Feeds

Yahoo feeds Trojan-laced ads to MySpace and PhotoBucket users

'High risk creative' on out of control web

5 things you didn’t know about cloud backup

A Yahoo-owned advertising network became the unwitting ally of cyber crooks after it spewed millions of Trojan-laced banner ads on MySpace, PhotoBucket and other websites.

The banner ads, which were brokered by Right Media, were served an estimated 12 million times over a three-week period starting in early August, according to ScanSafe, a managed security provider. Earlier this year, Yahoo paid $650m to acquire the 80 percent of the company it didn't already own.

The banners contained a Flash file that silently installed a Trojan back door on unpatched Windows machines that visited the popular web destinations. Using an unpatched version of Internet Explorer while visiting MySpace or PhotoBucket was all that was necessary to become infected. The ads also ran on TheSun.co.uk, Bebo.com and UltimateGuitar.com.

Security Fix reported the story earlier.

Wrong Media

Right Media, "the industry's largest emerging online advertising exchange," is a big believer in the power of open markets. It bills itself as a transparent platform that brings together buyers and sellers of online ads so they can find more favorable terms.

But this gutting of big, long-established intermediaries can have serious consequences for your security. By catering to more than 20,000 advertisers, publishers and networks, it's not always possible to separate legitimate advertisers from the scumbags looking for a new way to push malware onto the machines of millions of unsuspecting people.

While Right Media does attempt to weed out fraudulent advertisers by downloading banners and testing them for malicious code, hackers were able to circumvent these checks by programming the flash file not to attack machines associated with Right Media's internet domain. With this sole safety net removed, it seems there was no other mechanism in place to filter out the hostile ads.

"No one in the chain seems to be validating that these ads are good," said Dan Nadir, ScanSafe's vice president of product strategy. "It will continue to be a problem until there is some verified way of guaranteeing you know who is delivering this ad."

Yahoo! - 'Internet is out of control'

Indeed, the technique of cloaking malicious payloads in legitimate-looking ads isn't new, especially if you're MySpace. In July 2006, an estimated 1 million users of the social network were infected with adware when they were fed tainted banners. Such ruses are particularly pernicious because they attack users as they visit trusted sites, so their guards are down.

In a statement issued by a company spokeswoman, Yahoo said: "The ad has been identified as a high risk creative and banned from the exchange. However, we cannot control what happens elsewhere on the Net. We continue to enhance our protective tools and are committed to finding ways of keeping this type of activity away from consumers and publishers."

She declined to say what Right Media plans to do to prevent this episode from replaying in the future.

We put the same question to representatives of MySpace and PhotoBucket, both of which are owned by Rupert Murdoch's Fox Interactive Media. We had not received a reply as of time of writing.

The Trojan, identified by some security firms as Trojan Downloader.VBS.Agent.n, was distributed on more than 70 ad servers, which alternated between serving legitimate banners and those infected with the malicious payload. The Flash file checked to see if users were 1) using IE on a Windows machine that 2) had not installed the patch described in Microsoft Security Bulletin MS07-009 and 3) were not attached to a domain that belonged to Right Media.

When all three conditions were met, the Flash file dropped an iframe that directed the vulnerable computer to download the Trojan from a server located in the Netherlands, Nadir said. He couldn't say how many people might have been infected. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
One HUNDRED FAMOUS LADIES exposed NUDE online
Celebrity women victimised as Apple iCloud accounts reportedly popped
Rubbish WPS config sees WiFi router keys popped in seconds
Another day, another way in to your home router
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NZ Justice Minister scalped as hacker leaks emails
Grab your popcorn: Subterfuge and slur disrupts election run up
HP: NORKS' cyber spying efforts actually a credible cyberthreat
'Sophisticated' spies, DIY tech and a TROLL ARMY – report
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.