Google Removed 3.2 Billion Malicious Ads In 2017

Last year, Google removed more than 3.2 billion malicious ads because they tried to infect Internet users with malware, went to phishing sites, committed advertising fraud, or for other reasons - more than 100 ads removed per second.

For example, 79 million advertisements were removed because they sent internet users to websites with malware. Google removed another 48 million ads because they let users install unwanted software. Furthermore, 66 million "trick-to-click" ads were removed. In addition to advertising, 320,000 of the advertising network were also banned and Google decided to blacklist 90,000 websites and 700,000 mobile apps.

Recent Adobe Flash Player Vulnerability Leak Attacked Via Exploit Kits

A recently patched vulnerability in Adobe Flash Player is being actively attacked via exploit kits. This means that visiting a hacked website or seeing infected ads with a vulnerable Flash Player version is sufficient to infect with malware.

The vulnerability in question was resolved by Adobe on February 6 through an emergency patch . The vulnerability appeared to have been targeted against South Korean organizations since last November . Here Excel and Word files with embedded Flash objects were used. Now it appears that cyber criminals also have the exploit to use them via the web.

Flash Player was and still is the most popular target for exploit kits. Due to the absence of new exploits, and the fact that more and more browsers are phasing out the support of Flash Player, the effectiveness of exploit kits has declined sharply in the past period . According to researcher Kaffeine of the Malware do not need coffee blog , this is the first new Flash exploit that has been added to an exploit kit since July 2016 for a Flash leak. The new Flash exploit will be deployed via infected ads and will successfully install the Hermes ransomware. Users are therefore advised to upgrade to Flash Player version 28.0.0.161 or later, as the vulnerability has been corrected.

Popular Privacy Plug-In Ghostery Made Open Source

The German software company Cliqz, owner of the popular privacy plug-in Ghostery , has decided to make the tool open source. Ghostery blocks ads and trackers and has millions of users. A year ago Ghostery was taken over by Cliqz .

In the interests of transparency and an open internet, Cliqz has made the choice to make Ghostery open source. By looking at the source code, users can see how Ghostery works and what kind of data it collects. In addition, other developers can now contribute to the privacy plug-in. "Only when people understand what data digital products collect can they make meaningful decisions about what information they want to share and with whom," says Jeremy Tillman , Ghostery's product director.

According to Cliqz, most Ghostery users share stats with which new trackers are found. The software company emphasizes that it is anonymous statistics that also assess the relevance and safety of websites. However, it is also possible to set Ghostery so that no data is shared. The source code of Ghostery can be found on GitHub .

Decrease Of Malicious Advertisements In The Second Half Of 2017

The number of malicious advertisements that Internet users tried to infect with malware, tried to deprive data or attempted to defame it in another way, was reduced in the second half of 2017, security company RiskIQ claims. In the third quarter, the security company detected 53 percent less malvertising than in the second quarter of 2017. In the fourth quarter, this decline continued and 10 percent fewer malicious ads were detected.

The use of advertisements to attack unpatched internet users, for example through vulnerabilities in Adobe Reader or Internet Explorer, decreased by 36 percent in the third quarter and 20 percent in the fourth quarter. Other malware in ads decreased by as much as 67 percent in the fourth quarter. The fourth quarter, however, saw an increase of 16 percent in the number of ads pointing to a scam, but overall there were fewer rogue ads in both the third and fourth quarters.

Ads On Skype Spreading Ransomware

Cyber Criminals have managed to show ads to Skype users who were trying to infect computers with ransomware, says anti-virus firm F-Secure. Although the ads appeared within Skype, does not mean that the browser is not open to advertising.

In the case of observed infected ads which showed the browser unnoticed load a page with the Angler-exploitkit. This exploitkit uses known vulnerabilities in Adobe Flash Player to infect computers with malware. Users who had not patched their Flash Player could become so infected with the Tesla Crypt-ransomware. Like other ransomware encrypts Tesla Crypt sorts files for ransom. The ads on Skype came from the AppNexus-advertising platform, which in the past often for the spread of infectious advertisements used. Meanwhile, the offending ads are no longer displayed.

Adobe Close Critical Vulnerabilities In Flash Player And Photoshop

Adobe has patched critical vulnerabilities in Flash Player and Photoshop computers could allow an attacker to take complete. In the case of Flash Player is about 22 critical vulnerabilities which allowed an attacker to execute arbitrary code on the computer, such as installing malware by just visiting a hacked website or see it from an infected ad.

