Malvertising

Malvertising (from "malicious advertising") is the use of online advertising to spread malware.^[1]

Malvertising involves injecting malicious or malware-laden advertisements into legitimate online advertising networks and webpages.^[2] Online advertisements provide a solid platform for spreading malware because significant effort is put into them in order to attract users and sell or advertise the product.^[3] Because advertising content can be inserted into high-profile and reputable websites, malvertising provides malefactors an opportunity to push their attacks to web users who might not otherwise see the ads, due to firewalls, more safety precautions, or the like.^[4][5] Malvertising is "attractive to attackers because they 'can be easily spread across a large number of legitimate websites without directly compromising those websites'." ^[6]

Malvertising is a fairly new concept for spreading malware and is even harder to combat because it can work its way into a webpage and spread through a system unknowingly: "The interesting thing about infections delivered through malvertising is that it does not require any user action (like clicking) to compromise the system and it does not exploit any vulnerabilities on the website or the server it is hosted from... infections delivered through malvertising silently travel through Web page advertisements." ^[7] It is able to expose millions of users to malware, even the most cautious, and is growing rapidly: "In 2012, it was estimated nearly 10 billion ad impressions were compromised by malvertising." ^[2] Attackers have a very wide reach and are able to deliver these attacks easily through advertisement networks. Companies and websites have had difficulty diminishing the number of malvertising attacks, which "suggests that this attack vector isn’t likely to disappear soon." ^[6]

How it works

Websites or web publishers unknowingly incorporate a corrupted or malicious advertisement into their page. Once the advertisement is in place, and visitors begin clicking on it, their computer can become infected: "the user clicks on the ad to visit the advertised site, and instead is directly infected or redirected to a malicious site. These sites trick users into copying viruses or spyware usually disguised as Flash files, which are very popular on the web." ^[8] Redirection is often built into online advertising, and this spread of malware is often successful because users expect a redirection to happen when clicking on an advertisement. A redirection that is taking place only needs to be co-opted in order to infect a user's computer.^[1]

Malvertising often involves the exploitation of trustworthy companies. Those attempting to spread malware place "clean" advertisements on trustworthy sites first in order to gain a good reputation, then they later "insert a virus or spyware in the code behind the ad, and after a mass virus infection is produced, they remove the virus", thus infecting all visitors of the site during that time period. The identities of those responsible are often hard to trace, making it hard to prevent the attacks or stop them altogether, because the "ad network infrastructure is very complex with many linked connections between ads and click-through destinations." ^[8]

Examples of malicious advertisements

Several popular websites and news sources have been victims to malvertising and have had malicious advertisements placed on their webpages or widgets unknowingly, including Horoscope.com, The New York Times,^[9] the London Stock Exchange, Spotify, and The Onion.^[6]

In 2009, the banner feed of The New York Times was hacked for the weekend of September 11 to 14, causing some readers to see advertisements telling them their systems were infected and trying to trick them into installing infected software on their computers. According to spokeswoman Diane McNulty, "the culprit approached the newspaper as a national advertiser and had provided apparently legitimate ads for a week", and the ads were switched to the virus alert malvertisement afterwards. The New York Times suspended third-party advertisements to address the problem, and even posted advice for readers regarding this issue on its technology blog.^[10]

Types and modes

By visiting websites that are affected by malvertising, users are at risk of infection. There are many different methods used for injecting malicious advertisements or programs into webpages:

• Pop-up ads for deceptive downloads, such as fake anti-virus programs that install malicious software on the computer^[2]
• In-text or in-content advertising
• Drive-by downloads^[2]
• Web widgets in which redirection can be co-opted into redirecting to a malicious site^[3]
• Hidden iframes that spread malware into websites^[3]
• Content delivery networks exploited to share malware^[3]
• Malicious banners on websites^[3]
• Third-party advertisements on webpages^[11]
• Third-party applications, such as forums, help desks, and customer relationship management and content management systems^[11]

Preventive measures

There are several precautions that people can take to lessen their chances of getting tricked by these advertisements. Besides just learning about them, users can download internet browsers that can detect websites that have malware advertisements on them, such as Internet Explorer 9 or Google Chrome, which "includes some security advances that make attacks more difficult." Commonly used programs such as Adobe Flash Player and Adobe Reader can have their flaws exploited, and become vulnerable to attacks, so it is important to keep them up to date.^[12] Users can use ad blockers such as Adblock Plus or AdBlock to prevent running any code, including legitimate advertising, from known ad networks. Users can also download anti-virus software that protects against threats and removes malicious software from their systems. Users can also push companies and websites to scan advertisements before making them active on their webpages.^[2]

See also

• Malvertisement
• Social engineering (security)
• Malware

References

External links

• What You Need To Know About Malvertising
• Anti-Malvertising.com
• Wepawet
• Online Trust Alliance's Tools and Resources
• Internet security company Dasient's website