ZLOB Enters The Search Engine Market

More than a year ago, Trend Micro threat researchers uncovered a network of over 900 rogue DNS (Domain Name System) servers related to the ZLOB Trojan family. We gave examples showing that these rogue DNS servers are part of click fraud and leakage of personal information.

Just recently, however, we discovered that this network is now targeting four of the most popular search engines. In a large scale click fraud scheme, the ZLOB gang appears to hijack search results and to replace sponsored links with DNS “tricks”.

DNS is essential for the Internet to work. DNS servers translate domain names into IP addresses (and vice versa), which are assigned to computers connected to the Internet. This translation into IP addresses makes it possible for browsers to load Web sites from the correct computers. Most Internet users automatically use the DNS servers of their ISPs (Internet Service Providers), and implicitly trust that these DNS servers give back correct results. In the event that DNS settings get changed to point to a fraudulent or malicious server, the victim may be unknowingly redirected to any (potentially malicious) computer server at anytime while browsing the Internet.

These ZLOB Trojans we found, silently change the local DNS settings of affected systems to use two out of the abovementioned 900+ rogue DNS servers. These Trojans spread by advanced social engineering tricks; an example would be professional-looking Web sites that promise Internet users access to pornographic movies after installing malware that pose as video codecs. The number of ZLOB-related infections is huge — for the last six months of 2007, Microsoft reported more than 14,000,000 infections.