Who Can You Trust? Interactive Advertising Is Dangerous
The New York Times sold an ad to a fake Vonage and served its readers scareware. That was the industry's warning shot, and it was ignored.
The point of this post in 2010 was simple and unpopular: an ad is code, and the industry was letting strangers run code on your computer.
The case everyone should have learned from
Over the weekend of September 12 and 13, 2009, NYTimes.com readers got pop-ups telling them their computers were infected and pushing them to buy fake antivirus software. The attackers had bought ad space directly from the Times while posing as Vonage, a real past advertiser, then swapped the creative for malicious code late on a Friday, through a third-party ad server nobody had vetted. The Times warned readers and said it would stop letting advertisers use unfamiliar ad vendors.
The same week, Microsoft filed five lawsuits against unnamed operators accused of pushing malware through its own ad platform. In April 2010, Google presented research covering 240 million pages: fake antivirus was 15% of the malware it detected, across more than 11,000 domains, and online ads were a major way it spread.
Why trust was the right word
Every party in the chain trusted the next one. The publisher trusted the ad server. The ad server trusted the network. The network trusted whoever paid. Nobody was paid to check, so nobody checked, and the reader who trusted the masthead got the bill.
How it aged
Malvertising became a permanent feature of programmatic advertising. In 2014 a Senate investigation concluded that simply visiting a mainstream website could infect a user, and that the five or six intermediaries in an ad's path blurred who was responsible. In 2026, ADOTAT reported on ads used to deliver commercial spyware to a major news site. The question in this headline never got a better answer.
This page rebuilds an August 2010 IndustryPace post whose original text is not available. Facts come from The Register and Graham Cluley on the 2009 New York Times incident, Consumerist on Microsoft's lawsuits, eWeek on Google's 2010 research, and the 2014 Senate Permanent Subcommittee on Investigations report.