Yahoo users hit by 'malvertising' campaign

Yahoo Sign

Yahoo users have become the target of one of the biggest “malvertising” attacks every, after a malware company bought advertising space on the company’s websites to deliver malicious adverts in an attempt to install malware on users’ computers.

The malvertising campaign attempted to use a vulnerability in Adobe’s Flash to install the software, which tends to be a mixture of ad fraud and ransomware programs.

Malwarebytes, which discovered the campaign, says that the attack is “one of the largest malvertising attacks we have seen recently.”

“Malvertising is a silent killer because malicious ads do not require any type of user interaction in order to execute their payload. The mere fact of browsing to a website that has adverts (and most sites, if not all, do) is enough to start the infection chain.”

Yahoo pulled the malicious adverts as soon as they were alerted by Malwarebytes, and told the research firm: “Unfortunately, disruptive ad behaviour affects the entire tech industry.”

The statement continued: “We’ll continue to ensure the quality and safety of our ads through our automated testing and through the SafeFrame working group, which seeks to protect consumers and publishers from the potential security risks inherent in the online ad ecosystem.”

The attack highlights the weakness of multisite ad networks, which allow advertisers to algorithmically buy slots on major websites. While the networks attempt to filter out malware before it hits end-users, they are often unsuccessful. In November 2014, an attack by the Syrian Electronic Army used a major content delivery network to make it appear as though it had “hacked” sites including the Independent and Telegraph newspapers, while in January that year, as many as 2 million Yahoo customers may have received PC malware that turned their computers into bitcoin miners.

The serious attacks also need to exploit some other vulnerability to make the leap onto users’ computers, however. In January 2014, the Yahoo attackers used a flaw in Java to install software. This time, the weakness was with Adobe’s Flash, which has been in the headlines multiple times for vulnerabilities in the past few months. For some, this has been the last straw for the ageing content delivery framework: the Apple blogger John Gruber has argued that “the sooner we completely eliminate the use of Flash, the better. Just get rid of it.”

Powered by article was written by Alex Hern, for on Wednesday 5th August 2015 13.13 Europe/ © Guardian News and Media Limited 2010