Cylab News

Print

USENIX Security 2011: CyLab Researchers Release Study on Illicit Online Drug Trade and Attacks on Pharma Industry

posted by Richard Power
August 10, 2011

At the 20th USENIX Security Symposium, held in San Francisco, California (August 8-12, 2011), CyLab researchers will release the results of a study focusing on the illicit online trade in prescription drugs and the re-direction attacks on the Pharma industry that drive it.

At the 20th USENIX Security Symposium, held in San Francisco, California (August 8-12, 2011), CyLab researchers will release the results of a study focusing on the illicit online trade in prescription drugs and the re-direction attacks on the Pharma industry that drive it.

The study, Measuring and Analyzing Search-Redirection Attacks in the Illicit Online Prescription Drug Trade, authored by CyLab Systems Scientist and Information Networking Institute Associate Director Nicolas Christin, Carnegie Mellon graduate student Nektarios Leontiadis and Harvard's Tyler Moore, "investigates the manipulation of web search results to promote the unauthorized sale of prescription drugs." The researchers "constructed a representative list of 218 drug-related queries and automatically gathered the search results on a daily basis over nine months in 2010-2011."

CyLab fielded a strong presence at USENIX Security 2011. Nektarios Leontiadis' presentation on the work of Christin's team was one of two CyLab studies among the refereed papers on the agenda, the other was Q: Exploit Hardening Made Easy, co-authored by Edward J. Schwartz, Thanassis Avgerinos and CyLab faculty member David Brumley. In addition, Alessandro Acquisti and Collin Jackson delivered Invited Talks.

In this brief excerpt from the latest CyLab Chronicles, Nicolas Christin articulates the major findings of his new study.

"First, illicit online pharmacies --- or agents advertising on their behalf --- are increasingly trying to manipulate search engine results to promote their businesses. This is because they can get pretty decent conversion rates: We find they net somewhere between three and thirty purchasing customers out of a thousand people searching for drugs online. This is much more effective than email or web forum spam. As a very negative consequence, legitimate pharmacies or online health resources have been pretty much driven out of these search results entirely. Second, this attack is made effective thanks to fairly high profile websites (e.g., .edu) getting compromised and participating in the search-engine manipulation. Unfortunately, operators of these sites are very slow at cleaning up their sites -- infections last seven weeks on average, and four months on .edu sites. Third, we find that most pharmacies are connected through advertisement chains; looking at the advertising network a bit more deeply, we find that surprisingly few hosts ("redirectors") play a very important role in sending traffic to illicit pharmacies. Taking down these redirectors would almost certainly disrupt this line of business, at least temporarily." 

Some Related Posts

 

CyLab in the headlines

CMU professor tells Congress Social Security IT should embrace the cloud - May 10, 2012
"In the 30 years since many of the existing (Social Security Administration) systems were first stood up, storage capacities, network bandwidth, processing power, and the cost of these things have all improved by between 4 and 6 orders of magnitude," Carnegie Mellon CyLab researcher William Scherlis said in written testimony. "That’s a factor of a million. If skyscrapers increased in height by that factor, they would scrape the moon."

The Post-Cash, Post-Credit-Card Economy - April 28, 2012
Alessandro Acquisti, a researcher at Carnegie Mellon CyLab smiled. If today all you need to do is enter your phone number and PIN when you visit a store, perhaps tomorrow, he said, that store will be able to detect your phone by its unique identifier as soon as you enter. Perhaps in the not-too-distant future, he went on, you won’t have to shop at all. Your vast piles of shopping data would be instead collected, analyzed and used to tell you exactly what you need: a new motorcycle from Ducati, perhaps, or purple rain boots in the next size for your growing child. Money will be seamlessly taken from your account. A delivery will arrive at your doorstep.

Big Mac Attack: Apple Security Bruised after OS X Infections - April 25, 2012
"In the computer community we've been saying for five, six, seven years that Mac is not more immune to computer viruses than Windows PCs or even Linux boxes, " says Nicolas Christin, researcher at Carnegie Mellon CyLab. "The only reason Macs were not massively targeted is that they didn't have enough of a market share to make them interesting for a hacker to devote resources to try to compromise those machines. Now that they've acquired a fairly sizeable market share, it makes sense that the bad guys would focus some attention on the Mac platform."

[see all the headlines]

Upcoming events

May 15, 2012: CERT Training
Managing Enterprise Information Security: A Practical Approach for Achieving Defense-in-Depth

This three-day course begins with a brief review of the conceptual foundations of information security. This course is designed for individuals charged with implementing information security throughout the IT enterprise. Therefore, this course is an ideal pursuit for IT and Security managers, and/or system administrators and IT security personnel who would like to step up to the management level.

June 9, 2012: Celebration
CMU Silicon Valley 10th Anniversary Celebration

Join us on Saturday, June 9, 2012 to celebrate the rich history of CMU and its impact on the west coast! We will host the 10th anniversary event on the campus at Moffett Field beginning at 3:30 PM. All attendees are welcome to participate in the festivities. 

June 19, 2012: Research Talk
The Persistence of Passwords and Evaluating Authentication Alternatives
Paul C. Van Oorschot, Professor, Carleton University

[see all events]