Flashback 'hijacked' Google keyword searches

Apple logo outside store Macs were hit hard by the Flashback Trojan

Related Stories

The Flashback Trojan that infected Apple Mac computers could have made more than $10,000 (£6,200) a day for its creators, suggests research.

Analysis of the malicious software by security firm Symantec showed it was built to hijack Google searches.

On infected machines the malware watched for specific keywords.

When they were spotted, the Trojan re-directed users to sites that its creators were being paid to funnel people towards.

In early April, it was revealed that up to 500,000 Apple Mac computers had been infected by malicious software called Flashback.

The malware targeted a vulnerability in the Java software that is used in Windows machines, Apple computers and many others.

Macs were the biggest victims because Apple did not patch the loophole in its version of Java for several weeks after the vulnerability became known.

Twitter used

The Symantec analysis has revealed why the malware was created and how much cash it might have generated for its creators.

By reverse engineering the software, Symantec has discovered that it lurked on infected machines waiting until a user searched on Google for certain words such as "toys".

If a user clicked on an advert related to that search, they would never reach the site they wanted but were re-directed to others showing ads and links.

Symantec engineers found that Flashback's creators would be paid 0.008 cents every time a user was re-directed. Other malicious programs that managed to infect 25,000 victims have been seen to generate about $450 per day for their creators.

"Considering the Flashback Trojan measures in the hundreds of thousands, this figure could sharply rise to the order of $10,000 per day," wrote the Symantec researchers.

Further analysis of Flashback by Russian security firm Dr Web, which sounded the alarm about the malware, has revealed how it was controlled.

Its creators seem to have used Twitter as the command-and-control system for the huge number of machines that it infected.

Compromised machines were programmed to regularly search Twitter for messages containing particular strings of letters. These would direct infected machines to visit particular websites to get updates or receive further instructions.

More on This Story

Related Stories

The BBC is not responsible for the content of external Internet sites

More Technology stories


Features & Analysis

BBC Future

(US Navy)

The world’s noisiest spy plane

The Soviet giant that still soldiers on


  • A bicycle with a Copenhagen WheelClick Watch

    The wheel giving push bikes an extra boost by turning them into smart electric hybrids

Try our new site and tell us what you think. Learn more
Take me there

Copyright © 2015 BBC. The BBC is not responsible for the content of external sites. Read more.

This page is best viewed in an up-to-date web browser with style sheets (CSS) enabled. While you will be able to view the content of this page in your current browser, you will not be able to get the full visual experience. Please consider upgrading your browser software or enabling style sheets (CSS) if you are able to do so.