Maladverts hit Microsoft and Google sites

Malware hackers have attacked two of the largest websites with drive-by exploits.

Googleplex

Malicious hackers infected Google and Microsoft's online advertising networks last week, reports security firm Armorize.

When clicked on, the "maladvertisements" redirect users to rogue sites that exploit flaws in Adobe Reader, Java and other PC software to install backdoor programs, giving the hackers control of the victims' PCs, Armorize said.

Advertisement - Article continues below

The sites display a dialogue box informing the visitor that malware had been detected and provided a link to the HDDPlus website. This is a known fake optimisation tool which is a Trojan fronting the malicious software.

Armorize said that once the visitor arrived at the site they were immediately infected so that even rebooting would not remove the warning dialogue.

This vulnerability is a known one so anyone with up-to-date antivirus products should be secured.

The first attack occurred on Sunday December 5 and lasted for a few days. Google said that it had experienced some issues with the DoubleClick Ad Exchange that it uses. The company claims that the ads were identified and blocked "within seconds".

Microsoft may have been affected more severely as several reports indicate that malicious ads were found on the LiveMail (formerly Hotmail) site.

The Maladvertisers used a new trick by showing their adds as being from AdShufffle which adds an extra f' to the acceptable AdShuffle domain. Even so, it reveals a weakness that should not have been there and the ads should not have been accepted, security analysts said.

Advertisement
Advertisement - Article continues below
Advertisement - Article continues below

"If anyone was going to be on top of such issues, we would hope it would be Microsoft and Google," commented Bob Tarzey, analyst and director of Quocirca. "It is not just one of those things; there is a lot at stake, if the biggest web brands are not able to protect themselves, who can?

"Google and Microsoft need to take urgent action here. There is still a disproportionate underspend on web advertising, so there is lots of upside, but to tap that confidence in the web-mega brands needs to be maintained. This is especially an issue for Google, which is still very heavily reliant on revenue from click through ads."

It seems that Google's DoubleClick team are on the ball, however. Huang said, "We reached out to DoubleClick and in less than a few hours' time they arranged a meeting with a group of their experts on anti-malvertising and incidence response. We were very surprised and impressed with the speed that DoubleClick acted. We provided details, and DoubleClick said they were already on top of the issue."

Mirosoft said it, too, will seek information from Armorize.

Featured Resources

The case for a marketing content hub

Transform your digital marketing to deliver customer expectations

Download now

Fast, flexible and compliant e-signatures for global businesses

Be at the forefront of digital transformation with electronic signatures

Download now

Why CEOS should care about the move to SAP S/4HANA

And how they can accelerate business value

Download now

IT faces new security challenges in the wake of COVID-19

Beat the crisis by learning how to secure your network

Download now
Advertisement

Recommended

Visit/mobile/google-android/355837/arizona-files-lawsuit-against-google-for-illegally-tracking-android
Google Android

Arizona files lawsuit against Google for illegally tracking Android users’ locations

29 May 2020
Visit/security/encryption/355820/k2view-innovates-in-data-management-with-new-encryption-patent
encryption

K2View innovates in data management with new encryption patent

28 May 2020
Visit/network-internet/email-providers/355822/gmail-introduces-new-features-to-makes-personalizing-your
email providers

Gmail introduces new features to makes personalizing your inbox easier

28 May 2020
Visit/mobile/google-android/355804/google-confirms-users-can-make-purchases-via-voice-match-feature
Google Android

Google Assistant can now verify payments using your voice

27 May 2020

Most Popular

Visit/server-storage/network-attached-storage-nas/355849/western-digital-sneaked-inferior-smr-tech-into
network attached storage (NAS)

Western Digital accused of sneaking inferior SMR tech into NAS drives

1 Jun 2020
Visit/security/data-breaches/355777/easyjet-faces-class-action-lawsuit-over-data-breach
data breaches

EasyJet faces class-action lawsuit over data breach

26 May 2020
Visit/operating-systems/microsoft-windows/355812/microsoft-warns-against-installing-windows-10-may-2020
Microsoft Windows

Microsoft warns users not to install Windows 10's May update

28 May 2020