Flashback 'hijacked' Google keyword searches

The Flashback Trojan that infected Apple Mac computers could have made more than $10,000 (£6,200) a day for its creators, suggests research.

Analysis of the malicious software by security firm Symantec showed it was built to hijack Google searches.

On infected machines the malware watched for specific keywords.

When they were spotted, the Trojan re-directed users to sites that its creators were being paid to funnel people towards.

In early April, it was revealed that up to 500,000 Apple Mac computers had been infected by malicious software called Flashback.

The malware targeted a vulnerability in the Java software that is used in Windows machines, Apple computers and many others.

Macs were the biggest victims because Apple did not patch the loophole in its version of Java for several weeks after the vulnerability became known.

The Symantec analysis has revealed why the malware was created and how much cash it might have generated for its creators.

By reverse engineering the software, Symantec has discovered that it lurked on infected machines waiting until a user searched on Google for certain words such as "toys".

If a user clicked on an advert related to that search, they would never reach the site they wanted but were re-directed to others showing ads and links.

Symantec engineers found that Flashback's creators would be paid 0.008 cents every time a user was re-directed. Other malicious programs that managed to infect 25,000 victims have been seen to generate about $450 per day for their creators.

"Considering the Flashback Trojan measures in the hundreds of thousands, this figure could sharply rise to the order of $10,000 per day," wrote the Symantec researchers.

Further analysis of Flashback by Russian security firm Dr Web, which sounded the alarm about the malware, has revealed how it was controlled.

Its creators seem to have used Twitter as the command-and-control system for the huge number of machines that it infected.

Compromised machines were programmed to regularly search Twitter for messages containing particular strings of letters. These would direct infected machines to visit particular websites to get updates or receive further instructions.