Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


Yahoo Ads Hack Spreads Malware

Millions of users exposed to drive-by malware attacks that targeted Java bugs to install six types of malicious code.

Yahoo.com visitors received an unexpected surprise beginning on New Year's Eve: advertisements that targeted their systems with malware.

The malicious advertising campaign was first spotted on Friday by Dutch information security consulting firm Fox-IT, which immediately warned Yahoo. Fox-IT said in a blog post that the attack advertisements -- which were being served by ads.yahoo.com -- used iFrames to hide malicious scripts. If a user clicked on the advertisement, they were redirected to a site that hosted the "Magnitude" exploit kit, which then attempted to exploit any Java vulnerabilities present on their system to install malware.

"The attackers are clearly financially motivated and seem to offer services to other actors," said Fox-IT, noting that the exploit kit behind the attacks dropped six different types of malware, including the Zeus banking Trojan, Dorkbot, and a click-fraud Trojan. The greatest number of users targeted by the malicious advertisements were in Romania (24%), the United Kingdom (23%), and France (20%), according to Fox-IT.

By late Friday, Fox-IT reported that "traffic to the exploit kit has significantly decreased," meaning that whatever steps Yahoo was taking to block the attack appeared to be working.

[For more on recent security threats, see Snapchat Breach: What's Next.]

How long did the attacks last? Fox-IT said the attacks appeared to have begun on Monday, Dec. 30. Yahoo initially disagreed, saying in a statement on Friday, Jan. 3, that the attacks had started that day.

But by Monday, the company had revised its assessment. "Upon further investigation, we discovered that the advertisements were served between December 31 [to] January 3 -- not just on January 3," a company spokeswoman said via email.

Yahoo said it acted quickly after learning of the attacks, and said they appeared to target only European users. "These advertisements were taken down on Friday, January 3," the spokeswoman said. "Users in North America, Asia Pacific, and Latin America were not served these advertisements, and were not affected. Additionally, users using Macs and mobile devices were also not affected."

"We will continue to monitor and block any advertisements being used for this activity," she added. "We will be posting more information for our users shortly."

How many Yahoo.com visitors may have been exploited by the attacks? By Fox-IT's reckoning, based on the sample traffic it recorded -- about 300,000 visitors to the malicious site per hour -- and malware being dropped onto an average of 9% of those systems, it's likely that about 27,000 systems were infected every hour. Assuming that the attack campaign lasted for three days, that means 2 million Yahoo users may have been infected by malware via the attack campaign.

Who launched the attacks? That's not clear, although the exploit kit used by attackers "bears similarities to the one used in the brief infection of PHP.net in October 2013," said Fox-IT. In that attack, two of the servers running the PHP.net site were hacked and used to serve JavaScript malware.

This isn't the first information security or infrastructure snafu to affect Yahoo users in recent months. In September, the company introduced a "Not My Email" button after users of recycled account names reported that they'd received sensitive personal information intended for former accountholders.

Last month, meanwhile, some users of Yahoo Mail -- which CEO Marissa Mayer has made a priority of overhauling, and which was redesigned in June 2013 -- were unable to access their webmail for up to three days. Yahoo's senior VP of communications products, Jeff Bonforte, apologized for the email outage, which he said resulted from "a hardware problem in one of our mail data centers," and which had been "harder to fix than we originally expected."

Mathew Schwartz is a freelance writer, editor, and photographer, as well the InformationWeek information security reporter.

Knowing your enemy is the first step in guarding against him. In this Dark Reading report, Integrating Vulnerability Management Into The Application Development Process, we examine the world of cybercriminals -- including their motives, resources and processes -- and recommend what enterprises should do to keep their data and computing systems safe in the face of an ever-growing and ever-more-sophisticated threat. (Free registration required.)

