Malvertising

Malvertising (a portmanteau of "malicious advertising") is the use of online advertising to spread malware.[1] It typically involves injecting malicious or malware-laden advertisements into legitimate online advertising networks and webpages.[2] Online advertisements provide a solid platform for spreading malware because significant effort is put into them in order to attract users and sell or advertise the product.[3] Because advertising content can be inserted into high-profile and reputable websites, malvertising provides malefactors an opportunity to push their attacks to web users who might not otherwise see the ads, due to firewalls, more safety precautions, or the like.[4][5] Malvertising is "attractive to attackers because they 'can be easily spread across a large number of legitimate websites without directly compromising those websites'."[6]

An example of a malicious advertisement

Malvertising is a fairly new concept for spreading malware and can be extremely hard to combat because it can quietly work its way into a webpage or advertisement on a webpage and spread unknowingly: "The interesting thing about infections delivered through malvertising is that it does not require any user action (like clicking) to compromise the system and it does not exploit any vulnerabilities on the website or the server it is hosted from... infections delivered through malvertising silently travel through Web page advertisements."[7] It is able to expose millions of users to malware, even the most cautious, and is growing rapidly: "In 2012, it was estimated nearly 10 billion ad impressions were compromised by malvertising."[2] Attackers have a very wide reach and are able to deliver these attacks easily through advertisement networks. Companies and websites have had difficulty diminishing the number of malvertising attacks, which "suggests that this attack vector isn’t likely to disappear soon."[6]

Overview

When websites or web publishers unknowingly incorporate corrupted or malicious advertisements into their page, computers can become infected pre-click and post-click. It is a misconception that infection only happens when visitors begin clicking on a malvertisement. "Examples of pre-click malware include being embedded in main scripts of the page or drive-by-downloads. Malware can also auto-run, as in the case of auto redirects, where the user is automatically taken to a different site (without user interaction, such as clicking on them), which could be malicious. Malware can also be found in the delivery of an ad – where a clean ad that has no malware pre- or post-click (in its build and design) can still be infected whilst being called.[8] Malicious code can hide undetected and the user has no idea what's coming their way. A post-click malvertisement example: "the user clicks on the ad to visit the advertised site, and instead is directly infected or redirected to a malicious site. These sites trick users into copying viruses or spyware usually disguised as Flash files, which are very popular on the web."[9] Redirection is often built into online advertising, and this spread of malware is often successful because users expect a redirection to happen when clicking on an advertisement. A redirection that is taking place only needs to be co-opted in order to infect a user's computer.[1]

Malvertising often involves the exploitation of trustworthy companies. Those attempting to spread malware place "clean" advertisements on trustworthy sites first in order to gain a good reputation, then they later "insert a virus or spyware in the code behind the ad, and after a mass virus infection is produced, they remove the virus", thus infecting all visitors of the site during that time period. The identities of those responsible are often hard to trace, making it hard to prevent the attacks or stop them altogether, because the "ad network infrastructure is very complex with many linked connections between ads and click-through destinations."[9]

Some malvertisements can infect a vulnerable computer even if the user never clicks on the (normal-appearing) advertisement.[10]

History

2007/2008: The first recorded sighting of malvertising was in late 2007 / early 2008. This threat was based on a vulnerability in Adobe Flash (something that has continued to this day – see later) and affected a number of platforms including, MySpace, Excite and Rhapsody.

2009: The online edition of The New York Times Magazine was found to be serving up an ad that was part of a larger click fraud scam that created a botnet network of malware infected computers, nicknamed the Bahama botnet, that then went on to be used to carry out click fraud on pay per click ads all over the web. The banner feed of The New York Times was hacked for the weekend of September 11 to 14, causing some readers to see advertisements telling them their systems were infected and trying to trick them into installing rogue security software on their computers. According to spokeswoman Diane McNulty, "the culprit approached the newspaper as a national advertiser and had provided apparently legitimate ads for a week", and the ads were switched to the virus alert malvertisement afterwards. The New York Times then suspended third-party advertisements to address the problem, and even posted advice for readers regarding this issue on its technology blog.[11]

2010: Malvertising takes off. Marketing analysts ClickZ[12] noted that the Online Trust Alliance (OTA) identified billions of display ads, across 3500 sites carrying malware. In the same year the Online Trust Alliance[13] formed a cross industry Anti-Malvertising Task Force.

