Menu
AOL halts malicious ads served by its advertising platform

AOL halts malicious ads served by its advertising platform

The malicious ads had been served since late October, according to security company Cyphort

AOL.com said Tuesday it has stopped malicious advertisements being served by its advertising platforms after being alerted by a security company.

Cyphort, which specializes in detecting malware, found on Dec. 31 malicious ads being served on the U.S. and Canadian versions of the news site Huffington Post.

The malicious advertisements redirected users to other websites that attacked their computers and tried to install malware, according to a blog post from Cyphort.

Nick Bilogorskiy, [cq] Cyphort's director of security research, said AOL.com was notified on Saturday and the attacks stopped on Monday. Cyphort's logs showed the attacks started in late October.

An AOL.com spokesman confirmed Cyphort's findings via email and said the company took the necessary steps to fix the problem.

"AOL is committed to bringing new levels of transparency to the advertising process, ensuring ads uphold quality standards and create positive consumer experiences," the spokesman wrote.

A number of other sites were also affected, including weatherbug.com, mandatory.com and houstonpress.com, Cyphort wrote.

Malicious advertisements are a powerful way for hackers to compromise large numbers of computers. The ads are rigged to redirect users to other malicious Web pages.

The malicious ads shown by AOL redirected users to a Web page that hosted an exploit kit, the term for code that looks for software vulnerabilities on a user's computer that can be exploited to install malware.

Cyphort wrote that the exploit kit used was either NeutrinoEK or the Sweet Orange Kit. The kit served up an exploit for Adobe Systems' Flash program, a common target for hackers due to the voluminous number of vulnerabilities found in it.

Before landing on the attack site, users were bounced through a number of other websites, some of which used HTTPS encrypted connections in order to hide the servers used for the attack. Cyphort wrote that one of the HTTPS redirectors that was used was hosted on a Google App Engine page, which made analysis of the redirect harder because the traffic is encrypted.

The sites hosting the exploit kit were ".pl" domains, the country code top-level domain for Poland. Cyphort noticed that "adtech.de" and "advertising.com" -- both ad platforms owned by AOL -- were delivering ads that redirected users to the malicious domains.

Advertising platforms try to prevent malicious activity by vetting ads before they are shown. But there are a variety of tricks employed to skirt around the checks.

Bilogorskiy said attackers will submit ads to an advertising platform but wait a few days before enabling the malicious payload until after the ad has been approved. Sometimes, malicious ads will only attack every 10th user, making one more difficult to detect and remove.

"The ad networks get millions of ads submitted to them, and any one of them could be malvertising," he said. Advertising platforms "try to detect and filter malicious ads from their systems, but it is challenging."

"The potential damage is high, as ad networks have a very deep reach and can infect many people quickly," he said.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags CyphortsecuritymalwareAOL.com

Slideshows

Top 50 defining moments of the New Zealand channel in 2016

Top 50 defining moments of the New Zealand channel in 2016

Reseller News looks back on a tumultuous 12 months for the New Zealand channel, assessing the fallout from a year of sizeable industry change. Whether it be local or global mergers and acquisitions, distribution deals or job changes, the channel that started the year differs somewhat to the one set to finish it - Reseller News assesses the key moments that made 2016.​

Top 50 defining moments of the New Zealand channel in 2016
​Hewlett Packard Enterprise honours high achieving NZ channel

​Hewlett Packard Enterprise honours high achieving NZ channel

Hewlett Packard Enterprise honoured its top performing Kiwi partners at the second running of its HPE Partner Awards in New Zealand, held at a glitzy ceremony in Auckland. Recognising excellence across eight categories - from distributors to resellers - the tech giant celebrated its first year as a standalone company, following its official split from HP in 2015.

​Hewlett Packard Enterprise honours high achieving NZ channel
Nutanix treats channel partners to Christmas cruise

Nutanix treats channel partners to Christmas cruise

Nutanix recently took to the seas for a Christmas Cruise around Sydney Harbour with its Australia and New Zealand staff, customers and partners to celebrate a stellar year for the vendor. With the sun out, they were all smiles and mingled over drinks and food.

Nutanix treats channel partners to Christmas cruise
Show Comments