Online advertising poses significant security, privacy risks to users, US Senate report says

The online ad industry should offer better protections against 'malvertising,' a US Senate investigation found

The current state of online advertising endangers the security and privacy of users and the U.S. Federal Trade Commission should force the industry to offer better protections through comprehensive regulation, the U.S. Senate said in a report.

The report includes findings and recommendations of the Permanent Subcommittee on Investigations of the Senate's Committee on Homeland Security and Governmental Affairs following an investigation into the distribution of malware through online ads -- also known as "malvertising." It was followed by a hearing Thursday that included testimony from Yahoo and Google about their efforts to combat such threats.

"Consumers can incur malware attacks [through online ads] without having taken any action other than visiting a mainstream website," the subcommittee said, referencing two attacks that involved malicious ads distributed through Yahoo and Google ad networks.

The Yahoo incident happened at the end of December and the Google one in February. In both cases affected users didn't have to click on anything and a simple visit to a website where the malicious ads were displayed was enough to expose them to malware.

"Similar attacks have struck across many online advertising platforms," the subcommittee said, noting that cybercriminals have numerous methods to evade security measures, from stealing credentials of advertising network employees to posing as legitimate advertisers.

Some ad industry companies use automated systems to scan for malicious ads, but cybercriminals can learn the location of such scanners and not serve the ads to them, the report said. In other cases, attackers can change the content of a benign advertisement after it's been scanned and cleared.

"The online advertising industry has grown in complexity to such an extent that each party can conceivably claim it is not responsible when malware is delivered to a user's computer through an advertisement," the subcommittee said. "An ordinary online advertisement typically goes through five or six intermediaries before being delivered to a user's browser, and the ad networks themselves rarely deliver the actual advertisement from their own servers. In most cases, the owners of the host website visited by a user do not know what advertisements will be shown on their site."

This makes it impossible for ordinary consumers to avoid malicious ads, to identify their source and to determine whether the website they visited or the ad network could have prevented the attack, the report argued.

The complexity of the online advertising ecosystem also poses risks to consumer privacy risks, because in most cases users can't control what data is being collected, who collects it and how it's used.

For example, a visit to a popular tabloid news website triggered interactions with 352 other Web servers, the report said. "Many of those interactions were benign; some of those third-parties, however, may have been using cookies or other technology to compile data on the consumer. The sheer volume of such activity makes it difficult for even the most vigilant consumer to control the data being collected or protect against its malicious use."

The investigation determined that the industry's self-regulatory bodies and their codes do not properly address the malware issue and available data-collection protections are limited.

"In the absence of effective self-regulation, the FTC should consider issuing comprehensive regulations to prohibit deceptive and unfair online advertising practices that facilitate or fail to take reasonable steps to prevent malware, invasive cookies, and inappropriate data collection delivered to Internet consumers through online advertisements," the subcommittee said. "Greater specificity in prohibited or discouraged practices is needed before the overall security situation in the online advertising industry can improve."

Google, Facebook, Twitter and AOL recently founded, an organization aimed at making consumers aware of ad-related scams, sharing best practices, identifying trends in deceptive ads, and sharing its knowledge with policy makers and consumer advocates.

"Online advertising companies have battled these issues for years -- dating all the way back to the infant stages of their respective platforms," Rob Haralson, executive director of said Wednesday in a blog post. "Many have developed large-scale systems to scan for malicious code, not only in the advertisements they serve, but also across the billions of sites that make up the web. And while our industry has made significant progress in fighting bad ads, the level of sophistication by scammers reaches new heights at every turn."

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags online safetysecurityscamstwittermalwareprivacyFacebookAOLYahooFederal Trade CommissionGoogle

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Cool Tech

D-Link TAIPAN AC3200 Ultra Wi-Fi Modem Router (DSL-4320L)

Learn more >

Crucial® BX200 SATA 2.5” 7mm (with 9.5mm adapter) Internal Solid State Drive

Learn more >

Xiro Drone Xplorer V -3 Axis Gimbal & 1080p Full HD 14MP Camera

Learn more >

D-Link PowerLine AV2 2000 Gigabit Network Kit

Learn more >

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >

ASUS ROG Swift PG279Q – Reign beyond virtual world

Learn more >

Gadgets & Things

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >


Learn more >

Lexar Professional 2000x SDHC™/SDXC™ UHS-II cards

Learn more >

Family Friendly

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >

Lexar Professional 2000x SDHC™/SDXC™ UHS-II cards

Learn more >

ASUS VivoPC VM62 - Incredibly Powerful, Unbelievably Small

Learn more >

Stocking Stuffer

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >

Lexar Professional 2000x SDHC™/SDXC™ UHS-II cards

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Best Deals on Good Gear Guide

Latest News Articles


GGG Evaluation Team

Kathy Cassidy


First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni


For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell


The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi


The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott


My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.


Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?