There was no further interaction required from users. As far as known vulnerabilities are not attacked on the Internet. Since attackers often develop after the release of Flash Player updates exploits to attack unpatched users, Adobe advises to update to Flash Player version 20.0.0.306 within 72 hours. This can be done via the automatic update function or Adobe.com. In the case of Google Chrome, Internet Explorer 10 and 11 on Windows 8 and 8.1 and Internet Explorer 11 and Microsoft Windows 10 Edge Embedded Flash Player will be updated using the browser. Through this Adobe page can be verified that the system version is installed.

There is also a security update for Adobe Photoshop CC and Adobe Bridge CC appeared. The update fixes three critical vulnerabilities that an attacker could take over your computer if opened a malicious file. Because Photoshop traditionally not been a target for attackers, Adobe advises users and administrators to install the update if it suits them. Updating via the built-in updater of drawing programs. In the case of Photoshop CC 02.04.2014 is the update to download only via Adobe.com.

EBay Phishing Site Hosted By EBay Itself

EBay users have long been the target of phishing attacks and phishing sites, but researchers have now discovered an eBay phishing site that was hosted on the infrastructure of the auction site itself. The phishing site is offered from the domain ebaydesc.com, which is normally used to host the descriptions of goods offered on eBay.

These descriptions are then displayed via an iframe on the eBay website. Instead of a definition criminals have now created a phishing page that asks for the credentials German eBay users. After users enter their data being sent to the real eBay page, which states that the username or password was invalid.

Meanwhile, the entered credentials sent to a server with a Russian IP address. According to Internet company Netcraft that the phishing page offers discovered eBay by allowing HTML and scripts in the making of descriptions, crooks many opportunities to perform phishing attacks.

Swiss Government Warns Of Contaminated Ads

The Computer Emergency Response Team (CERT) of the Swiss government has warned Internet users to infected ads that tried to install a Trojan horse. The ads were distributed through a popular Swiss ad network was hacked.

The ads were equipped with malicious code that abuse of known vulnerabilities in Internet Explorer, Firefox, made Java or Adobe Flash Player. In case users this software were not up to date and had a German or French institution, the Gozi Trojan was installed. This is a Trojan specifically designed to steal money from online bank accounts. The version that was spreading through the ads focused on five Swiss and two Thai sofas.

According to the Swiss CERT are potentially hundreds of thousands of Internet users become infected through contaminated ads. Last Friday, the owner of the botnet suddenly decided to remove the malware. All the infected computers were instructed to uninstall the Trojan horse. The reason is unclear, according to the CERT. The government organization thinks the botnet administrator may have earned enough money or that he saw the CERT operation had been discovered and therefore decided to disable the botnet.

Adware Changing Settings Adblock Plus For Mac OS X

Adblock Plus is the most installed browser extension the world, with tens of millions of users. All of these users will not see ads, something that adware developers now have gotten through. Security company Webroot recently discovered copies of the VSearch- and adware Genieo for Mac OS X that adjust settings Adblock Plus.

For this, the Mac user, the first adware already installed on your system. Once active monitors adware or a AdBlocker the system is present and then add an exception, so the ads from adware still be displayed. According to Webroot's most malware for Mac OS X which it encounters adware, which displays all kinds of ads. Earlier this year, Mac users were already adware warned. Users become infected mainly because software outside the site of the supplier or downloading illegal software use.

Infected Ads Hide Behind SSL

The criminals who first infected ads on the websites of Yahoo demonstrated have now found a new ad network and use SSL to complicate the detection of malicious traffic. That leaves anti-virus company Malwarebytes know. The ad network in question is AdSpirit.de whose ads drudgereport.com and wunderground.com shown.

These websites get together more than 110 million visitors per month. The infected ads contain a redirect via SSL to an Azure-site, making it difficult to detect the malicious traffic at the network layer, reports analyst Jerome Segura. The ads users a website with the Angler-exploitkit charge. This exploitkit uses known vulnerabilities include Adobe Flash Player that users are not patched. What malware is installed on a successful attack Segura do not know.

Cyber Criminals Diving Brand New Flash Player Flaw

Visitors to the emergency patch this week for Adobe Flash Player are not yet installed get urgent advice to do so directly, since cyber criminals are now actively trying to infect computers with malware through the vulnerability.

The vulnerability attackers can take the computer completely. Visiting a hacked or malicious Web site or see getting an infected ads is sufficient. There is no further interaction is required. In announcing the emergency patch let Adobe know that the vulnerability on a limited scale was used in targeted attacks. It is in this case usually attacks against companies and organizations with valuable information.