2011: Spotify had a malvertising attack which used the Blackhole exploit kit – this was one of the first instances of a drive-by download, where a user doesn’t even have to click on an ad to become infected with malware. According to Blue Coat Systems 2012 Web Security Report,[14] saw an increase of 240% in malvertising based malicious sites.

2012: Symantec includes malvertising as a section in their Internet Security Threat Report 2013[15] which looked back at the landscape in 2012. Symantec used scanning software across a series of websites and detected that half of them were infected with malvertising. In 2012, the LA Times was hit by a massive malvertising attack which used the Blackhole exploit kit to infect users. It was seen as part of a general campaign of malvertising to hit large news portals – this strategy carried on into subsequent years with attacks on huffingtonpost.com and the NY Times.

2013: A major malvertising campaign was waged against Yahoo.com, one of the largest ad platforms with monthly visits of 6.9 billion. The malware exploit was based on the commonly used web attack, Cross-site scripting (XSS), number three in the top ten web attacks types identified by the Open Web Application Security Project[16] (OWASP). The attack infected users' machines with the ransomware, ‘Cryptowall’, a type of malware that extorts money from users by encrypting their data and placing a ransom of up to $1000 in bitcoins, to be paid in 7 days, to decrypt the data.

2014: In 2014 there were major malvertising campaigns on the DoubleClick and Zedo ad networks. Various news portals, including The Times of Israel and the Hindustan Times, were affected. As in previous attacks the cybercrime involved Cryptowall as the malware infection. This spate of malvertising was believed to have brought over $1 million of ransom money in by infecting over 600,000 computers.[17]

2015: McAfee's Threat Report for February 2015 said that malvertising was growing quickly on mobile platforms.[18] In 2015 there were malvertising campaigns on eBay, Answers.com, talktalk.co.uk, and wowhead.com, among others. The campaigns involved breaches of ad networks, including DoubleClick and engage:BDR. There was also a report of possibly the first "political malvertising" campaign by pro-Russian activists, which was based on a botnet, which then forced users machines to visit bogus sites that generated ad revenue for the activists. The users also ended up at several pro-Russian propaganda videos.

More examples of malicious advertisements

Several popular websites and news sources have been victims to malvertising and have had malicious advertisements placed on their webpages or widgets unknowingly, including Horoscope.com, The New York Times,[19] the London Stock Exchange, Spotify, and The Onion.[6]

Types and modes

By visiting websites that are affected by malvertising, users are at risk of infection. There are many different methods used for injecting malicious advertisements or programs into webpages:

Preventive measures

There are several precautions that people can take to reduce their chances of getting tricked by these advertisements. Commonly used programs such as Adobe Flash Player and Adobe Reader can have their flaws exploited, and become vulnerable to attacks, so it is important to avoid them, or at least keep them up to date.[21] Users can also download anti-virus software that protects against threats and removes malicious software from their systems. Users can also push companies and websites to scan advertisements before making them active on their webpages.[2] Users can also use ad blocking software to avoid downloading the malware contained in advertisements[22] or a specific browser extension alerting malvertising campaigns.[23]

gollark: No, PotatOS is immortal, omnipresent and inevitable.
gollark: PotatOS doesn't use bytecode and do not break backward compatibility or else.
gollark: it was never used.
gollark: The emergency shutdown thing was added after an issue when I retasked all PotatOS machines to spam a rednet chat server and couldn't stop them.
gollark: The SPUDNET interface is highly concurrent™ so you could just send a shutdown command while it is doing other things and it'd work.

