PDA

View Full Version : Sextracker Scandal - Pt 4


Nickatilynx
02-06-2005, 12:27 PM
Revenue Streams Undetectable to the User

Search Results Insertion

Search results from any major search engine can be replaced/ammended with your own per-per-click XML feed(s). When the user searches google he cannot tell the results are not coming from google itself.

This is not limited to 3rd party XML feeds: with the addition of commonly avaiable server-side scripts, one could display your paysite as search result #1 when a niche keyword is searched for, with the pay-per-click results following.


Affiliate income from purchases made directly via retailer's sites

For example, if the user types www.wal-mart.com in their browser, they are first redirected through your own link code for Wal-Mart's affiliate program. The user sees no difference at all.


Ability to override other webmasters' affiliate codes

Similar to the above, but this is for when the user navigates to the retailer or paysite via an affiliate link or another site. The referring URL can be forged so the real originating site does not appear in server logs.

Other Capabilities

Redirect any URL to another location
Most useful for paysite join pages, but can be used for just about anything. When the user navigates to somesite.com/join/, he can be sent to yoursite.com/join/ instead.


Custom 404/NoDNS error pages

Instead of the ErrorDocument presented by the server, the user is shown your own custom document for 404's and DNS errors, such as a portal page. This feature is currently turned off due to its extreme visibility.


"Splash" pages for any site

The user is shown a full-page ad with a "Continue" link at the bottom of the page which allows him to finish navigating to the site intended.


Splash pages based on search engine keyword

Similar to the above, but here the ad is displayed when the user searches for a specific keyword using any major search engine. In the case the Continue link leads to the actual search results.


Anti-Detection

Does not show up as an IE "Browser Helper Object" (where one usually finds run-of-the-mill malware)
In the process list, can show up as any system-sounding process you choose, such as taskmgr.exe, svchost.exe, or even explorer.exe.
Under Win9x it does not show up in the process list at all.
The file itself can reside anywhere on the hard drive, and can have the appropriate icon associated with it. For example, if one chose Program Files\Internet Explorer as the installation directory, then the .exe's icon could be Microsoft's 'e' logo.
The application does not request an internet connection at random times (so as not to alert users using software firewalls). If a connection is needed for an update, it is only done so when the user is loading a web page.
Only one registry entry is needed, and it can reside anywhere in the registry. Perhaps alongside Internet Connection Wizard's registry settings. Actually the registry entry can be omitted altogether if so desired: it is only used for detailed installation stats, which can be fairly accurately calculated using unique IPs instead.
The same redirect/override is never triggered twice in a row, so as not to prevent the user from getting where he wants to go. If the user sees something unexpected happen, he will try to load the page again and it will work properly the second time. This will cause him to think it was just a typo initially.
With judicious use of available features, there is no reason for the user to ever know it is there.

Nickatilynx
02-06-2005, 12:30 PM
Gotta be said.

It is fucking brilliant.

Almighty Colin
02-06-2005, 12:31 PM
Originally posted by Nickatilynx@Feb 6 2005, 12:31 PM
Gotta be said.

It is fucking brilliant.
Man, where do I buy some of those results?

I mean .. that's terrible!

Nickatilynx
02-06-2005, 12:32 PM
Exactly Colin. :)

Shocking!!!!!

grimm
02-06-2005, 01:13 PM
Originally posted by Nickatilynx@Feb 6 2005, 09:31 AM
Gotta be said.

It is fucking brilliant.
beat me to it, fantastic piee of software, err i mean bad spyware lol

JerryW
02-06-2005, 01:14 PM
Hmm, where did that come from? I want to get one of these babies and dissect it. Just research, of course :ph34r:

Nickatilynx
02-06-2005, 01:23 PM
Originally posted by JerryW@Feb 6 2005, 10:15 AM
Hmm, where did that come from? I want to get one of these babies and dissect it. Just research, of course :ph34r:
:ph34r:

So......

basically if you all had one , you'd use it?

:ph34r:



;-)))

Almighty Colin
02-06-2005, 01:42 PM
Originally posted by Nickatilynx+Feb 6 2005, 01:24 PM--></div><table border='0' align='center' width='95%' cellpadding='3' cellspacing='1'><tr><td>QUOTE (Nickatilynx @ Feb 6 2005, 01:24 PM)</td></tr><tr><td id='QUOTE'> <!--QuoteBegin-JerryW@Feb 6 2005, 10:15 AM
Hmm, where did that come from? I want to get one of these babies and dissect it. Just research, of course :ph34r:
:ph34r:

So......

basically if you all had one , you'd use it?

:ph34r:



;-))) [/b][/quote]
"I don't know you. Who is this? Don't come here, I'm hanging up the phone! Prank caller, prank caller!"

