Google Analytics and Bots

Everyday we see different things that the miscreants develop to make their job easier. Today I was checking the 288th variant of Opanki. The really interesting thing about this one is that the botnet owner seems concerned over not having an organized way to check the bots, like geographic distribution, for example. But how can he or she accomplish this in an easy way? Yes, Google Analytics! As many of you know, Google offers Google Analytics (www.google.com/analytics) as a free service that allows anyone to keep collect and view tracking information about website visitors, like Unique Visitor Tracking, Daily Visitor, Geo Location…

The following code was found on this bot variant. This is typical code that one would usually add in to a webpage to make Google Analytics work:

_uacct = "UA-XXXXXX-X";

_udn="xxxxxx.com";

urchinTracker();

The _uacct and _udn are parameters that identify the site owner for later statistics.

Yet another example of how the miscreants are organizing themselves…