Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

ABTV

7/17/2019
01:00 PM
Larry Loeb
Larry Loeb
Larry Loeb
50%
50%

Malvertising Adds Sophistication to Disruption

French security researcher Malekal delved into a murky world.

Eliya Stein, a senior security engineer at French security firm Confiant, was intrigued by what Malekal -- a French security researcher -- found out abouta malvertiser that was present on Microsoft services in France affecting Windows 10 desktops.

What concerned many people is that browser ad blockers wouldn't stop them. That seemed to imply that the malicious actor's effect was only secondary in a browser, and that the malvertising was being created and disseminated by other means than just an in-app placement.

Stein decided to publish what he was finding out about this situation.

The entry point for the served malvertising was initially "ads.creative-serving.com", the ad serving domain used by Platform161, acting as the DSP (realtime ad buying platform). Stein found that the DSP was being used unwittingly, and was not participating in the scheme.

The malvertiser can serve up innocuous code, or issue a redirect if certain criteria are met. Stein reminds us that malvertisers rely on forced redirections in order to drive victims to phishing pages, tech support scams, or drive-by downloads. Also, a large scale malvertiser needs at least some automation in their infrastructure deployments because they need to pivot often in order to maintain persistence. The automation that was chosen by the malvertiser correlates to an extremely reliable attribution formula. The first three letters of the domain are used for the ad serving php script.

This allowed Stein to track historic as well as predicted behavior of the threat actor. He found that in 2019 the attacker went through over 50 domains, all of which are registered at Namecheap.

He was also able to discern that malvertising activity that fits this pattern can be traced back to over 100 additional domains that were active since 2017.

Stein got a tip in March 2019 that pointed to a Hong Kong-based company named "fiber-ads" which fits this business model. He characterized them as a bunch of hucksters from the get-go. "The fiber-ads profile on MyMediAds reveals an active participant in a gray market where advertisers can transact or form joint ventures with hawkers of cheap inventory that has very questionable provenance."

This led to significant impression volume. Over 100 million impressions had been served this year as of mid June. He found that desktop and mobile devices were targeted in relatively equal quantities, but desktop Windows and iOS were also heavily favored by the attacker.

So, the malvertiser affected much more than just Windows 10 desktops. The "middleman" positioning that fiber-ads has chosen in this gray market insulates it from direct exposure. It is a evolution from what is usually seen, and requires more sophistication to pull off. Stein sums up this level of malvertising as, "The middle-men provide the delivery mechanism, but from there the trail can get murky very quickly as the ultimate payload probably goes to the highest bidder, or to whomever the malvertiser is partnered with at that particular moment."

Such a convoluted scheme can be as disruptive as the attackers think they can get away with.

— Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek.

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/25/2020
Hacking Yourself: Marie Moe and Pacemaker Security
Gary McGraw Ph.D., Co-founder Berryville Institute of Machine Learning,  9/21/2020
Startup Aims to Map and Track All the IT and Security Things
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25136
PUBLISHED: 2020-09-25
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files (even though li...
CVE-2020-25135
PUBLISHED: 2020-09-25
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to Cross-Site Scripting (XSS) due to the fact that it is possible to inject and store malicious JavaScript code within it. This can occur via the graph_title parameter to the graphs/ URI.
CVE-2020-25134
PUBLISHED: 2020-09-25
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files (even though li...
CVE-2020-25133
PUBLISHED: 2020-09-25
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to directory traversal and local file inclusion due to the fact that there is an unrestricted possibility of loading any file with an inc.php extension. Inclusion of other files (even though li...
CVE-2020-25132
PUBLISHED: 2020-09-25
An issue was discovered in Observium Professional, Enterprise & Community 20.8.10631. It is vulnerable to SQL Injection due to the fact that it is possible to inject malicious SQL statements in malformed parameter types. Sending the improper variable type Array allows a bypass of core SQL Inject...