Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

ABTV

7/17/2019
01:00 PM
Larry Loeb
Larry Loeb
Larry Loeb
50%
50%

Malvertising Adds Sophistication to Disruption

French security researcher Malekal delved into a murky world.

Eliya Stein, a senior security engineer at French security firm Confiant, was intrigued by what Malekal -- a French security researcher -- found out abouta malvertiser that was present on Microsoft services in France affecting Windows 10 desktops.

What concerned many people is that browser ad blockers wouldn't stop them. That seemed to imply that the malicious actor's effect was only secondary in a browser, and that the malvertising was being created and disseminated by other means than just an in-app placement.

Stein decided to publish what he was finding out about this situation.

The entry point for the served malvertising was initially "ads.creative-serving.com", the ad serving domain used by Platform161, acting as the DSP (realtime ad buying platform). Stein found that the DSP was being used unwittingly, and was not participating in the scheme.

The malvertiser can serve up innocuous code, or issue a redirect if certain criteria are met. Stein reminds us that malvertisers rely on forced redirections in order to drive victims to phishing pages, tech support scams, or drive-by downloads. Also, a large scale malvertiser needs at least some automation in their infrastructure deployments because they need to pivot often in order to maintain persistence. The automation that was chosen by the malvertiser correlates to an extremely reliable attribution formula. The first three letters of the domain are used for the ad serving php script.

This allowed Stein to track historic as well as predicted behavior of the threat actor. He found that in 2019 the attacker went through over 50 domains, all of which are registered at Namecheap.

He was also able to discern that malvertising activity that fits this pattern can be traced back to over 100 additional domains that were active since 2017.

Stein got a tip in March 2019 that pointed to a Hong Kong-based company named "fiber-ads" which fits this business model. He characterized them as a bunch of hucksters from the get-go. "The fiber-ads profile on MyMediAds reveals an active participant in a gray market where advertisers can transact or form joint ventures with hawkers of cheap inventory that has very questionable provenance."

This led to significant impression volume. Over 100 million impressions had been served this year as of mid June. He found that desktop and mobile devices were targeted in relatively equal quantities, but desktop Windows and iOS were also heavily favored by the attacker.

So, the malvertiser affected much more than just Windows 10 desktops. The "middleman" positioning that fiber-ads has chosen in this gray market insulates it from direct exposure. It is a evolution from what is usually seen, and requires more sophistication to pull off. Stein sums up this level of malvertising as, "The middle-men provide the delivery mechanism, but from there the trail can get murky very quickly as the ultimate payload probably goes to the highest bidder, or to whomever the malvertiser is partnered with at that particular moment."

Such a convoluted scheme can be as disruptive as the attackers think they can get away with.

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/2/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-9498
PUBLISHED: 2020-07-02
Apache Guacamole 1.1.0 and older may mishandle pointers involved inprocessing data received via RDP static virtual channels. If a userconnects to a malicious or compromised RDP server, a series ofspecially-crafted PDUs could result in memory corruption, possiblyallowing arbitrary code to be executed...
CVE-2020-3282
PUBLISHED: 2020-07-02
A vulnerability in the web-based management interface of Cisco Unified Communications Manager, Cisco Unified Communications Manager Session Management Edition, Cisco Unified Communications Manager IM & Presence Service, and Cisco Unity Connection could allow an unauthenticated, remote attack...
CVE-2020-5909
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, when users run the command displayed in NGINX Controller user interface (UI) to fetch the agent installer, the server TLS certificate is not verified.
CVE-2020-5910
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the Neural Autonomic Transport System (NATS) messaging services in use by the NGINX Controller do not require any form of authentication, so any successful connection would be authorized.
CVE-2020-5911
PUBLISHED: 2020-07-02
In versions 3.0.0-3.5.0, 2.0.0-2.9.0, and 1.0.1, the NGINX Controller installer starts the download of Kubernetes packages from an HTTP URL On Debian/Ubuntu system.