How hack on 10,000 WordPress sites was used to launch an epic malvertising campaign Security researchers at Check Point have lifted the lid on the infrastructure and methods of an enormous "malvertising" and banking trojan campaign. The operation delivered malicious adverts to millions worldwide, slinging all manner of nasties including crypto-miners, ransomware and banking trojans. The researchers told The …
.. have people being saying how the "ad industry" was just totally dodgy .. Most people I know that have adblock software are using it as malware protection because we all know the ad system is used to sling Trojans etc. Blocking / script barring as PC protection has long been necessary as malware has been ad dispensed for ages.
"Most people I know that have adblock software are using it as malware protection"
This! As I just posted the other day, the El Reg domain is white listed in my uBlock and NoScript add-ons, but 3rd party sites are not white listed. I see no ads on El Reg. If El Reg can serve their own ads, not only will I see them, but they will be able to control (and be responsible for) the ads we see.
Our local newspaper doesn't allow us to read it because I installed an adblocker on every browser - the wife figured this out and turned it off. An hour later she calls me, "There a box on the screen saying that we're infected with 5,682 different viruses and it will cost $99 to clear them from the computer" - luckily she just panicked and pull the plug out of the wall so all I had to do was clear the cache and turn the adblocker back on when I got home.
For the most part, nobody in the organization complains about this. Go figure. But, there was one news site, Forbes, that refused content when detecting blocked ads, and some people actually asked that it be allowed--which we didn't do. Last I checked, Forbes works a little differently now.
How to Fix It:
If you want to use ads to monetize content, it's either going to take an ad network or other vehicle that'll take responsibility for any infections. And, that might take being able to sue those who infect people by using tainted ad providers. But, I'm not holding out for this.
How to Fix It 2:
Develop a proper micropayment architecture that avoids the need for shitty adverts and casts web-marketeers into a dark, silent abyss where they belong for all time.
The actual "value per view" for an ad-funded website is trivial, and they probably could charge most reader's more than we "pay" through adverts. Unfortunately the dinosaurs (like daily news papers) are obsessed with wildly expensive monthly or annual subscriptions, and other websites refuse to understand that most users don't want to register their details individually webshite by webshite.
"an ad network or other vehicle that'll take responsibility for any infections"
You may as well wish for a unicorn -- that's just as likely to turn up. Besides, it's the ad networks that are the primary problem. I'll never trust an ad from a network. I have no problem trusting ads that are hosted by the site I'm viewing, have no connection to an ad network of any sort, and contains no javascript or other code.
Reading between the lines, I assume that the ad brokers simply didn't screen the ads they were pushing - hence allowing the primary scum to use them to push the malware out. So the ad slingers are secondary scum - not actually producing the malware themselves, but taking money to do so for 3rd parties.
So we have a system where web site owners rely on third parties to provide "content" in the form of adverts in return for a share of the proceeds. OK, nothing fundamentally wrong with that IMO - it's just what every newspaper and magazine does in order to stay afloat. But these 3rd parties are not smart enough to filter out malware before serving it, presumably trusting their customers (the advert providers) who presumably "pinky swear" not to stuff anything bad in.
TL;DR version - system relying on trust fails when some actors are not trustworthy.
What could possibly go wrong there.
Icon says it all.
Here I was thinking that "ad brokers" were basically "ad aggregators", but that's not really true. They are "hole aggregators", aiming to fill the holes on all those web pages. When they run out of jewels and gems, they fill the holes with turds, though wrapped in toilet paper sometimes. They turn your browser into a latrine. You knew this...
> Check Point said the criminals made a laughing stock of the legitimate online advertising ecosystem.
The crims are really a bit late to that particular party. But at least they are making some money out of it.
None of this changes until someone starts suing the legitimate parts of the chain for actual damage incurred such as from a ransomware infection(*). IANAL - anyone know how that would/could/should work? Can a web site that serves up 3rd party malware legitimately be held responsible (in any jusrisdiction)?
