What Do You Have to Do to Get Infected Online? Absolutely Nothing. It’s Called Malvertising and the U.S. Senate Wants It Stopped.

Posted on May 23rd, 2014 by Dan Rampe

Malware

Well technically to get infected you do have to do something – click on an ad distributed through Google or Yahoo for instance.

Referring to malvertisements (malicious ads) distributed through the Google and Yahoo networks, the Permanent Subcommittee on Investigations of the Senate’s Committee on Homeland Security and Governmental Affairs noted that “consumers can incur malware attacks without having taken any action other than visiting a mainstream website.”

In his story on pcworld.com, Lucian Constantin reported that the incidents on Yahoo and Google happened in December and February respectively and that “users didn’t have to click on anything and a simple visit to a website where the malicious ads were displayed was enough to expose them to malware.”

Google and Yahoo weren’t the only ones carrying malvertisements; the subcommittee said “similar attacks have struck across many online advertising platforms.”

Constantin explained that, “Some ad industry companies use automated systems to scan for malicious ads, but cybercriminals can learn the location of such scanners and not serve the ads to them…. In other cases, attackers can change the content of a benign advertisement after it’s been scanned and cleared.”

“The online advertising industry has grown in complexity to such an extent that each party can conceivably claim it is not responsible when malware is delivered to a user’s computer through an advertisement,” the subcommittee said. “An ordinary online advertisement typically goes through five or six intermediaries before being delivered to a user’s browser, and the ad networks themselves rarely deliver the actual advertisement from their own servers. In most cases, the owners of the host website visited by a user do not know what advertisements will be shown on their site.”

If it’s virtually impossible for the pros to track the meanderings of an ad, what can the average consumer do to avoid being infected? Constantin explains (The following has been edited to fit our format. You can find the full article on pcworld.com):

The complexity of the online advertising ecosystem also poses risks to consumer privacy risks, because in most cases users can’t control what data is being collected, who collects it and how it’s used.

For example, a visit to a popular tabloid news website triggered interactions with 352 other Web servers, the report said. “Many of those interactions were benign; some of those third-parties, however, may have been using cookies or other technology to compile data on the consumer. The sheer volume of such activity makes it difficult for even the most vigilant consumer to control the data being collected or protect against its malicious use.”

The investigation determined that the industry’s self-regulatory bodies and their codes do not properly address the malware issue and available data-collection protections are limited.

“In the absence of effective self-regulation, the FTC should consider issuing comprehensive regulations to prohibit deceptive and unfair online advertising practices that facilitate or fail to take reasonable steps to prevent malware, invasive cookies, and inappropriate data collection delivered to Internet consumers through online advertisements,” the subcommittee said. “Greater specificity in prohibited or discouraged practices is needed before the overall security situation in the online advertising industry can improve.”

Google, Facebook, Twitter and AOL recently founded TrustInAds.org, an organization aimed at making consumers aware of ad-related scams, sharing best practices, identifying trends in deceptive ads, and sharing its knowledge with policy makers and consumer advocates.

“Online advertising companies have battled these issues for years—dating all the way back to the infant stages of their respective platforms,” Rob Haralson, executive director of TrustInAds.org said…. “Many have developed large-scale systems to scan for malicious code, not only in the advertisements they serve, but also across the billions of sites that make up the web. And while our industry has made significant progress in fighting bad ads, the level of sophistication by scammers reaches new heights at every turn.”

ThreatMetrix® builds trust on the Internet by offering market-leading advanced fraud prevention and frictionless context-based security solutions. These solutions authenticate consumer and workforce access to mission critical applications using real-time identity and access analytics that leverage the world’s largest trusted identity network.

ThreatMetrix secures enterprise applications against account takeover, payment fraud, fraudulent account registrations, malware, and data breaches. Underpinning the solution is the ThreatMetrix® Global Trust Intelligence Network, which analyzes over 500 million monthly transactions and protects more than 160 million active user accounts across 2,500 customers and 10,000 websites.

The ThreatMetrix solution is deployed across a variety of industries, including financial services, enterprise, e-commerce, payments, social networks, government and insurance.

For more information, visit www.threatmetrix.com or call 1-408-200-5755.

Join the cybersecurity conversation by visiting the ThreatMetrix blogFacebookLinkedIn and Twitter pages.