Avast: “New Threat: Malvertising”

Malware that exploits holes in popular applications is being delivered by big ad delivery platforms including those run by Yahoo, Fox, and Google, according to Prague-based antivirus firm Avast.

Malware has previously been found in ads running on normally trustworthy sites like The New York Times, the Drudge Report.com, TechCrunch and WhitePages.com. The practice has been dubbed “malvertising.”

Researchers at Avast say some large ad delivery systems including Yahoo’s Yield Manager and Fox Audience Network’s Fimserve.com (together they cover more than 50 percent of online ads), and to a much smaller degree Google’s DoubleClick, are delivering much of the Malvertising. In addition, some of the malicious ads ended up on Yahoo and Google sites, Avast claims.

“It’s not just the small players but the ad servers connected with Google and Yahoo have been infected and served up bad ads,” said Lyle Frink, public relations manager for Avast.

The most compromised ad delivery systems were Yield Manager and Fimserve, but a number of smaller ad systems, including Myspace, were also found to be delivering malware on a lesser scale, Avast Virus Labs said.

In these cases, JavaScript code that Avast dubbed “JS:Prontexi,” was found in ads delivered from those networks. Avast researcher Jiri Sejtko said this is a Trojan in script form that targets the Windows operating system.

It trys to find vulnerabilities in Adobe Reader and Acrobat, Java, QuickTime, and Flash and launches fake antivirus warnings when it does find them, Sejtko said. “The Google portion of JS:Prontexi is quite small and has gotten visibly even smaller as Google has taken steps to improve the situation,” Sejtko said. “That is not the case with Yahoo and Fox.”

Users don’t need to click on anything to get infected; a computer becomes infected immediately after the ad is loaded by the browser, Avast said.

Since the malware started spreading in late December, Avast has registered more than 2.6 million instances of it on customers’ computers.

This same post is available on my local blog at http://www.networkingdelaware.com/blogpage.html

This entry was posted on 24. March 2010 at 21:25 and is filed under Drive-by Infection, Malvertising, Malware. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response or trackback from your own site.