Google Receives Complaints About 300.000 Injected Ads

Since the beginning of this year, Google has received more than 300,000 complaints of Chrome users on injected ads. It is the largest source of annoyance for Chrome users. The injected ads come from so-called "ad injectors".

This relates to adware or browser extensions that inject additional ads on random websites or replace existing ads. According to Google ad injectors are a problem for advertisers and websites. Advertisers do not know that their ads be injected and so have no idea where their ads are displayed. Websites are not, however, paid for these ads because they are injected locally on the users' computers. The content sometimes dubious, it may involve malware, making the injected ads are a risk to visitors. This is negative for the image of the website, which can do nothing to the injected ads.

Filter

To have to tackle Google ad injectors for several measures taken. Since July, the Internet giant has also begun to filter injected ads of its own advertising platform DoubleClick. Google allows advertisers DoubleClick Bid Manager, which can be bid on ad space. To prevent injected advertisers buy ad space, there is now an automatic filter active.

This new system will detect injected ads and proactively establishes a blacklist that prevents advertisers to bid on ad space injected. Google expects that this measure will not immediately solve the problem, but it hopes that other parties in the advertising industry will take action against ad injectors. "Progress can be achieved only if we work together," said Vegard Johnsen, product manager of Google Ads.

Organization Reads Alarm About Malware Videos On YouTube

The American organization Digital Citizens Alliance has sounded the alarm about Remote Access Trojans (RATs) and the fact that to find many tutorials on the use of this type of malware on YouTube. Something that both the makers and Google eventually benefit.

Remote Access Trojans existence for many years and give an attacker complete control of the computer of the victim. To install the RAT to a victim is often used social engineering, in which the victim is enticed to open a file and thus infect their computer. It involves, for example the e-mail attachments or files that are exchanged via Skype or social media. Once the victim opens the file, the attacker can for example watch the webcam or to save keystrokes.

Trading

On the internet there are several forums in which computers are traded infected with a RAT, or where images are seen from victims who were filmed secretly through their own webcam. A practice in which in 2008 was warned before. Software for making a RAT is easy to locate over the internet. In addition there are numerous instructional videos on YouTube, according to the Digital Citizens Alliance . Videos which both creators and Google make money because Google shows ads in the videos. "No company, especially one as big as Google, would earn a penny to videos that show the faces of victims and their IP addresses," said the organization. If it is to be YouTube videos now also controlled manually with the Digital Citizens Alliance.

Human Nature

To turn the call force was a lengthy report ( pdf ) published on Remote Access Trojans (the report at the time of writing not available, but still in the cache to find Google). In it is mainly create the impression that consumers nothing against this type of malware can do, rather than focusing on the prevention of an infection caused by a RAT, namely, by no unsolicited attachments, to open files or links.

There will be a security expert to speak which is precisely that people can do anything if they become infected. "Links are meant to be opened. Many people clicking hundreds of links per week," said Megan Horner Blackfin Security. "It goes in. Against human nature it is difficult to do, even if you see something that you should wait." In the conclusion of the report, however, called in short to awareness campaigns. In addition, the Digital Citizens Alliances which investigative agencies have more resources to deal with such crimes and would "hackers" that should be punished violate the privacy of their victims.

Weather Infected Ads Distributed By Google DoubleClick

Attackers twice in a short time managed to spread infectious ads through Google's DoubleClick. The attack, which has now become known was conducted through a company called Merchenta, which offers an advertising platform and direct ties with Google DoubleClick. Through this platform, the company would be US only deliver 28 billion monthly ad impressions.

The attackers did in this case as an advertiser and infiltrated the platform through a third party, says anti-virus company Malwarebytes. In addition, they managed to get the infected ad on the advertising platform Merchenta, after which it was transferred to the channels of DoubleClick. Contaminated ad within minutes would have had a 95% coverage in the US, Europe and Britain, which ran a large number of people risk, says Malwarebytes.

The virus fighter notes that DoubleClick is not directly responsible for loading the infected ad, but it starts with the chain of trust with the publisher, which has little control over the transactions that take place. The ad in question was using a well-known and already patched vulnerability in Adobe Flash Player to infect computers with malware. At the time of the attack, the exploit that abuse of the leak was detected by any of the virus scanner.

It was the same exploit that was recently used in another attack campaign, which contaminated ads include on the website of the Huffington Post published. The account of the attackers was lifted according Merchenta on 10 April. Two days earlier warned the Delft security firm Fox-IT for another attack that took place around the same time via DoubleClick. However, it has been used a different exploitkit for infecting unpatched Internet users.

Scale Attack Through Infected Google Ads

Last night there was a large-scale attack on Internet via infected Google ads place. Advertisements and the website of Engage Lab, a Bulgarian company that clients advertising space offered by Google, including through DoubleClick, were found to contain malicious code, as discovered the Delft security firm Fox-IT .

The malicious code sent visitors who see the ads were unnoticed through to another website. This website was exploitkit placed that visitors through known vulnerabilities in Adobe Flash Player, Java Oracle and Microsoft Silverlight tried to infect.In case users up-to-date were unsuccessful attack. Users who had forgotten to install the available security updates could become infected with malware.

After about two hours there were no ads found infected through the ad network Engage Lab. To prevent attacks via infected ads advises Fox-IT updating software like Java, Silverlight and Flash Player and the use of a AdBlocker.