I'm currently retaining the legal representation of Messrs. N. O'script, P. Badger and U. Block.
by DEFAULT, EVERY browser should block every 3rd party cookie and javascript.
Some domains should be always blacklisted.
User can whitelist, once off.
Why do people have to install noScript (used to use it), uMatrix (current on Firefox on all my platforms), uBlock etc?
Far more effective than AV SW and speeds up rather than slows computer use!
"El Reg invited AdsTerra, AdKernel, AdventureFeeds and EvoLeads to comment. We'll update this story as and when we get a response."
And there's some more to add to the DNS block list. I need a full list so I can block all of them. Ad block software not needed, and it's not detectable since it's running on my own server.
"And there's some more to add to the DNS block list. I need a full list so I can block all of them. Ad block software not needed, and it's not detectable since it's running on my own server."
I use pi-hole and it is sometimes detected - which isn't that difficult with a simple test. Most sensible sites realise that if I'm excluding ads then I'm hardly likely to click on one so there is no point in getting emotional about it.
As for the few others do they seriously expect me to turn it off and reconfigure my DHCP just to see their site? Dream on ...
The exact content users see depends on who they are, where they are, what device they're using and other variables. This makes it incredibly difficult for both publishers and ad networks to conclusively review every version of an advert for malicious content.
I don't see what the difficulty is. In the US, ad agencies are starting to be held liable for false advertising by their clients[1]. It is only a short step to hold them liable for distributing malware.
[1] https://www.retailconsumerproductslaw.com/2018/02/holding-agencies-accountable/
"The ads often contained malicious JavaScript."
There is a simple solution to malvertising: ABSOLUTELY NO JAVASCRIPT, JAVA, FLASH, or SIMILAR IN ANY AD EVER, NO EXCEPTION! Advertisements used to work just fine without javascript, java, or Flash. What changed?
But this will never happen. Their greed trumps my security (and privacy) every day of the week, and twice on Sunday.
Who clicks on adverts? Has anybody here ever clicked an ad? Does anybody know somebody who has clicked on an ad?
I've accidentally clicked on ads twice. A casual survey of friends and family shows a similar pattern. Those 40,000 clicks can't all be accidental.
I recall, a *very* long time ago, when a cron script for an scp choked because someone changed the IP of the Ad Host Gateway.
We used to poll said gateway every 30 minutes. The ad files were pngs and named according to the shape/size/relevance. Copied em over to the webserver and reloaded. At least I then knew all 12 of the yuman beans that put those ads together.
No more will this be apparently.
This is Yevgen Peresvyetov, CEO of AdKernel and we’d like to comment on the article above.
As a white label tech firm, we have ongoing and active technologies to detect fraud and we support all industry efforts to contain the issue. That said, unfortunately the article includes AdKernel as an actor in this fraud scheme which is 100% incorrect. Specifically, we are not now and have never been a reseller or ad network as the research blogpost suggests numerous times. Additionally, the errors in the original blogpost are compounded since Checkpoint assumed Adkernel owns domains: Junnify.com and Bikinisgroup.com. We do not! They are owned by ad network clients of AdKernel. Another factual error.
While the researchers did a great job discovering fraudulent and malvertising activities, they mistakenly included Adkernel as an "ad-network" or "reseller. We have we contacted Check Point requesting an immediate correction to the report since the information in the post in inaccurate.
Malvertising is the industry-wide problem. You can easily find articles about biggest ad networks on the planet has been compromized:
https://www.google.com/search?q=malvertising+leading+ad+networks&oq=malvertising+leading+ad+networks. We are constantly looking to improve ad-scanning techniques and growing our team of ad campaign reviewers & verification experts.
We are on the same side with CheckPoint here. Come on, CheckPoint, we are allies in this fight! You are blaming wrong ppl!
I've used CCleaner for many years. I t works very well. One should always block auto updates on every software. I am glad I did with CCleaner. Still run version 5.43.6520. I used my firewall to block CCupdate.exe, so I hope I am safe. After reading this, I also blocked CCleaner.exe so it won't phone home. Didn't know it is SPYware.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
