Massive malvertising campaign on Yahoo, AOL and other sites delivers ransomware

The malicious ads exploited vulnerabilities to install the CryptoWall ransomware on computers, researchers from Proofpoint said

Malicious advertisements made their way last week to almost two dozen popular websites and used browser-based exploits to infect computers with CryptoWall, a nasty file-encrypting ransomware program.

The malicious advertising, or malvertising, campaign was discovered by researchers from security firm Proofpoint and had an impact on visitors to at least 22 popular websites including Yahoo's Finance and Fantasy Sports sites, realestate.aol.com, theatlantic.com, 9gag.com and match.com.

"All told, more than 3 million visitors per day were potentially exposed to this malvertising campaign," the Proofpoint researchers said in a report published Wednesday.

As in the case of most malvertising attacks, the sites themselves were not compromised. Instead, attackers managed to push malicious ads through at least three major advertising networks and exchanges: The Rubicon Project, Right Media (now Yahoo Ad Exchange) and OpenX.

"Proofpoint has proactively attempted to provide information to these networks, and as of Saturday, October 18th, we believe these networks to have taken action to address the issue," the Proofpoint researchers said.

Yahoo, The Rubicon Project and OpenX did not immediately respond to a request for comment.

The malicious ads, which were impersonating legitimate ones for brands like Microsoft Bing, Fancy and Case Logic, used an attack tool called Flash Pack to silently execute exploits for vulnerabilities in outdated browser plug-ins. When successful, the exploits installed a ransomware program called CryptoWall 2.0 on users' computers.

CryptoWall encrypts files with popular extensions -- movies, images, documents, etc. -- that are stored on local hard disk drives or mapped network shares. It then asks victims to pay a ransom in Bitcoin cryptocurrency.

Security researchers from Dell SecureWorks estimated that CryptoWall infected more than 600,000 computers between March and August, earning cybercriminals over US$1 million.

CryptoWall is very destructive because it uses strong encryption and leaves users with almost no option to reliably recover their files aside from paying ransom. Restoring the files from backups is a possibility, if those backups weren't also affected by the infection.

The Proofpoint researchers tracked transactions to the Bitcoin wallet addresses used by CryptoWall in this new attack and determined that they received at least 65 bitcoins daily, or around US$25,000.

The malicious ads "passed through multiple parties including exchanges, optimizers, ad networks and web sites, all without detection at any step," the researchers said. "It is clear that site owners and ad distributors need to invest in more advanced tools to detect malicious advertisements that are embedded in the ad stream. In particular, site owners cannot and should not assume that the ad networks are taking care of this for them, and should proactively seek tools for online brand protection."

In order to protect themselves against malvertising attacks and drive-by exploits in general, users should keep the software installed on their computers up to date, especially their operating systems, browsers and browser plug-ins like Flash Player, Java, Silverlight and Adobe Reader.

Some browsers like Google Chrome and Mozilla Firefox allow users to enable click-to-play for plug-in based content, which can stop the automatic execution on exploits that target browser plug-ins.

Join the Good Gear Guide newsletter!

Error: Please check your email address.

Tags Yahooonline safetyproofpointThe Rubicon ProjectsecurityOpenXExploits / vulnerabilitiesmalware

Our Back to Business guide highlights the best products for you to boost your productivity at home, on the road, at the office, or in the classroom.

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Cool Tech

Crucial Ballistix Elite 32GB Kit (4 x 8GB) DDR4-3000 UDIMM

Learn more >

Gadgets & Things

Lexar® Professional 1000x microSDHC™/microSDXC™ UHS-II cards

Learn more >

Family Friendly

Lexar® JumpDrive® S57 USB 3.0 flash drive 

Learn more >

Stocking Stuffer

Plox Star Wars Death Star Levitating Bluetooth Speaker

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Featured Content

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?