Exploitkit

Security Researcher JuK of the blog Malware Do not Need Coffee now reports that an exploit that vulnerability uses the Magnitude Exploitkit added. This means that much more Internet users run the risk of being attacked via the leak. There contaminated ads in the past on Yahoo appeared that visitors to the Magnitude Exploitkit sent them. Last month, warned security company Zscaler for infectious ads that were distributed on the Internet in conjunction with the exploitkit.

In the case of Internet users their Flash Player not have up-to-date with the exploitkit come into contact CryptoWall-ransomware is installed on the computer. This ransomware encrypts files on the computer for ransom. Last week, the Magnitude Exploitkit was already in the news because an exploit for another just patched Flash Player flaw had been added to the arsenal. Users who have installed Flash Player belong version 18.0.0.194 to use. This page shows you which version is installed on the computer.

Millions Of Consumers Attacked Through Contaminated Ads

In the first months of this year are infected ads used to attack millions of consumers on the web, as sets anti-virus company Malwarebytes. These are ads that use three zero-day vulnerabilities were in Adobe Flash Player. The ads appeared on popular websites such as The Huffington Post, Answers.com and video site Dailymotion, which get millions of visitors per month.

According Malwarebytes is the malicious use of advertisements helped by the real-time bidding on ad space. This allows advertisers to provide real-time on specific targets and prevent the infected ads are not interesting targets are displayed to.An analysis of one attack campaign shows that infected 1,000 ad impressions on major websites at busy times 0.68 cents was paid. At this quieter time fell to 0.06 euro cents.

Microsoft Is Addressing Misleading Advertising

According to Microsoft, there is an increase in the number of misleading advertisements on the Internet, allowing users with malware or unwanted software come into contact. Reason for the software giant to tackle this kind of advertising. The deliberately misleading ads trick users usually have to do something whose consequences are not immediately obvious, such as visiting an infected website or downloading a program that has a "negative impact" on the Internet.

Therefore, Microsoft has a number of requirements established where ads from June 1, 2015 must meet. So ads can not be fooled, they should be distinguished from the website, they may not contain malicious code and may not lead to downloading files. In the event ads do not meet these requirements, Internet Explorer will soon give a warning and the website which can be seen blocking the ads.

Kaspersky Lab Launches Own QR Scanner

The Russian anti-virus company has an app launched that allows mobile users to read QR codes. QR codes appear in more and more places and allow smartphone users to easily learn more about locations and products retrieval. Scanning the QR code is sufficient. However, the user can not see in advance where the QR code refers to.

In the past it has been warned more common malicious QR codes that were used by cybercriminals to malware and Viagra spam to spread. The QR scanner Kaspersky scan the QR code and then checks whether the specified URL is safe. In case it comes to getting a malicious link users to a warning. The app is available for Apple iOS and Google Android

AdBlock Plus Would Allow Ads By Google, Microsoft And Amazon

Adblock Plus, by far the most popular browser extension that exists, would ads from Google, Microsoft and Amazon no longer hold back. According to a report in the Financial Times the company would pay the developer of the extension to allow their ads.

Adblock Plus claims to be downloaded over 300 million times. Some 20 million Firefox users and more than 10 million users use Chrome extension. Adblock Plus is also available for other browsers. According to research of Page Fair would be the impact of these and other ad blockers are increasingly felt by websites. Users can easily block ads in this way, allowing websites to lose revenue.

The Financial Times says that Google, Amazon, Microsoft and advertising company Taboola the developer of Adblock Plus paid to whitelist their ads. For example, ads are as in Microsoft's Bing search engine is shown. For this, the developer would be 30% of the ad revenue have asked where the companies agreed upon. Developer EYEO also states that will be transmitted only acceptable advertisements. Google and Amazon, however, want to give response to the Financial Times, while Microsoft has announced that it always gives users a choice when it comes to advertising.

WhatsSpam - "Spamming Market Rises In WhatsApp"

The amount of spam that is sent to WhatsApp users has increased in recent times, which would also come by the end-to-end encryption that uses mobile messaging, say experts. By using this form of encryption WhatsApp can not see the content of messages and filter on, like many other messaging services do.

Adaptive Mobile security firm says that in recent months there is an increase in the number of spam messages has been to WhatsApp users. Indeed, it is quite cheap to distribute spam via the message. It would in particular be advertisements for luxury fakes. "

WhatsApp Investment Spam

WhatsApp Spam

WhatsApp Indian Spam

The total size of these individual spam attacks WhatsApp is difficult to determine, but it is clear that WhatsApp now one of the messaging services with a fully functioning and active spam ecosystem," said Cathal McDaid Adaptive Mobile.

