Stories
Slash Boxes
Comments

SoylentNews is people

posted by cmn32480 on Wednesday December 09 2015, @02:13PM   Printer-friendly
from the hook-line-and-sinker dept.

The popular video streaming site DailyMotion has been hit by a malvertising attack. Malwarebytes explains:

We have been tracking an attack via .eu sites for several days but were missing the final payload. However, this changed when we managed to reproduce a live infection via an ad call coming from popular video streaming site DailyMotion, ranked among Alexa's top 100 sites.

This malversiting incident happened via real-time bidding (RTB) within the WWWPromoter marketplace. A decoy ad (pictured below) from a rogue advertiser initiates a series of redirections to .eu sites and ultimately loads the Angler exploit kit.

The bogus advertiser is using a combination of SSL encryption, IP blacklisting and JavaScript obfuscation and only displays the malicious payload once per (genuine) victim. In addition, Angler EK also fingerprints potential victims before launching its exploits to ensure the user is not a security researcher, honeypot or web crawler.

[...] The incident was resolved very rapidly once the proper contacts were made and the problem isolated. For this, we would like to them[sic] all parties involved in taking such prompt action, therefore limiting the potential damage to innocent users.

This particular malvertising attack is one of a few campaigns we have been tracking which is much more sophisticated than the average incidents we encounter daily. We can say that lately threat actors have really stepped up their game in terms of being very stealthy and making a particular ad call look benign when reproduced in a lab environment. Indeed, the problem comes when we suspect foul play but can't prove it with a live infection. It is difficult to convince ad networks to take action, when on the surface there's nothing wrong with a particular advertiser.

Here's some more information about the Angler exploit kit.


Original Submission

 
This discussion has been archived. No new comments can be posted.
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
  • (Score: 3, Interesting) by Anonymous Coward on Wednesday December 09 2015, @02:29PM

    by Anonymous Coward on Wednesday December 09 2015, @02:29PM (#273939)

    It's about time that advertising networks are held responsible for the malware they distribute. Retroactive action is not sufficient; they should be required to proactively filter anything malicious out. Failure to do so should be considered criminal negligence.

    Starting Score:    0  points
    Moderation   +3  
       Interesting=3, Total=3
    Extra 'Interesting' Modifier   0  

    Total Score:   3  
  • (Score: 3, Insightful) by Whoever on Wednesday December 09 2015, @05:08PM

    by Whoever (4524) on Wednesday December 09 2015, @05:08PM (#274007) Journal

    It's about time that advertising networks are held responsible for the malware they distributeIt's about time that advertising networks are held responsible for the malware they distribute

    Responsible? Hah! These are the same people who get annoyed at the use of ad blockers. The web sites and the ad networks still got paid for distributing the malware. A little thing like exploits against their target users should not get in the way of their revenue.

    Remember: you are the product, not the customer!

    • (Score: 2) by maxwell demon on Wednesday December 09 2015, @07:00PM

      by maxwell demon (1608) on Wednesday December 09 2015, @07:00PM (#274063) Journal

      I don't think a court would care much about what those people get annoyed at.

      --
      The Tao of math: The numbers you can count are not the real numbers.