Millions menaced as ransomware-smuggling ads pollute top websites

New malvertising campaign may have exposed tens of thousands in the past 24 hours.

by Dan Goodin - Mar 15, 2016
 
                                 http://cdn.arstechnica.net/wp-content/uploads/2015/03/teslacrypt-640x577.png
 
Mainstream websites are falling victim to a new rash of malicious ads that attempt to surreptitiously install crypto ransomware and other malware on the computers of unsuspecting visitors, security firms warned.
 
The tainted ads may have exposed tens of thousands of people over the past 24 hours alone, according to a blog post published Monday  by Trend Micro. The new campaign started last week when "Angler," a toolkit that sells exploits for Adobe Flash, Microsoft Silverlight, and other widely used Internet software, started pushing laced banner ads through a compromised ad network.
 
According to a separate blog post from Trustwave's SpiderLabs group, one JSON-based file being served in the ads has more than 12,000 lines of heavily obfuscated code. When researchers deciphered the code, they discovered it enumerated a long list of security products and tools it avoided in an attempt to remain undetected.
 
Full Article

By Mark Wilson
 

 
Top news websites including the BBC, the New York Times and MSN were hit over the weekend by a co-ordinated malware campaign. Delivered through the advertising networks used by the sites, the malvertising attack aimed to install ransomware on victims' computers.
On-site ads are far from loved, hence the prevalence of ad-blocking tools. But as well as being an annoyance, online ads can also pose a serious security risk -- something highlighted by this attack. The infected ads redirected people to servers hosting the Angler exploit kit and was engineered to target US-based web users.
 With a footprint measured in billions of readers, the sites -- including MSN, the BBC, the New York Times, AOL and Newsweek -- were hit with a rash of malicious traffic from two rogue domains, TRACKMYTRAFFIC.BIZ and TALK915.PW. the malvertising campaign affected four major ad networks -- Google, AppNexus, AOL and Rubicon -- and caused what MalwareBytes calls a "huge spike in malicious activity".
 
full article here: