisticated method of flying under the radar of credit card fraud detection by minimising chargebacks (credit card refunds) which in turn meant that no suspicion would be raised by the victim's bank or credit card company. They did this simply by maintaining a 24/7 support hotline, thereby keeping a track of the customer's suspicions, and when necessary, issuing refunds directly back to the customer. Fewer than 10% of all victims asked for a refund, meaning that the cybercriminals could issue a full refund to all complainants, and still make massive profits. But in fact the criminals only issued enough refunds to keep their chargeback ratio under the suspicious limit (such as 3%) thereby squeezing the maximum amount of cash from their victims.

The flow of money in the Fake Anti Virus Business Model

The researchers were able to follow the money trail from the victim, on to the payment processing company, which happened to be exclusively ChronoPay, on to rouge merchant accounts at banks in Europe and Asia. From these merchant accounts, money was transferred back to the Fake AV affiliate members exclusively via a virtual electronic currency called WebMoney. The affiliate members, who provide the original victim's computer details to the controlling gang, are very highly rewarded, taking in anywhere from 30% to 80% commission on sales. The most successful affiliate was able to bank approx. US$30,000 per day from Fake AV1.

A typical Fake Anti Virus popup that leads to the initial infection

Follow @dodgy_coder

Subscribe to posts via RSS

Anti Virus Software Rankings

One of the essential pieces of software to install on any Windows PC is anti-virus software. Below find the ranked results of the latest independent tests from AV-Test.org ...

Ranking	Product Name	Protection	Repair	Usability	Total
1	BitDefender: Internet Security Suite 2011	6	4	5.5	15.5
2	F-Secure: Internet Security 2011	5.5	4.5	5.5	15.5
3	Symantec: Norton Internet Security 2011	5.5	5	4.5	15
4	Kaspersky: Internet Security 2011	5.5	4.5	4	14
5	G Data: Internet Security 2011	5	4	5	14
6	Panda: Internet Security 2011	5	4.5	4.5	14
7	AVG: Internet Security 10.0	5	4	4.5	13.5
8	Sophos: Endpoint Security and Control 9.5	4	4	5	13
9	Webroot: Internet Security Complete 7.0	4.5	5	3	12.5
10	Trend Micro: Titanium Internet Security 2011	3.5	3.5	5.5	12.5
11	Eset: Smart Security 4.2	3	4	5.5	12.5
12	Sunbelt: Vipre Antivirus Premium 4.0	3	5	4	12
13	Avira: Premium Security Suite 10.0	4	3.5	4	11.5
14	Avast: Free AntiVirus 5.0 and 6.0	3.5	2.5	5.5	11.5
15	MicroWorld: eScan Internet Security Suite 11.0	3.5	3	5	11.5
16	Microsoft: Security Essentials 2.0	2.5	3.5	5.5	11.5
17	BullGuard: Internet Security 10.0	5.5	2	3.5	11
18	Comodo: Internet Security Premium 5.0 and 5.3	4	3	3.5	10.5
19	PC Tools: Internet Security 2011	4	3.5	3	10.5
21	CA: Internet Security Suite 2011	2	3.5	4	9.5
20	McAfee: Total Protection 2011	3	2	3.5	8.5
22	Norman: Security Suite Pro 8.0	3	3	2.5	8.5

Above tests were carried out between January and March, 2011.

Each score is out of 6 so the maximum total score for a product is 18. Interestingly, the AV-Test.org people determine that a score of at least 11 is needed to pass their test, in other words the bottom 5 products here have failed and so could not be recommended, ouch!