Mainstream Media Finally Paying Attention to Malware Advertisements on Exchanges? Why Have They Been Ignoring It Until Now?
In December 2010, poisoned ads ran through Google's DoubleClick and Microsoft's ad network at the same time. It had been happening for years.
In early December 2010, malicious banner ads started running through Google's DoubleClick. By December 10, the security firm Armorize had confirmed they were also coming through Microsoft's ad network, reaching Hotmail, msnbc.com and other Microsoft properties. Scout.com was hit through DoubleClick.
How it worked
The attackers registered a lookalike domain, ADShufffle.com, with an extra f, to fool ad account managers into thinking they were dealing with the real AdShuffle. The ads used obfuscated code and off-the-shelf exploit kits to attack old Adobe Reader, Java and Internet Explorer flaws. No click was needed. The payload was a fake antivirus program, and at first only 2 of 42 antivirus engines caught it. Google said its exchange filters blocked the creatives within seconds but did not explain how they got in. Armorize said several other exchanges had been fooled as well.
Why "finally"
Because this was not new. In September 2007, malicious banners sold through Yahoo's Right Media exchange ran about 12 million times over three weeks on MySpace, Photobucket and others, and a researcher said at the time that nobody in the chain was checking whether ads were safe. In September 2009 another wave hit DoubleClick, Right Media and FastClick. The trade and security press covered it. The broader public mostly heard about it when it touched names they knew.
How it aged
In May 2014 the Senate Permanent Subcommittee on Investigations confirmed the thesis in a formal report. Visiting a mainstream site alone could infect a user, the chain of five or six intermediaries blurred accountability, and industry self-regulation was inadequate. It cited a 2010 malware strain with about 2.6 million infections, including about 530,000 through a Yahoo-controlled ad network. Congress took three and a half years to say what this headline asked.
This page rebuilds a December 2010 IndustryPace post, cited by Ben Edelman, whose original text is not available. Facts come from The Register and CSO Online (December 2010 and September 2007) and the 2014 Senate PSI report. Whether major general-news outlets covered the December 2010 incident was not checked. The author ran an ad network in this period.