Vulnerabilities / Threats
1/16/2015
10:15 AM
Peter Zavlaris
Peter Zavlaris
Commentary
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
100%
0%

The Truth About Malvertising

Malvertising accounts for huge amounts of cyberfraud and identity theft. Yet there is still no consensus on who is responsible for addressing these threats.

Malicious advertisements, or “malvertising” for short, present arguably the fastest growing and least understood online threat today. The technique, used to distribute malware on popular websites via online advertising networks, was responsible for an exponential number of attacks in 2014. This past week, The Huffington Post and several major websites presented visitors with advertisements that infected computers with ransomware, locked them down, and demanded money from victims to get back control of their devices.

The danger
Malvertisements can appear on any website at any given time, and there is little that the website owner can do to prevent them. That’s because they are planted on Web pages via third-party ad delivery networks. These networks auction website placements to advertisers using a high bid, free market system. There is currently very little oversight in this industry.

This system was built for efficiency, so the marketplace has very little regulation to force better security practices. To make matters worse, malvertisers use various techniques to disguise the true purpose of their advertisements, often building entire infrastructures designed to redirect users between URLs. Finding offenders that are impersonating brands with fake software updates in this marketplace is extremely difficult.

Digital marketing is big business
According to a report compiled by eMarketer, the worldwide paid media market is estimated at $545 billion, and it will increase by approximately 5% for the foreseeable future. This industry funds the “free” websites we all know and enjoy online, and malvertising is a major threat to their continued success and expansion.

[Find out how Operation DeathClick put a new twist on an old method of infecting users in Sophisticated Malvertising Campaign Targets US Defense Industry.]

In the third quarter of 2014 alone, almost 200,000 malvertising examples were detected on live websites. The chart below ranks these by type of attack.

(Source: RiskIQ Global Network)
(Source: RiskIQ Global Network)

What makes malvertising insidious is its ability to hide and deliver malware using an Internet-wide infrastructure that can target specific types of users. Since malicious ads do not persist once a user session is terminated, they’re extremely difficult to detect and track. Worst of all there is still a lot of grey area regarding who exactly should be solving this problem. Meanwhile, consumers and their personal data are being put at risk.

Why should we be concerned?
There are several reasons. First, malvertising accounts for huge sums of financial fraud and is responsible for the theft of personally identifiable data. Meanwhile, most organizations lack the tools to monitor and mitigate this problem. Since there still isn’t any consensus on who is responsible for addressing these threats, no formal processes have been put in place and the problem continues to increase in size and velocity.

The onus is on advertisers and publishers to take the necessary steps to address malvertising and limit the spread of malware on their networks. Until then, it is their customers, the consumers, who remain in the crosshairs.

Peter Zavlaris is one of the primary analysts and contributors to the RiskIQ blog, which provides weekly insights on the latest threats and attacks that target companies outside the firewall and put customers at risk. He has held various customer satisfaction positions with ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
PZav
50%
50%
PZav,
User Rank: Author
1/21/2015 | 7:48:35 PM
Re: who is responsible? onus on advertisers and publishers
The reason ISPs won't get involved is because its a slippery slope for them. If they created controls for something like bad adverstisements, then media outlets would start putting pressure on them to curb pirating. Its the same issue for search engines. Plus there is the whole privacy can of worms as well. How closely do they have to look at our traffic to setup meaningful controls? As soon as they're viewed as anything more than a transit system, they begin to take on a lot more responsibility. Its too much of a liability.  
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
1/21/2015 | 8:48:34 AM
Re: who is responsible? onus on advertisers and publishers
It's hard to know who should take the lead for malvertising prevention -- or the blame for the problem in the first place. Yes, it's a consumer problem via personal computers. But so is a  lot of garden variety malware. Maybe ISPs should provide consumers with better controls ?
Chris Weltzien
50%
50%
Chris Weltzien,
User Rank: Author
1/20/2015 | 5:31:59 PM
Re: who is responsible? onus on advertisers and publishers
This problem has been brewing for a while. We saw it back in 2007 at Exploit Prevention Labs when it was just starting to surface and when we uncovered some some malicious Google Ads campaigns USA Today ran an article on it. (can't link to it in comments)  More recently the Senate had hearings on it in the spring of 2014, where ad networks were called out for ignoring the problem. If you are looking to protect yourself AVG's LinkScanner is a real-time client side solution, if you are looking for someone to take responsibility I wouldn't hold your breath. 
PZav
50%
50%
PZav,
User Rank: Author
1/20/2015 | 4:02:55 PM
Re: who is responsible? onus on advertisers and publishers
History is on your side Marilyn! I do wonder if this is recognized as a consumer facing problem, if brands will take it more seriously though. It seemed like with the POS breaches that the banks were really the ones left holding the bag. But malvertising reaches personal computers. Time will tell! Thanks for the comment.
Marilyn Cohodas
100%
0%
Marilyn Cohodas,
User Rank: Strategist
1/20/2015 | 9:04:17 AM
Re: who is responsible? onus on advertisers and publishers
I wouldn't hold my breath for advertisers and publishers to be proactive about malvertising -- at least not any time soon. Retailers have certainly been a major target of attacks and look at their track record at getting ahead of the hackers...
PZav
50%
50%
PZav,
User Rank: Author
1/19/2015 | 12:15:47 PM
Re: who is responsible?
Maybe one of the biggest concerns is the harm malvertising will cause to the Internet economy, which is fueled by digital advertising. 
macker490
50%
50%
macker490,
User Rank: Ninja
1/17/2015 | 9:51:31 AM
who is responsible?
until the laws regarding product liability are changed the system owner is responsible.

I am considering running my browser in a "NamedSpace" such as "firejail"  -- as my response to this question.

 
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Five Emerging Security Threats - And What You Can Learn From Them
At Black Hat USA, researchers unveiled some nasty vulnerabilities. Is your organization ready?
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
Cybercrime has become a well-organized business, complete with job specialization, funding, and online customer service. Dark Reading editors speak to cybercrime experts on the evolution of the cybercrime economy and the nature of today's attackers.