Menu
Malvertising campaigns are becoming harder to detect

Malvertising campaigns are becoming harder to detect

The techniques used by attackers are difficult even for security researchers to study

Jerome Segura, a senior security researcher with Malwarebytes, was recently stumped by a cyberattack he was studying. It seemed to keep vanishing.

Segura often studies malvertising, which involves seeding ad networks with harmful online advertisements that then appear on websites, potentially delivering malware to a person's computer.

It's a particularly insidious type of attack, since a person merely has to view an advertisement to become infected if their computer has a software vulnerability. 

"We knew there was something different that malvertisers were doing," said Segura in a phone interview Thursday.

The problem was they couldn't replicate the attack by viewing the malicious ad. It's almost as if the attackers knew they were being watched.

Cyberattackers often profile machines -- known as fingerprinting -- in order to attack ones that are being used by security researchers. Machines on certain IP addresses or VPN networks or those running virtual machines won't be attacked.

Segura couldn't get another look at the attack until he went home and used his home computer rather than the ones in Malwarebytes' lab.

The suspicious advertisement contained a one-by-one pixel GIF image. That's not usual, as pixels are used for tracking purposes, but this one actually contained JavaScript.

The JavaScript exploits an information leakage vulnerability (CVE-2013-7331) in older unpatched versions of Internet Explorer, Segura said. The vulnerability can be used to parse a computer's file system and figure out if it's running certain AV programs.

If a computer checked out, its user was redirected by the advertisement to a server running the Angler exploit kit, Segura said.

It is not unusual for cyberattackers to do some quick reconnaissance on potential victims. But Segura said this time around, the attackers are also taking other steps that make it very difficult for ad networks and security researchers to detect bad behavior.

The malicious ad, including the one-by-one pixel, was also delivered over SSL/TLS, which makes it harder to detect potentially malicious behavior, Segura said.

The malicious ad was carried by Google's DoubleClick and dozens of other ad networks. It appears the attackers had set up fake domains and even LinkedIn profiles months before to appear they were legitimate before supplying their malicious advertisement to the online advertising companies.

"It shows you how deceptive they can be and how many fake advertisers are out there," he said.

Segura said he has been in touch with DoubleClick and other online advertising companies, but the malvertising ad is still running in some places.

The automated nature of online advertising and the labyrinth of relationships between companies has made filtering malicious ads difficult, he said.

"What criminals have figured out is it's easier to infiltrate a third partner that works with Google but doesn't necessarily have the same security screening and tight guidelines," Segura said.

Malwarebytes posted a writeup of its research on its blog.


Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Featured

Slideshows

Tight lines as Hooked on Lenovo catches up at Great Barrier Island

Tight lines as Hooked on Lenovo catches up at Great Barrier Island

​Ingram Micro’s Hooked on Lenovo incentive programme recently rewarded 28 of New Zealand's top performing resellers with a full-on fishing trip at Great Barrier Island for the third year​ in a row.

Tight lines as Hooked on Lenovo catches up at Great Barrier Island
Inside the AWS Summit in Sydney

Inside the AWS Summit in Sydney

As the dust settles on the 2017 AWS Summit in Sydney, ARN looks back an action packed two-day event, covering global keynote presentations, 80 breakout sessions on the latest technology solutions, and channel focused tracks involving local cloud stories and insights.

Inside the AWS Summit in Sydney
Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day

Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day

Ingram Micro hosted its third annual Cure Kids Charity Golf Tournament at the North Shore Golf Club in Auckland. In total, 131 resellers, vendors and Ingram Micro suppliers enjoyed a round of golf consisting of challenges on each of the 18 sponsored holes, with Team Philips taking out the top honours.

Channel tees off on the North Shore as Ingram Micro hosts annual Cure Kids Charity golf day
Show Comments