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
Li Tan
Li Tan,
User Rank: Apprentice
1/8/2014 | 10:57:37 PM
Re: Another Yahoo problem
That's also the reason why I do not like online Ads - the potential problem of having virus/malware, etc. embedded. Yahoo is good at putting out fire but it cannot survive in this way. Some concrete action plans are needed to prevent such kind of disaster happening from the very beginning. 
Shane M. O'Neill
Shane M. O'Neill,
User Rank: Apprentice
1/7/2014 | 9:50:11 AM
Re: Another Yahoo problem
Yahoo may work quickly to quash email outages and malware-infested ads when they happen, and these snafus may be just part of doing business, but the past month has been a PR disaster for the company. I don't think it's enough to do serious damage to the brand; Yahoo still has millions of content users. But the company needs to shake the perception that it is always putting out fires.
Kristin Burnham
Kristin Burnham,
User Rank: Apprentice
1/7/2014 | 8:50:27 AM
Re: Another Yahoo problem
Good insight, Jason. Dedicated Yahoo users -- similar to dedicated Facebook users -- seem to roll with the punches when things like this occur.
User Rank: Apprentice
1/7/2014 | 7:45:40 AM
Re: Another Yahoo problem
This is good insight.  The way advertising has always worked on the web is a bit different than say print media.  It is much harder to keep tabs on what is behind the curtain with ads delivered on the web so it's hard to hold Yahoo completely responsible for stopping the ads.  Now once they learned that there was a problem then yes the burden of removing the ads fell on them but it sounds like they acted quickly.  If we're going to hold every web site that has ads responsible for the content of those ads then it's time to start shutting everyone down because I've seen those scammy "lose 10 pounds in a week" ads just about every where.
User Rank: Ninja
1/7/2014 | 7:38:22 AM
Re: Another Yahoo problem
No, it fits exactly into the perception I have from Yahoo. They want to play with the big kids, but lack the skill to do so. Yahoo is one of these companies where I wonder how they managed to stick around despite their utter irrelevance.
User Rank: Apprentice
1/6/2014 | 9:21:39 PM
Re: Another Yahoo problem
Having spent 10 years working for a regional news & information site, I have first-hand knowledge of how hard it is to prevent malicious ads from being delivered to end-users. Many larger advertisers supply code that communicates with their servers (or those of some third party) to select an ad based on various criteria ... so the code that was provided to Yahoo! may have appeared fine ... but the ad that was dynamically returned contained malicious code. Sometimes it's even more convoluted than that.

So this issue doesn't affect my concerns about Yahoo!.

Nor does it trouble me that Yahoo! is replacing the rotting foundations of some of its systems. That's smart, and hopefully they're implementing new foundations upon which they'll launch new services, soon.

These days, it's less likely that Yahoo! or anyone else will introduce some revolutionary new service. Yahoo! has enough of a user base that if they can repair things and have solid, reliable services, they'll do fine. In fact, if they can offer a good alternative to the questionably-invasive services offered by certain other providers, they could very well pick up a bunch of users.

Personally, I have a Yahoo! account that I use daily, and have for about 7 years now, and it works well for me. (I was unaffected by the recent outage, btw ... that would have bothered me somewhat, but mail to the account isn't usually critical/time-sensitive.)

I will say that the recycled email account usernames was just a poor business decision on their part ... or at the very least poorly carried out. But, again, it didn't affect me, since my account has been in use for years.
Thomas Claburn
Thomas Claburn,
User Rank: Ninja
1/6/2014 | 3:52:34 PM
Re: Another Yahoo problem
I keep hoping Yahoo will do something that demonstrates it has put its past behind it. But most of the company's recent moves seem to be geared at replacing rotting foundations. I hope 2014 brings some initiatives that show leadership rather than just acknowledgement of existing gaps.
Kristin Burnham
Kristin Burnham,
User Rank: Apprentice
1/6/2014 | 2:01:25 PM
Another Yahoo problem
Yahoo has made some significant strides with redesigns, acquisitions and new features in the last year, but it has also suffered some major problems: the recycled email debacle being one of them, and now this. Readers: Does this latest problem impact your perception of the company?
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
Everything You Need to Know About DNS Attacks
It's important to understand DNS, potential attacks against it, and the tools and techniques required to defend DNS infrastructure. This report answers all the questions you were afraid to ask. Domain Name Service (DNS) is a critical part of any organization's digital infrastructure, but it's also one of the least understood. DNS is designed to be invisible to business professionals, IT stakeholders, and many security professionals, but DNS's threat surface is large and widely targeted. Attackers are causing a great deal of damage with an array of attacks such as denial of service, DNS cache poisoning, DNS hijackin, DNS tunneling, and DNS dangling. They are using DNS infrastructure to take control of inbound and outbound communications and preventing users from accessing the applications they are looking for. To stop attacks on DNS, security teams need to shore up the organization's security hygiene around DNS infrastructure, implement controls such as DNSSEC, and monitor DNS traffic
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences. Cross site scripting (XSS) can be triggered by review volumes. This issue has been fixed in version 4.4.7.
PUBLISHED: 2023-05-26
Django-SES is a drop-in mail backend for Django. The django_ses library implements a mail backend for Django using AWS Simple Email Service. The library exports the `SESEventWebhookView class` intended to receive signed requests from AWS to handle email bounces, subscriptions, etc. These requests ar...
PUBLISHED: 2023-05-26
Highlight is an open source, full-stack monitoring platform. Highlight may record passwords on customer deployments when a password html input is switched to `type="text"` via a javascript "Show Password" button. This differs from the expected behavior which always obfuscates `ty...
PUBLISHED: 2023-05-26
Craft is a CMS for creating custom digital experiences on the web.The platform does not filter input and encode output in Quick Post validation error message, which can deliver an XSS payload. Old CVE fixed the XSS in label HTML but didn’t fix it when clicking save. This issue was...
PUBLISHED: 2023-05-26
GDSDB infinite loop in Wireshark 4.0.0 to 4.0.5 and 3.6.0 to 3.6.13 allows denial of service via packet injection or crafted capture file