Sign up for our weekly newsletter!
REGISTER NOW |
||
|
||
Malvertising Adds Sophistication to Disruption![]() Larry Loeb, Author, 7/17/2019
Eliya Stein, a senior security engineer at French security firm Confiant, was intrigued by what Malekal -- a French security researcher -- found out about a malvertiser that was present on Microsoft services in France affecting Windows 10 desktops. What concerned many people is that browser ad blockers wouldn't stop them. That seemed to imply that the malicious actor's effect was only secondary in a browser, and that the malvertising was being created and disseminated by other means than just an in-app placement. Stein decided to publish what he was finding out about this situation. The entry point for the served malvertising was initially "ads.creative-serving.com", the ad serving domain used by Platform161, acting as the DSP (realtime ad buying platform). Stein found that the DSP was being used unwittingly, and was not participating in the scheme. The malvertiser can serve up innocuous code, or issue a redirect if certain criteria are met. Stein reminds us that malvertisers rely on forced redirections in order to drive victims to phishing pages, tech support scams, or drive-by downloads. Also, a large scale malvertiser needs at least some automation in their infrastructure deployments because they need to pivot often in order to maintain persistence. The automation that was chosen by the malvertiser correlates to an extremely reliable attribution formula. The first three letters of the domain are used for the ad serving php script. This allowed Stein to track historic as well as predicted behavior of the threat actor. He found that in 2019 the attacker went through over 50 domains, all of which are registered at Namecheap. He was also able to discern that malvertising activity that fits this pattern can be traced back to over 100 additional domains that were active since 2017. Stein got a tip in March 2019 that pointed to a Hong Kong-based company named "fiber-ads" which fits this business model. He characterized them as a bunch of hucksters from the get-go. "The fiber-ads profile on MyMediAds reveals an active participant in a gray market where advertisers can transact or form joint ventures with hawkers of cheap inventory that has very questionable provenance." This led to significant impression volume. Over 100 million impressions had been served this year as of mid June. He found that desktop and mobile devices were targeted in relatively equal quantities, but desktop Windows and iOS were also heavily favored by the attacker. So, the malvertiser affected much more than just Windows 10 desktops. The "middleman" positioning that fiber-ads has chosen in this gray market insulates it from direct exposure. It is a evolution from what is usually seen, and requires more sophistication to pull off. Stein sums up this level of malvertising as, "The middle-men provide the delivery mechanism, but from there the trail can get murky very quickly as the ultimate payload probably goes to the highest bidder, or to whomever the malvertiser is partnered with at that particular moment." Such a convoluted scheme can be as disruptive as the attackers think they can get away with. — Larry Loeb has written for many of the last century's major "dead tree" computer magazines, having been, among other things, a consulting editor for BYTE magazine and senior editor for the launch of WebWeek. |
Aviatrix, an enterprise VPN company with customers that include NASA, Shell and BT, has recently dealt with a vulnerability that was uncovered by Immersive Labs researcher and content engineer Alex Seymour.
Security firm CyberArk is now finally able to discuss a major OAuth 2.0 vulnerability that affects Microsoft Azure web services.
Be alert, be aware, and be careful about what you reveal of your company's internal processes on social media.
The Microsoft Defender ATP Research Team has begun to discuss a polymorphic threat, Dexphot, that it has been tracking for over a year.
'Improper Restriction of Operations within the Bounds of a Memory Buffer' tops this year's list.
Information Resources
upcoming Webinars
ARCHIVED
Top Tips for Blocking pwned [email protected]$$wOrds in Your Organization
Tuesday, October 29, 2019
12 p.m. New York/ 4:00 p.m. London Podcasts
Podcast: Infrastructure Hunting – Stopping Bad Actors in Their Tracks
Being able to effectively build a threat intelligence ecosystem or threat-hunting identification response requires both user and systems sophistication and capabilities. Security, orchestration, automation and response (SOAR) is a new technology designed to provide organizations a single comprehensive platform they can use to implement an intelligence driven security strategy.
Podcast: Digital Transformation, SD-WAN & Optimal Security
Dan Reis chats to Cybera's Josh Flynn about how to achieve digital transformation without sacrificing security. ![]() like us on facebook
|
|
![]() |
||
![]() |
Security Now
About Us
Contact Us
Help
Register
Events
Supporting Partners
Twitter
Facebook
RSS
Copyright © 2019 Light Reading, part of Informa Tech, a division of Informa PLC. All rights reserved. Privacy Policy | Cookie Policy | Terms of Use in partnership with
|