Feeds

Ad networks owned by Google, Microsoft serve malware

Javascript obfuscation

Securing Web Applications Made Simple and Scalable

Two of the world's biggest ad serving networks – one owned by Google and the other by Microsoft – have been caught delivering booby-trapped banner ads that infect computers with malware without any action required on the part of the end user.

The ads on Google's DoubleClick and Microsoft's rad.msn.com contained heavily obfuscated javascript in an attempt to conceal the attack, according to an analysis by web security firm Armorize. As a result, people surfing to Scout.com, MSNBC.com and other sites that relied on the ad platforms were surreptitiously attacked by malicious code that in many cases was able to install malware without any warning.

Among the titles silently thrust on marks was HDD Plus, a piece of malware that falsely claims users have serious system errors that can only be fixed by buying a premium version of the program. The tainted banner ads used code from the Eleonore and Neosploit crimeware kits to exploit at least seven previously patched vulnerabilities in applications such as Adobe Reader, Oracle's Java, and Microsoft's Internet Explorer.

The attacks are only the latest to get past gatekeepers at DoubleClick and other large networks, which are used by smaller websites to deliver ads. In September 2009 a torrent of malicious ads flooded DoubleClick, Yahoo's Right Media and FastClick, a platform owned by ValueClick. Over the past few years there have been at least half a dozen similar breaches. An ad platform is a huge advantage to malware attackers because it allows them to get their exploits in front of potentially millions of people who have no reason to believe they're under threat.

In the attack documented by Armorize, the miscreants appear to have tricked account managers with the use of ADShufffle.com, a domain that fed the malicious banners. The address was designed to look to AdShuffle.com, which regularly works with ad platforms.

“We can confirm that the DoubleClick Ad Exchange, which has automatic malware filters, independently detected several creatives containing malware, and blocked them instantly - within seconds,” a Google spokesman said in an email. “Our security team is in touch with Armorize to help investigate and help remove any affected creatives from any other ad platforms.”

The email didn't say how the tainted ads got carried on DoubleClick or how similar attacks could be prevented in the future.

A Microsoft spokeswoman said the company is investigating the report. ®

The smart choice: opportunity from uncertainty

More from The Register

next story
Mozilla fixes CRITICAL security holes in Firefox, urges v31 upgrade
Misc memory hazards 'could be exploited' - and guess what, one's a Javascript vuln
Manic malware Mayhem spreads through Linux, FreeBSD web servers
And how Google could cripple infection rate in a second
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Don't look, Snowden: Security biz chases Tails with zero-day flaws alert
Exodus vows not to sell secrets of whistleblower's favorite OS
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
prev story

Whitepapers

Top three mobile application threats
Prevent sensitive data leakage over insecure channels or stolen mobile devices.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Designing a Defense for Mobile Applications
Learn about the various considerations for defending mobile applications - from the application architecture itself to the myriad testing technologies.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.