Menu
AOL halts malicious ads served by its advertising platform

AOL halts malicious ads served by its advertising platform

The malicious ads had been served since late October, according to security company Cyphort

AOL.com said Tuesday it has stopped malicious advertisements being served by its advertising platforms after being alerted by a security company.

Cyphort, which specializes in detecting malware, found on Dec. 31 malicious ads being served on the U.S. and Canadian versions of the news site Huffington Post.

The malicious advertisements redirected users to other websites that attacked their computers and tried to install malware, according to a blog post from Cyphort.

Nick Bilogorskiy, [cq] Cyphort's director of security research, said AOL.com was notified on Saturday and the attacks stopped on Monday. Cyphort's logs showed the attacks started in late October.

An AOL.com spokesman confirmed Cyphort's findings via email and said the company took the necessary steps to fix the problem.

"AOL is committed to bringing new levels of transparency to the advertising process, ensuring ads uphold quality standards and create positive consumer experiences," the spokesman wrote.

A number of other sites were also affected, including weatherbug.com, mandatory.com and houstonpress.com, Cyphort wrote.

Malicious advertisements are a powerful way for hackers to compromise large numbers of computers. The ads are rigged to redirect users to other malicious Web pages.

The malicious ads shown by AOL redirected users to a Web page that hosted an exploit kit, the term for code that looks for software vulnerabilities on a user's computer that can be exploited to install malware.

Cyphort wrote that the exploit kit used was either NeutrinoEK or the Sweet Orange Kit. The kit served up an exploit for Adobe Systems' Flash program, a common target for hackers due to the voluminous number of vulnerabilities found in it.

Before landing on the attack site, users were bounced through a number of other websites, some of which used HTTPS encrypted connections in order to hide the servers used for the attack. Cyphort wrote that one of the HTTPS redirectors that was used was hosted on a Google App Engine page, which made analysis of the redirect harder because the traffic is encrypted.

The sites hosting the exploit kit were ".pl" domains, the country code top-level domain for Poland. Cyphort noticed that "adtech.de" and "advertising.com" -- both ad platforms owned by AOL -- were delivering ads that redirected users to the malicious domains.

Advertising platforms try to prevent malicious activity by vetting ads before they are shown. But there are a variety of tricks employed to skirt around the checks.

Bilogorskiy said attackers will submit ads to an advertising platform but wait a few days before enabling the malicious payload until after the ad has been approved. Sometimes, malicious ads will only attack every 10th user, making one more difficult to detect and remove.

"The ad networks get millions of ads submitted to them, and any one of them could be malvertising," he said. Advertising platforms "try to detect and filter malicious ads from their systems, but it is challenging."

"The potential damage is high, as ad networks have a very deep reach and can infect many people quickly," he said.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags malwareCyphortAOL.com

Featured

Slideshows

The making of an MSSP: a blueprint for growth in NZ

The making of an MSSP: a blueprint for growth in NZ

Partners are actively building out security practices and services to match, yet remain challenged by a lack of guidance in the market. This exclusive Reseller News Roundtable - in association with Sophos - assessed the making of an MSSP, outlining the blueprint for growth and how partners can differentiate in New Zealand.

The making of an MSSP: a blueprint for growth in NZ
Reseller News Platinum Club celebrates leading partners in 2018

Reseller News Platinum Club celebrates leading partners in 2018

The leading players of the New Zealand channel came together to celebrate a year of achievement at the inaugural Reseller News Platinum Club lunch in Auckland. Following the Reseller News Innovation Awards, Platinum Club provides a platform to showcase the top performing partners and start-ups of the past 12 months, with more than ​​50 organisations in the spotlight.​​​

Reseller News Platinum Club celebrates leading partners in 2018
Meet the top performing HP partners in NZ

Meet the top performing HP partners in NZ

HP has honoured its leading partners in New Zealand during 2018, following 12 months of growth through the local channel. Unveiled during the fourth running of the ceremony in Auckland, the awards recognise and celebrate excellence, growth, consistency and engagement of standout Kiwi partners.

Meet the top performing HP partners in NZ
Show Comments