He argues that WhatsApp in fighting spam is hampered by the use of encryption. Although commendable to encrypt messages from users is the end result that it is difficult to filter the contents of WhatsApp messages. McDaid argues that it is not the end of the world, but problematic. Also Martijn Grooten Virus Bulletin notes that end-to-end encryption, spam filtering is difficult.

According Grooten WhatsApp may see if some users send large numbers of messages, but it is not possible for example to watch sent linkers. One solution would be to look for example at the phone to the content, but if, for example linkers a blacklist of a third party comparison would bring this user privacy again questioning.

Great is like McDaid positive about the deployment of end-to-end encryption and hopes that more will follow. "But as with all measures that improve security and / or privacy, it has a price tag. We have to be more creative in our fight against spam."

Google Adsense Used For Malicious Ads

Cybercriminals have used Google Adsense to display ads on all sorts of malicious websites that visitors to these sites for several scam sites by sent. Numerous webmasters complained about the ads that ensured that visitors were redirected automatically.

The scam sites where visitors ended up offered all kinds of products to lose weight, aging combat, combat skin problems or improve IQ. The websites looked like blogs and magazines with so-called scientific studies and research on the products, complemented by all kinds of false responses from people who supposedly had tried the products.

The problem with the malicious ads would play since mid-December, but was last Friday, January 9th widely felt. On the Google AdSense forum, more than 180 responses from angry webmasters inside. Webmasters who use Google Adsense on their websites and see how visitors were redirected by the malicious ads.

On January 10, Google would have solved the problem. According to security firm Sucuri used the attackers behind the attack two legitimate AdSense campaigns, they probably via guessed or stolen credentials managed to hijack. However, it is not excluded that the scammers Adsense accounts have created yourself and initially did occur that it was legitimate campaigns.
Code

Researcher Denis Sinegubko of Sucuri is wondering why Google allows advertisers may use this type of potentially dangerous code. "I realize that Google advertisers flexibility in managing their campaigns and the use of scripts will give their own pages. And I realize that at the first check these scripts did nothing malicious, and is only misbehaved after they were approved. But there would have to be more in control of third-party scripts. "

Sinegubko further notes that nobody likes ads, but they are indispensable for many websites. "I will not tell you to remove all ads from your site," he says to webmasters. "But I ask you to think about the safety and reputation effects that may have bad ads for your site. Consider each script from a third party that you place on your website as a potential threat. Especially those scripts that others who do not knows, allow you to place content on your site. "

Previously we already seen the Malicious Ads Distributed By AOL Advertisement's Network and Users Report Malicious Ads On Skype.

Porndroid - Android Ransomware Locks 180,000 Android Devices

A form of ransomware that focuses on Android devices and is distributed through fake porn sites has locked least 180,000 Android devices, claims a researcher. Porndroid such as ransomware is called, occurs when users need to install video player to pornographic content visit. Through various Traffic Distribution Systems (TDS), and especially malicious ads, mobile Internet users are redirected to porn sites.

According to researcher JuK of the blog Malware Do not Need Coffee is about 500,000 visitors each day who find themselves in this way on the fake porn sites. The websites instantly show a message that a "porn player" must be installed to view the porn video. However, it is a malicious app that asks, among other administrative privileges. Once installed, the malware is active and locks the device.

The ransomware locks the device with a so-called warning from the FBI stating that the user has committed a crime prohibited by visiting porn sites. The warning will be displayed as evidence four child pornography images and a photo of the user. This picture was taken secretly through the camera on the phone. To unlock the device should be a fine of $ 500 to be paid. Most victims of Porndroid-ransomware are located in the United States, says JuK.

Only in December were locked between 180,000 and 240,000 Android devices. Average hit every day 7,000 devices infected by the ransomware and between 0.4% and 1% of users pay the ransom. Together would have yielded the ransomware in December alone $ 500,000, says the researcher. The reason there is spoken in his little about Porndroid because the victims are ashamed.

Users Report Malicious Ads On Skype

Several users report that Skype they were seeing in the use of the popular VoIP software malicious ads to a fake Adobe website creature that tried to install malware. According to the malicious website, the user must update their Flash Player.

In reality, it was malware. Users wonder how the ads could pass the filters of Microsoft. The software giant has not yet responded to the ads, though a Skype employee on the Skype forum to affected users asking whether they have a " Fiddler trace can make. " This would help to find the malignant advertisement in question.

It would not be the first time that Skype is the target of "malvertisement". Last year, the Dutch security researcher Yonathan Klijnsma did know that he had found on Skype malicious ads. A problem with the ads on Skype is a "AdBlocker" that users use their browsers not working for these ads.