Ads--the new malware delivery format
Instead of hacking into major online sites to embed malware, malicious hackers are going in through the front door by exploiting security holes in systems for delivering ads.
It happened just days ago, for instance, to the Web site of The New York Times. The newspaper company informed readers on Sunday about a rogue ad that was popping up on its site. The ad warned visitors to NYTimes.com that their computer may be infected with a virus and redirected them to a site that purports to scan the computer and offers to sell antivirus software.
This is common behavior for what is known as fake security alerts, or "scareware," designed to trick people into paying for something they don't need. Use of this type of scam is on the rise.
Typically, the site hosting the rogue alerts has been compromised, or a worm, like Conficker, distributes the alerts directly to computers.
On his blog Input & Output, Seven Scale CEO Troy Davis offers an analysis of the scareware ad that appeared on NYTimes.com.
(Credit: Troy Davis)"I think there is a problem with ad networks, in general," said Graham Cluley, a Sophos security researcher. "The problem really is with Web sites handing over control of some of their content to third parties."
The rogue ad on NYTimes.com was delivered by an unknown ad delivery firm after the newspaper agreed to run an ad for a week from a company posing as Internet telephony provider Vonage, according to New York Times spokeswoman Diane McNulty. Initially, a legitimate-looking ad was running, but that was switched with the fake antivirus alerts, possibly on Friday, she said.
"In the future, we will not allow any advertiser to use unfamiliar third-party vendors," McNulty is quoted as saying. (McNulty did not respond to e-mail questions posed by CNET News on Monday and Tuesday.)
Several news organizations were targeted in the rogue ad scam, according to a New York Times statement.
One of them was SFGate.com, the site for the San Francisco Chronicle, a Chronicle spokeswoman told The New York Times. (Calls from CNET News were not returned on Monday and Tuesday.) "We did get hit with something over the weekend," Kelly Harville, a vice president of marketing at the newspaper, is quoted as saying.
"This isn't uncommon," said Michael Caruso, founder and chief executive of Clickfacts. Scammers "come in looking like one thing. They spoof the email addresses, even get good references for their credit and run a car ad. It happened with a Lexus ad a couple of weeks ago...They change the content out at the content delivery network."
ClickFacts, which started out helping advertisers defend against click fraud, also offers an ad scanning service for Web sites and ad networks that audits ad content for things like malware. For instance, ClickFacts is monitoring the ads that appear on News Corp.'s Fox site, which previously was hit by rogue scareware, Caruso said.
"We proactively scan the ads before they are delivered and then continuously scan them from many IP ranges around the world to make sure they're not launching adware," he said.
Many ad networks are scanning ads manually, but ad content can easily be changed after a manual scan is done, Caruso said. In addition, he said, a malicious ad "could be placed in anywhere" because sites often have other companies sell their ad inventory.
For example, two years ago Trojan horse software was discovered in banner ads that an ad network was serving up via Yahoo's Right Media Exchange to MySpace, Photobucket, Bebo, and other high-traffic sites.
The rogue ads pose a number of problems. First, they can download malware to a computer once the ad is clicked on. The malware can include Trojans, back doors, and keystroke loggers and can be used by the scammers to commandeer the computer to send spam or launch attacks on other computers, according to Cluley.
Then, if someone falls for the ruse and provides credit card and other billing information, the scammers have sensitive financial data that can be used for identity fraud.
"Identity theft is the purpose behind the ads," said Caruso.
Elinor Mills covers Internet security and privacy. She joined CNET News in 2005 after working as a foreign correspondent for Reuters in Portugal and writing for The Industry Standard, the IDG News Service, and the Associated Press. E-mail Elinor. 
I use a Mac.
(and yep it's gone now, but I saw a similar posting for the same thing on another article here).
Why can't we find these people via IP address and arrest them within 8 hours of doing a ping,whois???
The lack of willpower and host providers need to be at fault for not securing the sites.
Name the names and their home address VIA GOOGLE MAPS with a sign that says these are the people infecting your PC.......... WHY WHY WHY?!?!!?
I feel I might do just that pretty soon.
The malware is hosted on ISPs who often turn a blind eye to it. For example, one of these phony antivirus sites continued to be hosted on American ISP The Planet for months even after they were notified multiple times that they were hosting malware. Malware authors may host the phony antivirus malware on thousands of Web sites; that's a lot of money for an ISP to turn down, especially in a recession.
I hit at CNET pretty hard because they were allowing ads for trojans and cialis on their site. No offense that is the last thing I want to see when I come to this site. However the marketing department don't really care as long as they have revenue streaming in.
I was at the NYTimes site on Sunday, but I definitely knew something was up when it showed a scan of a Windows system and I'm running Ubuntu.
The reason for my comment is just to get a quick thing off my chest.
"Ads--the new <a href="http://www.sophos.com/products/malware-protection/">malware</a>
delivery format"
Are you serious with that title? How about: Ads, the oldest malware delivery format we have..
Delivering malware through ads is one of the most tried and true methods of infecting a system. I just cannot understand how the author is serious with this title..
Just like the spam problem, jerks spam because enough people idiotically click that link, and place an "order" or update their supposed account, or help that nice eastern European lady hide her assets from her mean brothers.
Actually it won't if web sites properly adapt. A simple change would be to make all adds not clickable. Revenue would be based on traffic, just like TV and lots of other places. The ad could post the website address, but no large urls, nothing more complex that subdomain.domain.com/product_name.
Maybe I am just an oddball, outside of the occasional movie trailer or event ad, I don't buy things because of ads. I do however, purposely not buy things because an ad annoyed me(ie obnoxious cereal commercials with loud crunching the whole time). I never really bought the corporate line unlike most people apparently.
Actually you aren't that much of an oddball. Advertisers generally have high cost per acquisition because most people ignore advertising messages. Only a relatively successful ad will get more than a few percentage of its' viewers to convert into customers.
Seriously...why doesn't everyone? All the time? Everywhere?
- by Pride73170 September 16, 2009 11:06 AM PDT
- I had almost completely made the switch to Google Chrome when one of these sites bit my laptop. I didn't click on any ads on the page. When I tried to close the pop-up window, it started a fake scan in the window. I had to force Chrome to close and then ran a McAfee scan and it quarantined a nice trojan for me. It's the first one I've seen in years. One of the reasons I'd switched to Chrome was that it had been doing a better job of blocking pop-ups (versus Firefox) reputable sites that I frequently visit. We need to decriminalize marijuana and use those funds for prosecution of malware creators. Then we can all smoke up and surf, worry free. Just kidding...I have kids...I would never smoke that stuff!
- Like this Reply to this comment
-
Showing 1 of 2 pages (36 Comments)