Feeds

Ad networks owned by Google, Microsoft serve malware

Javascript obfuscation

Remote control for virtualized desktops

Two of the world's biggest ad serving networks – one owned by Google and the other by Microsoft – have been caught delivering booby-trapped banner ads that infect computers with malware without any action required on the part of the end user.

The ads on Google's DoubleClick and Microsoft's rad.msn.com contained heavily obfuscated javascript in an attempt to conceal the attack, according to an analysis by web security firm Armorize. As a result, people surfing to Scout.com, MSNBC.com and other sites that relied on the ad platforms were surreptitiously attacked by malicious code that in many cases was able to install malware without any warning.

Among the titles silently thrust on marks was HDD Plus, a piece of malware that falsely claims users have serious system errors that can only be fixed by buying a premium version of the program. The tainted banner ads used code from the Eleonore and Neosploit crimeware kits to exploit at least seven previously patched vulnerabilities in applications such as Adobe Reader, Oracle's Java, and Microsoft's Internet Explorer.

The attacks are only the latest to get past gatekeepers at DoubleClick and other large networks, which are used by smaller websites to deliver ads. In September 2009 a torrent of malicious ads flooded DoubleClick, Yahoo's Right Media and FastClick, a platform owned by ValueClick. Over the past few years there have been at least half a dozen similar breaches. An ad platform is a huge advantage to malware attackers because it allows them to get their exploits in front of potentially millions of people who have no reason to believe they're under threat.

In the attack documented by Armorize, the miscreants appear to have tricked account managers with the use of ADShufffle.com, a domain that fed the malicious banners. The address was designed to look to AdShuffle.com, which regularly works with ad platforms.

“We can confirm that the DoubleClick Ad Exchange, which has automatic malware filters, independently detected several creatives containing malware, and blocked them instantly - within seconds,” a Google spokesman said in an email. “Our security team is in touch with Armorize to help investigate and help remove any affected creatives from any other ad platforms.”

The email didn't say how the tainted ads got carried on DoubleClick or how similar attacks could be prevented in the future.

A Microsoft spokeswoman said the company is investigating the report. ®

Remote control for virtualized desktops

More from The Register

next story
Regin: The super-spyware the security industry has been silent about
NSA fingered as likely source of complex malware family
Why did it take antivirus giants YEARS to drill into super-scary Regin? Symantec responds...
FYI this isn't just going to target Windows, Linux and OS X fans
Privacy bods offer GOV SPY VICTIMS a FREE SPYWARE SNIFFER
Looks for gov malware that evades most antivirus
Home Office: Fancy flogging us some SECRET SPY GEAR?
If you do, tell NOBODY what it's for or how it works
Patch NOW! Microsoft slings emergency bug fix at Windows admins
Vulnerability promotes lusers to domain overlords ... oops
HACKERS can DELETE SURVEILLANCE DVRS remotely – report
Hikvision devices wide open to hacking, claim securobods
'Regin': The 'New Stuxnet' spook-grade SOFTWARE WEAPON described
'A degree of technical competence rarely seen'
Syrian Electronic Army in news site 'hack' POP-UP MAYHEM
Gigya redirect exploit blamed for pop-rageous ploy
prev story

Whitepapers

Designing and building an open ITOA architecture
Learn about a new IT data taxonomy defined by the four data sources of IT visibility: wire, machine, agent, and synthetic data sets.
Getting started with customer-focused identity management
Learn why identity is a fundamental requirement to digital growth, and how without it there is no way to identify and engage customers in a meaningful way.
10 threats to successful enterprise endpoint backup
10 threats to a successful backup including issues with BYOD, slow backups and ineffective security.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
10 ways wire data helps conquer IT complexity
IT teams can automatically detect problems across the IT environment, spot data theft, select unique pieces of transaction payloads to send to a data source, and more.