JerryW
02-06-2005, 01:54 PM
:scans: I'll take the fifth

EmporerEJ
02-06-2005, 02:12 PM
Wow-

I'd like to see some more detail on that.
It sounds scary, but can I see it?
I came into this thread from the back end I think....

fraggle
02-06-2005, 02:44 PM
wow got to be said that is seriously impressive

quite how they thought they wouldnt get cuaght on this is unbelievable really

$tanDaMan
02-06-2005, 03:29 PM
Software is amazing, i saw it with my own eyes :)

Opti
02-06-2005, 06:24 PM
Great Info!

but i still have 2 questions..


How Do I Get Rid Of It?

and

Could someone from Avenue Media write us a anti-trojan trojan that we can stealth install on our website visitors. One that will seek out their original malware and either disable it... or tum it into a permanent DDOS attack on FCI sites?

Mr Benn
02-07-2005, 04:45 AM
Originally posted by Nickatilynx@Feb 6 2005, 09:28 AM
Anti-Detection

Does not show up as an IE "Browser Helper Object" (where one usually finds run-of-the-mill malware)
In the process list, can show up as any system-sounding process you choose, such as taskmgr.exe, svchost.exe, or even explorer.exe.
A guy i used to work with (security consultancy) coded a nice windows backdoor a few years ago for W2K/XP that attaches itself to a currently running process and runs in its process space - so you don't even get an extra process showing up at all when you run your program :)

Anyone know if this is what the ST thing is doing, or will it show up as an extra process?

Maxime
02-07-2005, 08:07 AM
Some of the 'features' of their software is questionable. I mean, trying to find all kind of tricks to get high in SE's is normal in our world. I don't think Google is happy with the way they're doing it though.
However, most things like changing WM's aff.code on join pages is something I have bigger problems with. Those things are going way too far in my book.

Also, don't forget that their software is capable of doing way more. If things out of the specs I've seen are still in there, it's capable to be updated with new modules/features.
For example, I'm 100% sure that with their current installed base, it's very easy for them to DDos the shit out of everyone they don't like.

As for ST/FCI/Accretive/etc. itself, I'm pretty sure they covered their ass pretty well. With offshore companies in Curacao, Cyprus etc. and without them being noted on any paperwork, I think it will be very difficult to get to them.

What bothers me most though is that this dialer shit is one thing of many.
Bode and Ross (and later his sorry ass brother) fucked so many people in so many different ways it's not funny anymore. Andy was a moron and there was something seriously wrong in his head. However, Shawn, Ross and the people around them were intentionally fucking around with people.

Anyway, without saying too much, there comes a day that I see Bode, Ross or Scott Perkins (or even those idiots Bob Kim or Jim Finnell) so I will be able to 'tell' them what I think.
Number 1 on my list is Shawn but knowing him as one of the biggest cowards in the world, he will probably hide his ass again waiting until the problems are solved.
But hey, I will wait too... my day will come.

invasion
02-07-2005, 11:05 AM
Unfucking believable....

This it way to cool and what this software does?!?!?!?!

who comes up with this shit...

As a marketer this is like a the holy grail of direct marketing

…scary but way too cool

and amazing that people can pull this off and totally get away with it

Peace,

Invasion
:barfon:

DrGuile
02-07-2005, 12:05 PM
Honestly?

No, most of these features I wouldnt use.

Nickatilynx
02-08-2005, 12:30 PM
Originally posted by DrGuile@Feb 7 2005, 09:06 AM
Honestly?

No, most of these features I wouldnt use.
Most being the operative word ;-))

leedsfan
02-10-2005, 04:08 PM
i wonder how many companies are running software programs with scripts that allow them to get away with what these guys did?

As a rough estimate, how many companies left in adult do you think are pulling some hefty scams?

more than 10% more than 50%, all of them.

Ruin
02-10-2005, 06:31 PM
Sorry ass brother! Haha! I can't get enough of these personal attacks on Scott Perkins. That's right Scott, you retarded little termite fucker wigger baller wanna-be never-will-be loser douchebag. The jigs up bitch. Like I told you before, someone, not me, is going to catch your narrow ass and cram those 9mm's straight up inside you. Not a threat, its just what happens to faggy little girls like you. Clown.

Would I use these features if I had them? The company I work for does have these features and no, we do not use them. The functionality is illegal, and use of the features would probably be wire or credit fraud. No one in our office cares to go to prison. Its just a matter of time before law enforcement realizes that they already have the tools at their disposal to move against unscrupulous adware companies.

Avenue Media most certainly has used these features, a friend of mine plugged the URL's to be redirected into their config. I saw it with my own two eyes.