Vulnerabilities / Threats
9/23/2009
04:55 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Google Urges Cooperation Against Bad Ads, Malware

A malicious ad surfaced in Google search results just as Google called for a more concerted industry effort against such scams.

As if to underscore its call for greater industry cooperation to fight malicious online ads and content, Google allowed a scam ad to appear briefly atop search results on Tuesday for the term "Firefox."

The sponsored link purported to take Google searchers to the official Firefox Web site, but in fact took them to a different domain, firefox.mozilla-now.com, according to Sophos, a computer security company.

Google appears to have removed the ad as a violation of the company's advertising policies.

A company spokesperson declined to comment on the Firefox ad in question, but acknowledged that the company does look for and remove ads that violate its policies.

"Google's advertising policy requires that the Web site address displayed in the ad must match the domain of the landing page for that ad in order to ensure that users clearly understand the destination Web site being advertised," the spokesperson said in an e-mailed statement. "We use a combination of manual and automated processes to detect and enforce these policies."

But the incident underscores the problem that Google and other online companies face in trying to thwart malicious advertising, or malvertising.

Malicious ads have also been spotted this year at nytimes.com. eweek.com, mlb.com, and foxnews.com, among other Web sites and such incidents are becoming more common.

ScanSafe, a security company, on Wednesday said that a large scale malvertising attack had hit popular Web sites, including drudgereport.com, horoscope.com and lyrics.com, over the weekend.

The company said that the ads were delivered by the several advertising networks, including DoubleClick, YieldManager and FastClick.

On Wednesday at the Virus Bulletin conference in Geneva, Switzerland, Eric Davis, head of Google's anti-malvertising team, part of the company's broader anti-malware team, urged ISPs and security companies to work together to fight malicious ads and content. He pointed to the Australian government's Australian Internet Security Initiative, a program to help ISPs identify hijacked PCs (bots) and regain control over them, as an example of cooperative security.

Along those lines, Google earlier this year introduced a custom service engine for conducting background research on online advertisers. In June, the company launched anti-malvertising.com as a home for its custom search engine and as a resource for those fighting malvertising.

Last week, Microsoft, in order to obtain enough information from ISPs to go after the cyber criminals placing malicious ads, filed five lawsuits to halt malvertising through its Ad Exchange.

In a blog post, Microsoft associate general counsel Tim Cranton warned that abuse of online advertising represents a serious threat to the free services available to consumers and businesses.

Such warnings have been heard for years. In late 2007, SANS Internet Storm Center handler William Salusky characterized malicious advertising as "a growing problem that has the potential to effectively place every Internet user at risk."

In its 2009 media predictions, global consulting firm Deloitte warned that malvertising is spreading. "By taking advantage of poor quality control mechanisms for some advertising networks and placing advertisements on trusted sites, the incidence of malvertising is likely to increase in 2009," the firm predicted.

Deloitte's report called for greater education about the threat among Web site publishers and their employees, possible code reviews for advertisements, and the development of tools to automate the screening of third-party advertisements.

Update: Added information from ScanSafe.


Experience both highlights from our InformationWeek conference as well as exclusive content presented in a unique virtual environment that allows you to personally connect with C-level executives. It happens Sept. 23, 2009. Find out more and register.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, January 2015
To find and fix exploits aimed directly at your business, stop waiting for alerts and become a proactive hunter.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3580
Published: 2014-12-18
The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a REPORT request for a resource that does not exist.

CVE-2014-6076
Published: 2014-12-18
IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote attackers to conduct clickjacking attacks via a crafted web site.

CVE-2014-6077
Published: 2014-12-18
Cross-site request forgery (CSRF) vulnerability in IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.

CVE-2014-6078
Published: 2014-12-18
IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 do not have a lockout period after invalid login attempts, which makes it easier for remote attackers to obtain admin access via a brute-force attack.

CVE-2014-6080
Published: 2014-12-18
SQL injection vulnerability in IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.