Serving malware through Ad-networks

NEW DELHI, INDIA: Serving malware instead of news is news in itself. Recently, Yahoo! servers were found to be serving a bouquet of malware through its advertisements.

Serving malware through Ad-networks is not new and in the recent past, we have seen quite a few of the ad-networks like Yahoo!, Open-X or NetSeer being compromised and ended up serving malware.

The web economy is primarily based on two factors, i.e. Seller / Manufacturer and Advertisements. One may wonder, as to why the ‘Buyer' has been left out? Well, the buyer equates to market needs / requirements. To entice the buyer, manufacturer will come up with products and to make the buyer realize that such a product exists, they will resort to various marketing tactics, of which, Web-Based Advertisements play a major role.

Search Engines, news reporting websites, video sharing web-sites and last but not the least social networking sites, rely on the advertisements for generating revenue. Number of visitors to a particular website will determine the cost of advertisement to the manufacturer / seller. Secondly, the cost of the advertisement depends on a few factors viz. per-view or per-click.

In order to manage/maintain all the aspects of advertisements that include revenue sharing, systems have been developed and there are organizations specializing in providing such infrastructure to their clients. Clients in this case are the web-based content providers, or even individuals, whose working is similar to affiliates.

Also, there is software available that can automatically block advertisements and a number of users make use of such software in addition to the regular antivirus programs. Due to this, there is a constant tussle between advertisers and ad-block software. In this capitalist world, no advertiser would ever want such software to exist as they directly hit where it hurts the most.

Cyber Criminals have been using the medium of advertisements, either to peddle their wares or target unsuspecting victims with scams. However, attacking an advertising server to serve malware, takes the cake.
Normally, Cyber-Criminals in order to serve malware would either hack a well-known website or send deceptive emails; however when it comes to an advertising network, the target audience catered by the infector increases dramatically.

Recently, Yahoo! ad-servers started serving malware to their European visitors, which resulted in infecting 27,000 unsuspecting users per hour and those users who were using advertisement blocking software, were protected. The amazing thing is that in the AV industry, we would block malicious content after analyzing the threat factor. However, for those using advertisement blocking software, the threat was averted, irrespective of the malicious nature of the content, simply because the content was being served from a ‘known' advertising server.

(The author is managing director and CEO of eScan)