Francois Paget
Senior Threat Researcher
François Paget is a senior threat research engineer and one of the founding members of McAfee Labs, where he conducts a ...
It is relatively easy for illegitimate websites to “poison” Google search results and achieve a top-5 ranking. And it’s financially well worth their while. Last Friday, at the French CLUSIR/RSSIA conference, Frédéric Roumat from EdelWeb (groupe ON-X) gave us an impressively argued demonstration on the subject.
After Roumat exposed the methods to gain illegal traffic using blackhat search-engine optimization (backlinks, spam-indexing, doorway, cloaking, canonical beacon infection, SEO kits) or malware (man-in-the-browser attacks, DNS changer), he talked about the real aim: profit. His working hypotheses included the following:
Recent news attracted the interest of the French and contributed to Google research spikes. On May 17, using Google Insight and Google Traffic Estimator,, Roumat captured this interest. With a consistent search string (“Paris”) he measured:
These hypotheses demonstrate the interest that cybercrooks pay to the news. For example, they show that a scareware campaign on the day of his death yielded a third-ranked Google search engine result for “Ben Laden” as well as a reward of $43,000 in one day:
To convince the skeptics, Roumat next focused on rogue pharmacies to show how to obtain a third rank in a search engine routine. He invited the audience to search for “viagra” on Google.fr. Here is my search:
To verify the search’s finishing in third rank we ran a query on LegitScript.com. And, indeed, LegitScript warns us against this website, which lacks general conditions of sale and business address yet offers an attractive affiliates program.
By the way, LegitScript gives us some interesting information about the scope of rogue pharmacies. Their database contains:
Let’s get back to the money: Searches on Google Adwords Traffic Estimator for “viagra” and “cialis” returns for the United States only 1,830,000 and 823,000, respectively, in local monthly searches:
Using these figures and a similar calculation as before, we can estimate the income of this suspicious pharmacy at $190,000 a month for the USA alone:
So now we know why scareware and rogue pharmacies are so prevalent on the web.
Frédéric Roumat’s presentation (in French) can be downloaded here.
Under the CLUSIF label, I presented the 2010 Cybercrime Overview, which is available here.
Tags: Cybercrime, scareware, Search engine optimization, Search engine poisoning
Submit your own comments / message for this post