AOL halts malicious ads served by its advertising platform

The malicious ads had been served since late October, according to security company Cyphort

AOL.com said Tuesday it has stopped malicious advertisements being served by its advertising platforms after being alerted by a security company.

Cyphort, which specializes in detecting malware, found on Dec. 31 malicious ads being served on the U.S. and Canadian versions of the news site Huffington Post.

The malicious advertisements redirected users to other websites that attacked their computers and tried to install malware, according to a blog post from Cyphort.

Nick Bilogorskiy, [cq] Cyphort's director of security research, said AOL.com was notified on Saturday and the attacks stopped on Monday. Cyphort's logs showed the attacks started in late October.

An AOL.com spokesman confirmed Cyphort's findings via email and said the company took the necessary steps to fix the problem.

"AOL is committed to bringing new levels of transparency to the advertising process, ensuring ads uphold quality standards and create positive consumer experiences," the spokesman wrote.

A number of other sites were also affected, including weatherbug.com, mandatory.com and houstonpress.com, Cyphort wrote.

Malicious advertisements are a powerful way for hackers to compromise large numbers of computers. The ads are rigged to redirect users to other malicious Web pages.

The malicious ads shown by AOL redirected users to a Web page that hosted an exploit kit, the term for code that looks for software vulnerabilities on a user's computer that can be exploited to install malware.

Cyphort wrote that the exploit kit used was either NeutrinoEK or the Sweet Orange Kit. The kit served up an exploit for Adobe Systems' Flash program, a common target for hackers due to the voluminous number of vulnerabilities found in it.

Before landing on the attack site, users were bounced through a number of other websites, some of which used HTTPS encrypted connections in order to hide the servers used for the attack. Cyphort wrote that one of the HTTPS redirectors that was used was hosted on a Google App Engine page, which made analysis of the redirect harder because the traffic is encrypted.

The sites hosting the exploit kit were ".pl" domains, the country code top-level domain for Poland. Cyphort noticed that "adtech.de" and "advertising.com" -- both ad platforms owned by AOL -- were delivering ads that redirected users to the malicious domains.

Advertising platforms try to prevent malicious activity by vetting ads before they are shown. But there are a variety of tricks employed to skirt around the checks.

Bilogorskiy said attackers will submit ads to an advertising platform but wait a few days before enabling the malicious payload until after the ad has been approved. Sometimes, malicious ads will only attack every 10th user, making one more difficult to detect and remove.

"The ad networks get millions of ads submitted to them, and any one of them could be malvertising," he said. Advertising platforms "try to detect and filter malicious ads from their systems, but it is challenging."

"The potential damage is high, as ad networks have a very deep reach and can infect many people quickly," he said.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags malwareCyphortAOL.com

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Jeremy Kirk

IDG News Service
Show Comments

Cool Tech

Toys for Boys

Family Friendly

Stocking Stuffer

SmartLens - Clip on Phone Camera Lens Set of 3

Learn more >

Christmas Gift Guide

Click for more ›

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Aysha Strobbe

Microsoft Office 365/HP Spectre x360

Microsoft Office continues to make a student’s life that little bit easier by offering reliable, easy to use, time-saving functionality, while continuing to develop new features that further enhance what is already a formidable collection of applications

Michael Hargreaves

Microsoft Office 365/Dell XPS 15 2-in-1

I’d recommend a Dell XPS 15 2-in-1 and the new Windows 10 to anyone who needs to get serious work done (before you kick back on your couch with your favourite Netflix show.)

Maryellen Rose George

Brother PT-P750W

It’s useful for office tasks as well as pragmatic labelling of equipment and storage – just don’t get too excited and label everything in sight!

Cathy Giles

Brother MFC-L8900CDW

The Brother MFC-L8900CDW is an absolute stand out. I struggle to fault it.

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Featured Content

Product Launch Showcase

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?