Malware-Infested Ads Now a Threat When Reading Online
Between popup ads, auto-play video ads, and pernicious tracking cookies, there are a hundred and one good reasons to use ad-blocking plugins like Adblock Plus.
That doesn’t stop some experts like Benedict Evans from calling such plugins "malware installed by the user", but a new report from security researchers should take the wind out of his sails.
A team of security researchers at Proofpoint have reported that they have identified a "malvertisng" campaign which used ads displayed on high traffic sites to infect the computers of anyone who visited the site.
Malvertising attacks use online advertising channels to infiltrate malware into the computers of unsuspecting users by embedding malicious code within legitimate advertisements on trusted websites. There is no visible indication that the trusted site is compromised: simply by visiting a site, users can get infected via "drive-by download".
Proofpoint reported that the malvertsing was concentrated on 3 ad networks (Rubicon Project, Right Media / Yahoo Advertising, OpenX), and they noted that they found the malicious ads on AOL, Yahoo, 9GAG, and Match.com as well as news sites ranging from The Atlantic to Stuff.co.nz to The Age. They went on to add that this campaign first started to show up in late September and grew until there were enough instances that the researchers could track the campaign.
Proofpoint reports that they subsequently worked quickly to inform the affected parties who then took steps to remove the ads. The last malicious ad was detected on 18 October.
Or rather, the last sign of that campaign was detected last week; it’s certainly not going to be the last malicious ad ever, which means that users will still need to protect themselves.
It’s pretty clear no one else is going to be able to:
Malvertising attacks are a growing problem; research shows that billions of malicious advertisements are being served each year. Malvertising attacks are especially virulent for two reasons. First, leveraging the online ad network gives attackers the ability to target specific groups; attackers can ensure infection across a designated demographic or targeted set of audiences. Second, because there are so many players in the supply chain through which a given advertisement passes, attackers can more easily avoid detection.
To put it simply, an ad blocker isn’t a sign of selfishness anymore; it’s now part of the basic security steps you should take when browsing online.
I know that’s going to upset anyone who relies on advertising (I don’t like it) but that doesn’t change the fact that this won’t be the mast malvertisng campaign. Until the online ad industry gets better at preventing malicious ads, people have to protect themselves, and that means blocking ads.
images by IntelFreePress, Robbert van der Steeg
R October 26, 2014 um 9:28 pm
Good news! I will tell them this news when they say that I am "stealing" because I use adblocker and don’t allow ads.
Jesslyn October 27, 2014 um 5:21 pm
I have been letting them go, but with increasing concern. Recently, I’ve been noticing that some pages have so many ads that it takes undue time to load. Others kill you with an errant click on what you thought was a blank spot on the page.
It’s taking me back to the old pop-up ad days…ugh….
Roundup: French Publishers Threaten toTo start, there's The Monday Note ()ss Sue Ad-Blocking Company Overs Ads You Weren't Seeing Anyway ⋆ The Digital Reader December 10, 2014 um 9:27 pm
[…] an estimated 5% of the internet population using one, ad blockers are either a necessary security measure, a threat to the ledger book, or a symptom of a greater problem (it depends on who you […]
Huffington Post, Other Sites Hit by Malvertising via AOL Ad Network ⋆ Ink, Bits, & Pixels February 4, 2015 um 2:55 pm
[…] I reported last October, malicious advertising is a persistent problem which is growing worse month by month. Cyphort […]
Forbes Website Was Hacked in Targeted Attack on Its Visitors ⋆ Ink, Bits, & Pixels February 11, 2015 um 11:41 am
[…] to spread malware and attack more computers. Historically, this is an older problem than the rising issue of malware-infested ad […]
Miriam July 15, 2016 um 7:49 am
So much for the claim that if you have malware it’s your own fault.