Some Ad Networks Are Bad News

By Larry Seltzer  |  Posted 2007-11-12 Print this article Print

Opinion: When you trust a Web site, you trust everyone it's in bed with, including its advertisers. Some of these have been sending you to malware sites recently.

You wouldnt go surfing to just any site. Youre careful about where you go. You only go to sites you trust. But who are you trusting? A series of recent attacks has resulted in seemingly respectable news sites serving malware and redirecting users to sites that serve malware.

The problem is in the ads on those news sites. The ads are served by advertising networks that werent careful enough with their own security. When you trust a Web site you have to trust everyone its in bed with.

Follow the latest developments surrounding Google in Clint Boultons Google Watch blog.

The first one I became aware of was YNet, an Israeli news site. Dont go to that site just yet. The site I read is in English. The Hebrew site at is far more popular, in fact the most popular news site in Israel. It is the Internet site for Yedioth Ahronoth, a very large Israeli newspaper.

About two weeks ago I noticed that after going to the page from a bookmark that had only the domain name in it I was redirected to a different site on the domain, a classic "rogue anti-spyware" site that I recognized from prior experience. There are a variety of scams that come from this domain, but this one said that my system was infected with malware and that they could scan it. The browser window shrinks down to dialog box size to give the appearance of a dialog box. You cant cancel out; no matter what you do (other than killing the process in Task Manager) you are brought to the "scanning" Web site, where your system is faux-scanned, and lots of malware is found on it.

Ive observed this attack many times now, both through up-to-date versions of Internet Explorer and Firefox. Sometimes the "app" being pushed is a "performance optimizer" rather than a malware scanner, but in any event its malware. Kaspersky Antivirus on my system recognized it as "not-virus.Hoax.Win32.Renos.kd." I got a lot of analysis help from the ubiquitous Gadi Evron, from independent analyst Thor Larholm and from Adam Thomas of Sunbelt Software.

The redirect came from code in one of the many ad sections in the home page. The code in this page is disturbingly complex and contains a large number of IFRAME tags, many to other domains. An IFRAME tells the browser to go to some other site and read in the HTML from there. This is an example of what is called transitive trust: I trusted Ynet, it trusted its ad providers, therefore I trusted those ad providers. Big mistake. The attack is still up and running as of Sunday, Nov. 11. Incidentally, the actual attack came through Flash code on one of the ad domains ( that performed the redirect.

Next page: Take me out to the malware ...

Larry Seltzer has been writing software for and English about computers ever since—,much to his own amazement—,he graduated from the University of Pennsylvania in 1983.

He was one of the authors of NPL and NPL-R, fourth-generation languages for microcomputers by the now-defunct DeskTop Software Corporation. (Larry is sad to find absolutely no hits on any of these +products on Google.) His work at Desktop Software included programming the UCSD p-System, a virtual machine-based operating system with portable binaries that pre-dated Java by more than 10 years.

For several years, he wrote corporate software for Mathematica Policy Research (they're still in business!) and Chase Econometrics (not so lucky) before being forcibly thrown into the consulting market. He bummed around the Philadelphia consulting and contract-programming scenes for a year or two before taking a job at NSTL (National Software Testing Labs) developing product tests and managing contract testing for the computer industry, governments and publication.

In 1991 Larry moved to Massachusetts to become Technical Director of PC Week Labs (now eWeek Labs). He moved within Ziff Davis to New York in 1994 to run testing at Windows Sources. In 1995, he became Technical Director for Internet product testing at PC Magazine and stayed there till 1998.

Since then, he has been writing for numerous other publications, including Fortune Small Business, Windows 2000 Magazine (now Windows and .NET Magazine), ZDNet and Sam Whitmore's Media Survey.

Submit a Comment

Loading Comments...
Manage your Newsletters: Login   Register My Newsletters

Rocket Fuel