Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

ABTV

// // //
7/17/2019
01:00 PM
Larry Loeb
Larry Loeb
Larry Loeb

Malvertising Adds Sophistication to Disruption

French security researcher Malekal delved into a murky world.

Eliya Stein, a senior security engineer at French security firm Confiant, was intrigued by what Malekal -- a French security researcher -- found out abouta malvertiser that was present on Microsoft services in France affecting Windows 10 desktops.

What concerned many people is that browser ad blockers wouldn't stop them. That seemed to imply that the malicious actor's effect was only secondary in a browser, and that the malvertising was being created and disseminated by other means than just an in-app placement.

Stein decided to publish what he was finding out about this situation.

The entry point for the served malvertising was initially "ads.creative-serving.com", the ad serving domain used by Platform161, acting as the DSP (realtime ad buying platform). Stein found that the DSP was being used unwittingly, and was not participating in the scheme.

The malvertiser can serve up innocuous code, or issue a redirect if certain criteria are met. Stein reminds us that malvertisers rely on forced redirections in order to drive victims to phishing pages, tech support scams, or drive-by downloads. Also, a large scale malvertiser needs at least some automation in their infrastructure deployments because they need to pivot often in order to maintain persistence. The automation that was chosen by the malvertiser correlates to an extremely reliable attribution formula. The first three letters of the domain are used for the ad serving php script.

This allowed Stein to track historic as well as predicted behavior of the threat actor. He found that in 2019 the attacker went through over 50 domains, all of which are registered at Namecheap.

He was also able to discern that malvertising activity that fits this pattern can be traced back to over 100 additional domains that were active since 2017.

Stein got a tip in March 2019 that pointed to a Hong Kong-based company named "fiber-ads" which fits this business model. He characterized them as a bunch of hucksters from the get-go. "The fiber-ads profile on MyMediAds reveals an active participant in a gray market where advertisers can transact or form joint ventures with hawkers of cheap inventory that has very questionable provenance."

This led to significant impression volume. Over 100 million impressions had been served this year as of mid June. He found that desktop and mobile devices were targeted in relatively equal quantities, but desktop Windows and iOS were also heavily favored by the attacker.

So, the malvertiser affected much more than just Windows 10 desktops. The "middleman" positioning that fiber-ads has chosen in this gray market insulates it from direct exposure. It is a evolution from what is usually seen, and requires more sophistication to pull off. Stein sums up this level of malvertising as, "The middle-men provide the delivery mechanism, but from there the trail can get murky very quickly as the ultimate payload probably goes to the highest bidder, or to whomever the malvertiser is partnered with at that particular moment."

Such a convoluted scheme can be as disruptive as the attackers think they can get away with.

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Improving Enterprise Cybersecurity With XDR
Enterprises are looking at eXtended Detection and Response technologies to improve their abilities to detect, and respond to, threats. While endpoint detection and response is not new to enterprise security, organizations have to improve network visibility, expand data collection and expand threat hunting capabilites if they want their XDR deployments to succeed. This issue of Tech Insights also includes: a market overview for XDR from Omdia, questions to ask before deploying XDR, and an XDR primer.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-37770
PUBLISHED: 2022-06-30
Nucleus CMS v3.71 is affected by a file upload vulnerability. In this vulnerability, we can use upload to change the upload path to the path without the Htaccess file. Upload an Htaccess file and write it to AddType application / x-httpd-php.jpg. In this way, an attacker can upload a picture with sh...
CVE-2021-37778
PUBLISHED: 2022-06-30
There is a buffer overflow in gps-sdr-sim v1.0 when parsing long command line parameters, which can lead to DoS or code execution.
CVE-2013-4146
PUBLISHED: 2022-06-30
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2012-3414. Reason: This candidate is a duplicate of CVE-2012-3414. Notes: All CVE users should reference CVE-2012-3414 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental u...
CVE-2013-4170
PUBLISHED: 2022-06-30
In general, Ember.js escapes or strips any user-supplied content before inserting it in strings that will be sent to innerHTML. However, the `tagName` property of an `Ember.View` was inserted into such a string without being sanitized. This means that if an application assigns a view's `tagName` to ...
CVE-2021-41506
PUBLISHED: 2022-06-30
Xiaongmai AHB7008T-MH-V2, AHB7804R-ELS, AHB7804R-MH-V2, AHB7808R-MS-V2, AHB7808R-MS, AHB7808T-MS-V2, AHB7804R-LMS, HI3518_50H10L_S39 V4.02.R11.7601.Nat.Onvif.20170420, V4.02.R11.Nat.Onvif.20160422, V4.02.R11.7601.Nat.Onvif.20170424, V4.02.R11.Nat.Onvif.20170327, V4.02.R11.Nat.Onvif.20161205, V4.02.R...