Measuring lower bounds of the financial abuse to online advertisers: A four year case study of the TDSS/TDL4 Botnet

Online advertising is a complex ecosystem that enables one of the most profitable businesses, which has become the target of abuse for botnets. For example, recent charges filed from the United States Department of Justice against the operators of the DNSChanger botnet stated that the botnet stole at least $14 million (Antonakakis et al, 2012, LawFuel Editors, 2014) from online advertisers during its lifetime just short of two years. In this paper we present a system, A2S, to analyze one of the most complex, sophisticated, and long-lived botnets: TDSS/TDL4. Using passive datasets from a large Internet Service Provider in the United States, we estimated conservative lower bounds of advertisers' loss caused by the botnet. Over its entire life span, less than 15% of TDSS/TDL4 population caused at least $346 million in damages to advertisers, primarily due to impression fraud. This translates to an average of $340 thousand daily loss to advertisers, which is three times the last reported estimate from the analysis of ZeroAccess botnet (Pearce et al., 2014) and more than ten times of the daily impact the DNSChanger botnet (Meng et al., 2013) had to the ad ecosystem. Our study is the first to reveal the extent of the abuse that botnets bring to the ad ecosystem from the outside: the edge of the Internet.