Vulnerabilities / Threats

1/16/2015
10:15 AM
Peter Zavlaris
Peter Zavlaris
Commentary
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail vvv
100%
0%

The Truth About Malvertising

Malvertising accounts for huge amounts of cyberfraud and identity theft. Yet there is still no consensus on who is responsible for addressing these threats.

Malicious advertisements, or “malvertising” for short, present arguably the fastest growing and least understood online threat today. The technique, used to distribute malware on popular websites via online advertising networks, was responsible for an exponential number of attacks in 2014. This past week, The Huffington Post and several major websites presented visitors with advertisements that infected computers with ransomware, locked them down, and demanded money from victims to get back control of their devices.

The danger
Malvertisements can appear on any website at any given time, and there is little that the website owner can do to prevent them. That’s because they are planted on Web pages via third-party ad delivery networks. These networks auction website placements to advertisers using a high bid, free market system. There is currently very little oversight in this industry.

This system was built for efficiency, so the marketplace has very little regulation to force better security practices. To make matters worse, malvertisers use various techniques to disguise the true purpose of their advertisements, often building entire infrastructures designed to redirect users between URLs. Finding offenders that are impersonating brands with fake software updates in this marketplace is extremely difficult.

Digital marketing is big business
According to a report compiled by eMarketer, the worldwide paid media market is estimated at $545 billion, and it will increase by approximately 5% for the foreseeable future. This industry funds the “free” websites we all know and enjoy online, and malvertising is a major threat to their continued success and expansion.

[Find out how Operation DeathClick put a new twist on an old method of infecting users in Sophisticated Malvertising Campaign Targets US Defense Industry.]

In the third quarter of 2014 alone, almost 200,000 malvertising examples were detected on live websites. The chart below ranks these by type of attack.

(Source: RiskIQ Global Network)
(Source: RiskIQ Global Network)

What makes malvertising insidious is its ability to hide and deliver malware using an Internet-wide infrastructure that can target specific types of users. Since malicious ads do not persist once a user session is terminated, they’re extremely difficult to detect and track. Worst of all there is still a lot of grey area regarding who exactly should be solving this problem. Meanwhile, consumers and their personal data are being put at risk.

Why should we be concerned?
There are several reasons. First, malvertising accounts for huge sums of financial fraud and is responsible for the theft of personally identifiable data. Meanwhile, most organizations lack the tools to monitor and mitigate this problem. Since there still isn’t any consensus on who is responsible for addressing these threats, no formal processes have been put in place and the problem continues to increase in size and velocity.

The onus is on advertisers and publishers to take the necessary steps to address malvertising and limit the spread of malware on their networks. Until then, it is their customers, the consumers, who remain in the crosshairs.

Peter Zavlaris is one of the primary analysts and contributors to the RiskIQ blog, which provides weekly insights on the latest threats and attacks that target companies outside the firewall and put customers at risk. He has held various customer satisfaction positions with ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
PZav
50%
50%
PZav,
User Rank: Author
1/21/2015 | 7:48:35 PM
Re: who is responsible? onus on advertisers and publishers
The reason ISPs won't get involved is because its a slippery slope for them. If they created controls for something like bad adverstisements, then media outlets would start putting pressure on them to curb pirating. Its the same issue for search engines. Plus there is the whole privacy can of worms as well. How closely do they have to look at our traffic to setup meaningful controls? As soon as they're viewed as anything more than a transit system, they begin to take on a lot more responsibility. Its too much of a liability.  
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
1/21/2015 | 8:48:34 AM
Re: who is responsible? onus on advertisers and publishers
It's hard to know who should take the lead for malvertising prevention -- or the blame for the problem in the first place. Yes, it's a consumer problem via personal computers. But so is a  lot of garden variety malware. Maybe ISPs should provide consumers with better controls ?
Chris Weltzien
50%
50%
Chris Weltzien,
User Rank: Author
1/20/2015 | 5:31:59 PM
Re: who is responsible? onus on advertisers and publishers
This problem has been brewing for a while. We saw it back in 2007 at Exploit Prevention Labs when it was just starting to surface and when we uncovered some some malicious Google Ads campaigns USA Today ran an article on it. (can't link to it in comments)  More recently the Senate had hearings on it in the spring of 2014, where ad networks were called out for ignoring the problem. If you are looking to protect yourself AVG's LinkScanner is a real-time client side solution, if you are looking for someone to take responsibility I wouldn't hold your breath. 
PZav
50%
50%
PZav,
User Rank: Author
1/20/2015 | 4:02:55 PM
Re: who is responsible? onus on advertisers and publishers
History is on your side Marilyn! I do wonder if this is recognized as a consumer facing problem, if brands will take it more seriously though. It seemed like with the POS breaches that the banks were really the ones left holding the bag. But malvertising reaches personal computers. Time will tell! Thanks for the comment.
Marilyn Cohodas
100%
0%
Marilyn Cohodas,
User Rank: Strategist
1/20/2015 | 9:04:17 AM
Re: who is responsible? onus on advertisers and publishers
I wouldn't hold my breath for advertisers and publishers to be proactive about malvertising -- at least not any time soon. Retailers have certainly been a major target of attacks and look at their track record at getting ahead of the hackers...
PZav
50%
50%
PZav,
User Rank: Author
1/19/2015 | 12:15:47 PM
Re: who is responsible?
Maybe one of the biggest concerns is the harm malvertising will cause to the Internet economy, which is fueled by digital advertising. 
macker490
50%
50%
macker490,
User Rank: Ninja
1/17/2015 | 9:51:31 AM
who is responsible?
until the laws regarding product liability are changed the system owner is responsible.

I am considering running my browser in a "NamedSpace" such as "firejail"  -- as my response to this question.

 
Cybersecurity's 'Broken' Hiring Process
Kelly Jackson Higgins, Executive Editor at Dark Reading,  10/11/2017
Ransomware Grabs Headlines but BEC May Be a Bigger Threat
Marc Wilczek, Digital Strategist & CIO Advisor,  10/12/2017
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Search Cybersecuruty and you will get unicorn.
Current Issue
Security Vulnerabilities: The Next Wave
Just when you thought it was safe, researchers have unveiled a new round of IT security flaws. Is your enterprise ready?
Flash Poll
The State of Ransomware
The State of Ransomware
Ransomware has become one of the most prevalent new cybersecurity threats faced by today's enterprises. This new report from Dark Reading includes feedback from IT and IT security professionals about their organization's ransomware experiences, defense plans, and malware challenges. Find out what they had to say!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.