Menu
AOL halts malicious ads served by its advertising platform

AOL halts malicious ads served by its advertising platform

The malicious ads had been served since late October, according to security company Cyphort

AOL.com said Tuesday it has stopped malicious advertisements being served by its advertising platforms after being alerted by a security company.

Cyphort, which specializes in detecting malware, found on Dec. 31 malicious ads being served on the U.S. and Canadian versions of the news site Huffington Post.

The malicious advertisements redirected users to other websites that attacked their computers and tried to install malware, according to a blog post from Cyphort.

Nick Bilogorskiy, [cq] Cyphort's director of security research, said AOL.com was notified on Saturday and the attacks stopped on Monday. Cyphort's logs showed the attacks started in late October.

An AOL.com spokesman confirmed Cyphort's findings via email and said the company took the necessary steps to fix the problem.

"AOL is committed to bringing new levels of transparency to the advertising process, ensuring ads uphold quality standards and create positive consumer experiences," the spokesman wrote.

A number of other sites were also affected, including weatherbug.com, mandatory.com and houstonpress.com, Cyphort wrote.

Malicious advertisements are a powerful way for hackers to compromise large numbers of computers. The ads are rigged to redirect users to other malicious Web pages.

The malicious ads shown by AOL redirected users to a Web page that hosted an exploit kit, the term for code that looks for software vulnerabilities on a user's computer that can be exploited to install malware.

Cyphort wrote that the exploit kit used was either NeutrinoEK or the Sweet Orange Kit. The kit served up an exploit for Adobe Systems' Flash program, a common target for hackers due to the voluminous number of vulnerabilities found in it.

Before landing on the attack site, users were bounced through a number of other websites, some of which used HTTPS encrypted connections in order to hide the servers used for the attack. Cyphort wrote that one of the HTTPS redirectors that was used was hosted on a Google App Engine page, which made analysis of the redirect harder because the traffic is encrypted.

The sites hosting the exploit kit were ".pl" domains, the country code top-level domain for Poland. Cyphort noticed that "adtech.de" and "advertising.com" -- both ad platforms owned by AOL -- were delivering ads that redirected users to the malicious domains.

Advertising platforms try to prevent malicious activity by vetting ads before they are shown. But there are a variety of tricks employed to skirt around the checks.

Bilogorskiy said attackers will submit ads to an advertising platform but wait a few days before enabling the malicious payload until after the ad has been approved. Sometimes, malicious ads will only attack every 10th user, making one more difficult to detect and remove.

"The ad networks get millions of ads submitted to them, and any one of them could be malvertising," he said. Advertising platforms "try to detect and filter malicious ads from their systems, but it is challenging."

"The potential damage is high, as ad networks have a very deep reach and can infect many people quickly," he said.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags CyphortsecuritymalwareAOL.com

Featured

Slideshows

Educating from the epicentre - Why distributors are the pulse checkers of the channel

Educating from the epicentre - Why distributors are the pulse checkers of the channel

​As the channel changes and industry voices deepen, the need for clarity and insight heightens. Market misconceptions talk of an “under pressure” distribution space, with competitors in that fateful “race for relevance” across New Zealand. Amidst the cliched assumptions however, distribution is once again showing its strength, as a force to be listened to, rather than questioned. Traditionally, the role was born out of a need for vendors and resellers to find one another, acting as a bridge between the testing lab and the marketplace. Yet despite new technologies and business approaches shaking the channel to its very core, distributors remain tied to the epicentre - providing the voice of reason amidst a seismic industry shift. In looking across both sides of the vendor and partner fences, the middle concept of the three-tier chain remains centrally placed to understand the metrics of two differing worlds, as the continual pulse checkers of the local channel. This exclusive Reseller News Roundtable, in association with Dicker Data and rhipe, examined the pivotal role of distribution in understanding the health of the channel, educating from the epicentre as the market transforms at a rapid rate.

Educating from the epicentre - Why distributors are the pulse checkers of the channel
Kiwi channel reunites as After Hours kicks off 2017

Kiwi channel reunites as After Hours kicks off 2017

After Hours made a welcome return to the channel social calendar last night, with a bumper crowd of distributors, vendors and resellers descending on The Jefferson in Auckland to kickstart 2017. Photos by Maria Stefina.

Kiwi channel reunites as After Hours kicks off 2017
Arrow exclusively introduces Tenable Network Security to A/NZ channel

Arrow exclusively introduces Tenable Network Security to A/NZ channel

Arrow Electronics introduced Tenable Network Security to local resellers in Sydney last week, officially launching the distributor's latest security partnership across Australia and New Zealand. Representing the first direct distribution agreement locally for Tenable specifically, the deal sees Arrow deliver security solutions directly to mid-market and enterprise channel partners on both sides of the Tasman.

Arrow exclusively introduces Tenable Network Security to A/NZ channel
Show Comments