See also

References
  1. Salusky, William (December 6, 2007). "Malvertising". SANS ISC. Retrieved September 11, 2019.
  2. "Anti-Malvertising". Online Trust Alliance. Archived from the original on December 15, 2013. Retrieved September 11, 2019.
  3. Sood, Aditya; Enbody, Richard (April 2011). "Malvertising - exploiting web advertising" (PDF). Computer Fraud and Security: 11–16. ISSN 1361-3723. Retrieved September 11, 2019.
  4. Johnson, Bobbie (September 25, 2009). "Internet companies face up to 'malvertising' threat". The Guardian. Retrieved September 11, 2019.
  5. "The rise of malvertising and its threat to brands". Deloitte. 2009. Archived from the original on July 22, 2011. Retrieved September 11, 2019.
  6. Zeltser, Lenny (June 6, 2011). "Malvertising: Some Examples of Malicious Ad Campaigns". Retrieved September 11, 2019.
  7. "Five-month malvertising campaign serves up silent infections". Infosecurity. Reed Exhibitions Ltd. February 12, 2013. Retrieved September 11, 2019.
  8. Vuijsje, Eliana (August 31, 2015). "What is Malvertising (Malware) Detection in Online Advertising, Part I". Archived from the original on 22 September 2016. Retrieved September 11, 2019.
  9. "A rising security threat: Malvertising". Bullguard. Retrieved September 11, 2019.
  10. Siciliano, Robert (April 8, 2014). "Business Identity Theft; Big Brand, Big Problems". Huffington Post. Retrieved September 11, 2019.
  11. Picchi, Aimee (September 14, 2009). "Malvertising hits The New York Times". The Daily Finance. Archived from the original on April 21, 2016. Retrieved September 11, 2019.
  12. Kaye, Kate (February 10, 2011). "Billions of Web Ads Carried Malware in 2010". Retrieved September 11, 2019.
  13. "Online Trust Alliance Forms Cross-Industry Anti-Malvertising Task Force". Reuters. September 8, 2010. Archived from the original on March 27, 2016. Retrieved September 11, 2019.
  14. "Blue Coat Systems 2012 Web Security Report" (PDF). Retrieved September 11, 2019.
  15. "Symantec Internet Security Threat Report 2013" (PDF). April 2013. Archived from the original (PDF) on 5 June 2014. Retrieved September 11, 2019.
  16. "Category:OWASP Top Ten Project". Retrieved September 11, 2019.
  17. Constantin, Lucian (August 29, 2014). "CryptoWall ransomware held over 600K computers hostage, encrypted 5 billion files". Retrieved September 11, 2019.
  18. "McAfee Labs Threats Report February 2015" (PDF). Archived from the original (PDF) on March 4, 2016. Retrieved September 11, 2019.
  19. Johnson, Bobbie (September 25, 2009). "Internet companies face up to 'malvertising' threat". The Guardian. Retrieved September 11, 2019.
  20. Finley, Klint (July 26, 2010). "Report: The 3 Biggest Enterprise Website Malware Vulnerabilities". ReadWrite Enterprise. Retrieved September 11, 2019.
  21. Richmond, Riva (May 20, 2010). "Five Ways to Keep Online Criminals at Bay". Personal Tech. The New York Times. Retrieved September 11, 2019.
  22. Nichols, Shaun (August 14, 2015). "You've been Drudged! Malware-squirting ads appear on websites with 100+ million visitors". The Register. Retrieved September 11, 2019.
  23. George, Thomas (October 9, 2015). "Malvertising up 325% – Are the AdBlockers Working?". Check&Secure. Archived from the original on January 30, 2016. Retrieved September 11, 2019.
This article is issued from Wikipedia. The text is licensed under Creative Commons - Attribution - Sharealike. Additional terms may apply for the media files.