Remind me how these Russian sites earn money by redirecting to their sites. Or do these sites have links that they are paid for
after the user gets redirected?
I can easily understand how a SPAMmer makes money from useless items for sale (which may never get sent, of course). I'm simply too dumb to understand how redirecting a viewer earns anything. I'm sure it must, wouldn't expect any "mod" to do much of anything for "fun!"
The Web site that the user is redirected to attempts to download a virus onto the user's computer, invisibly and silently, without the user knowing it. These Web sites are quite sophisticated and will use a number of different browser exploits to try to get the virus to download, one after the other. For example, they will often first try a well-known iFrame exploit in Internet Explorer. If that doesn't work, they will move on to another exploit, then another, then another.
If none of the exploits work--that is, if the user has been good and has run all the security updates and so on--the Web site will show a fake, scary-looking "Warning! You are infected with a virus! Click here to download a program to remove the virus!" message. The program that you download to "remove the virus" is, of course, a virus.
Anyway, the whole purpose of the redirection is to force or trick a virus onto the user's computer. As soon as the user is infected, the virus sends back a signal to the Russian virus writers, telling them the user's IP address. It then opens a back door on the user's computer, allowing the hackers to take over the user's computer and do anything they want.
The hackers make money in a lot of ways. They can sell lists of infected computers to spammers. The spammers then use the infected computers to send out spam. (Most spam comes from virus-infected computers. If anyone tries to trace the spam, the trace ends with the infected computer; Joe Average, who does not know his computer is infected, is actually unwittingly sending millions of spam messages without knowing it.)
The Russians will also install keyloggers on infected computers. The keyloggers will sit silently, waiting until they recognize certain words typed into a browser, such as "bank," "ebay," or "paypal." They will then kick into action, recording every button the user pushes and sending a complete transcript back to the hackers. The hackers then have the person's bank account number and password, or PayPal login and password, or whatever.
The virus-infected computers can also be used for extortion. Often, organized crime will target highly profitable sites such as porn sites or gambling sites. They will email the owner and say "Give us money or we will take down your site." If the owner does not pay, the hackers order the virus-infected computers to start accessing the Web sites, thousands of times per second. This kind of coordinated attack from tens of thousands of infected computers all at once swamps and overloads the victim's Web site, forcing it offline.
So what it all comes down to is this: Organized crime uses lots of tricks, such as hacking, poisoned banner ads, poisoned Google searches, and so on to get users to visit hostile servers. The hostile servers try to trick or force the user to download a computer virus. When the user downloads a computer virus, his computer is totally in the hands of the criminals, who use it in a variety of ways to make money--by selling access to the victim's computer to spammers, by stealing bank account information from the victim, or by using the victim's computer to attack other Web sites in order to extort money from the Web site owners.
It's very, very, very profitable. In Eastern Europe, cybercrime has pretty much replaced the normal businesses such as prostitution, loan sharking, and so on as the biggest money-maker. Russian mafia makes millions by spreading viruses.
