Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

1/16/2015
10:15 AM
Peter Zavlaris
Peter Zavlaris
Commentary
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail vvv
100%
0%

The Truth About Malvertising

Malvertising accounts for huge amounts of cyberfraud and identity theft. Yet there is still no consensus on who is responsible for addressing these threats.

Malicious advertisements, or “malvertising” for short, present arguably the fastest growing and least understood online threat today. The technique, used to distribute malware on popular websites via online advertising networks, was responsible for an exponential number of attacks in 2014. This past week, The Huffington Post and several major websites presented visitors with advertisements that infected computers with ransomware, locked them down, and demanded money from victims to get back control of their devices.

The danger
Malvertisements can appear on any website at any given time, and there is little that the website owner can do to prevent them. That’s because they are planted on Web pages via third-party ad delivery networks. These networks auction website placements to advertisers using a high bid, free market system. There is currently very little oversight in this industry.

This system was built for efficiency, so the marketplace has very little regulation to force better security practices. To make matters worse, malvertisers use various techniques to disguise the true purpose of their advertisements, often building entire infrastructures designed to redirect users between URLs. Finding offenders that are impersonating brands with fake software updates in this marketplace is extremely difficult.

Digital marketing is big business
According to a report compiled by eMarketer, the worldwide paid media market is estimated at $545 billion, and it will increase by approximately 5% for the foreseeable future. This industry funds the “free” websites we all know and enjoy online, and malvertising is a major threat to their continued success and expansion.

[Find out how Operation DeathClick put a new twist on an old method of infecting users in Sophisticated Malvertising Campaign Targets US Defense Industry.]

In the third quarter of 2014 alone, almost 200,000 malvertising examples were detected on live websites. The chart below ranks these by type of attack.

(Source: RiskIQ Global Network)
(Source: RiskIQ Global Network)

What makes malvertising insidious is its ability to hide and deliver malware using an Internet-wide infrastructure that can target specific types of users. Since malicious ads do not persist once a user session is terminated, they’re extremely difficult to detect and track. Worst of all there is still a lot of grey area regarding who exactly should be solving this problem. Meanwhile, consumers and their personal data are being put at risk.

Why should we be concerned?
There are several reasons. First, malvertising accounts for huge sums of financial fraud and is responsible for the theft of personally identifiable data. Meanwhile, most organizations lack the tools to monitor and mitigate this problem. Since there still isn’t any consensus on who is responsible for addressing these threats, no formal processes have been put in place and the problem continues to increase in size and velocity.

The onus is on advertisers and publishers to take the necessary steps to address malvertising and limit the spread of malware on their networks. Until then, it is their customers, the consumers, who remain in the crosshairs.

Peter Zavlaris is one of the primary analysts and contributors to the RiskIQ blog, which provides weekly insights on the latest threats and attacks that target companies outside the firewall and put customers at risk. He has held various customer satisfaction positions with ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
macker490
50%
50%
macker490,
User Rank: Ninja
1/17/2015 | 9:51:31 AM
who is responsible?
until the laws regarding product liability are changed the system owner is responsible.

I am considering running my browser in a "NamedSpace" such as "firejail"  -- as my response to this question.

 
PZav
50%
50%
PZav,
User Rank: Author
1/19/2015 | 12:15:47 PM
Re: who is responsible?
Maybe one of the biggest concerns is the harm malvertising will cause to the Internet economy, which is fueled by digital advertising. 
Marilyn Cohodas
100%
0%
Marilyn Cohodas,
User Rank: Strategist
1/20/2015 | 9:04:17 AM
Re: who is responsible? onus on advertisers and publishers
I wouldn't hold my breath for advertisers and publishers to be proactive about malvertising -- at least not any time soon. Retailers have certainly been a major target of attacks and look at their track record at getting ahead of the hackers...
PZav
50%
50%
PZav,
User Rank: Author
1/20/2015 | 4:02:55 PM
Re: who is responsible? onus on advertisers and publishers
History is on your side Marilyn! I do wonder if this is recognized as a consumer facing problem, if brands will take it more seriously though. It seemed like with the POS breaches that the banks were really the ones left holding the bag. But malvertising reaches personal computers. Time will tell! Thanks for the comment.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
1/21/2015 | 8:48:34 AM
Re: who is responsible? onus on advertisers and publishers
It's hard to know who should take the lead for malvertising prevention -- or the blame for the problem in the first place. Yes, it's a consumer problem via personal computers. But so is a  lot of garden variety malware. Maybe ISPs should provide consumers with better controls ?
PZav
50%
50%
PZav,
User Rank: Author
1/21/2015 | 7:48:35 PM
Re: who is responsible? onus on advertisers and publishers
The reason ISPs won't get involved is because its a slippery slope for them. If they created controls for something like bad adverstisements, then media outlets would start putting pressure on them to curb pirating. Its the same issue for search engines. Plus there is the whole privacy can of worms as well. How closely do they have to look at our traffic to setup meaningful controls? As soon as they're viewed as anything more than a transit system, they begin to take on a lot more responsibility. Its too much of a liability.  
Chris Weltzien
50%
50%
Chris Weltzien,
User Rank: Author
1/20/2015 | 5:31:59 PM
Re: who is responsible? onus on advertisers and publishers
This problem has been brewing for a while. We saw it back in 2007 at Exploit Prevention Labs when it was just starting to surface and when we uncovered some some malicious Google Ads campaigns USA Today ran an article on it. (can't link to it in comments)  More recently the Senate had hearings on it in the spring of 2014, where ad networks were called out for ignoring the problem. If you are looking to protect yourself AVG's LinkScanner is a real-time client side solution, if you are looking for someone to take responsibility I wouldn't hold your breath. 
Aviation Faces Increasing Cybersecurity Scrutiny
Kelly Jackson Higgins, Executive Editor at Dark Reading,  8/22/2019
Microsoft Tops Phishers' Favorite Brands as Facebook Spikes
Kelly Sheridan, Staff Editor, Dark Reading,  8/22/2019
Capital One Breach: What Security Teams Can Do Now
Dr. Richard Gold, Head of Security Engineering at Digital Shadows,  8/23/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15540
PUBLISHED: 2019-08-25
filters/filter-cso/filter-stream.c in the CSO filter in libMirage 3.2.2 in CDemu does not validate the part size, triggering a heap-based buffer overflow that can lead to root access by a local Linux user.
CVE-2019-15538
PUBLISHED: 2019-08-25
An issue was discovered in xfs_setattr_nonsize in fs/xfs/xfs_iops.c in the Linux kernel through 5.2.9. XFS partially wedges when a chgrp fails on account of being out of disk quota. xfs_setattr_nonsize is failing to unlock the ILOCK after the xfs_qm_vop_chown_reserve call fails. This is primarily a ...
CVE-2016-6154
PUBLISHED: 2019-08-23
The authentication applet in Watchguard Fireware 11.11 Operating System has reflected XSS (this can also cause an open redirect).
CVE-2019-5594
PUBLISHED: 2019-08-23
An Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") in Fortinet FortiNAC 8.3.0 to 8.3.6 and 8.5.0 admin webUI may allow an unauthenticated attacker to perform a reflected XSS attack via the search field in the webUI.
CVE-2019-6695
PUBLISHED: 2019-08-23
Lack of root file system integrity checking in Fortinet FortiManager VM application images of all versions below 6.2.1 may allow an attacker to implant third-party programs by recreating the image through specific methods.