Feeds

Real Media attacks real people via RealPlayer

Hackers twist ad network into Trojan network

New hybrid storage solutions

Hackers have rooted into a server owned by internet advertising network 24/7 Real Media and used it to serve malware-laced banner ads that tried to circumvent security mechanisms on end users' machines, Symantec researchers said. The malware exploited a previously unknown vulnerability in Real Player that was patched on Friday.

While Real Media no longer appears to be serving the tainted ads, it's possible competing ad networks are launching the same attack, said Alfred Huger, vice president of software engineering at Symantec Security Response.

"There is a very real chance this is not the only server serving up this bad content," he told The Register.

People who use RealPlayer should download a patch, available here as soon as possible, he said. Symantec Antivirus was updated on Thursday to detect the attack. By now, competing antivirus programs are likely to have followed suit.

Real Media has become the latest ad network to be outed as an unwitting ally to cyber crooks. In September, it was disclosed that Yahoo!-owned Right Media served about 12 million ads over three weeks, which silently installed a Trojan back door on unpatched Windows machines. The ads were served on MySpace, PhotoBucket and other popular web destinations.

The complex web of networks provide an ideal vehicle for spreading malware because they attack users who are visiting sites deemed trustworthy. Ads also make it easy to disguise malicious payloads by allowing cyber crooks to infect end users only during certain hours located only in certain geographic parts of the world: in Europe between 12 and 6 a.m., for instance. That makes it harder for researchers to detect and repel the attacks.

Windows users who used Internet Explorer to visit certain sites hosted by Tripod.com and Lycos.com were silently infected if they also had RealPlayer installed, according to a report issued on Symantec's DeepSight Threat Management System. It was possible other trusted web sites that served ads distributed by Real Media also infected users, Huger said. Symantec discovered the tainted ads on October 8. It remains unclear how many ads Real Media served or when the problem was corrected.

An IFrame contained in the tainted ads pointed to malicious code hosted on a server located in the Netherlands that has a history of attacking honeypot machines maintained by Symantec. Vulnerable machines were force-fed code dubbed Trojan.Zonebac, which attempts to disable anti-virus and other third-party security programs, lowers IE security settings and modifies the registry so the program runs each time the computer starts.

It remains unclear how miscreants breached Real Media's server or what steps, if any, the company has taken to prevent a similar incident from happening again. Representatives of New York-based Real Media didn't immediately return calls, which we made outside of business hours on Monday. Real Media is not affiliated with RealNetworks, maker of the RealPlayer program. ®

Secure remote control for conventional and virtual desktops

More from The Register

next story
Google recommends pronounceable passwords
Super Chrome goes into battle with Mr Mxyzptlk
Apple Pay is a tidy payday for Apple with 0.15% cut, sources say
Cupertino slurps 15 cents from every $100 purchase
Reddit wipes clean leaked celeb nudie pics, tells users to zip it
Now we've had all THAT TRAFFIC, we 'deplore' this theft
Enigmail PGP plugin forgets to encrypt mail sent as blind copies
User now 'waiting for the bad guys come and get me with their water-boards'
YouTube, Amazon and Yahoo! caught in malvertising mess
Cisco says 'Kyle and Stan' attack is spreading through compromised ad networks
TorrentLocker unpicked: Crypto coding shocker defeats extortionists
Lousy XOR opens door into which victims can shove a foot
prev story

Whitepapers

Secure remote control for conventional and virtual desktops
Balancing user privacy and privileged access, in accordance with compliance frameworks and legislation. Evaluating any potential remote control choice.
Intelligent flash storage arrays
Tegile Intelligent Storage Arrays with IntelliFlash helps IT boost storage utilization and effciency while delivering unmatched storage savings and performance.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.