Security Manager's Journal: New ransomware attack hurts trustworthiness of Web

When an infection can result from just calling up a mainstream website, malware becomes harder to battle

Last week, my company was paid a visit by some interesting malware. This time, it was ransomware: malicious software that disguises itself as "security software" but actually holds the system hostage to trick the user into paying money to the software's handlers. This is the same kind of trickery I wrote about when I experienced a FakeAV infection.

Based on that experience, I know this malware is insidious. It embeds itself deeply into the computer, even below the file and operating system levels. There's no point in trying to clean it -- it will just come back. So I instructed the desktop team to wipe the infected computers and reimage them.

Then I had my team perform a root-cause analysis to find out where the infection came from. What they found was interesting. Based on the Web filtering logs and the alerts generated by our intrusion-detection and behavioral monitoring systems, we were able to determine that the infection came from a Web advertisement on the front page of a major news service. The website for the news service was fine, but it links to a series of rotating ads, one of which was compromised. When the compromised ad appears on the news service's Web page, it infects the unlucky browser using JavaScript code -- a drive-by download of malware that doesn't require the user to do anything. No need to click "yes" or "continue" to any prompts -- the JavaScript code executes automatically as soon as the ad appears.

We were lucky -- only two users got infected by the compromised ad. The news service displays lots of ads in a rotation, so the chances of getting the compromised one are pretty small, at least on a single visit.

I had my team contact the news service to let people there know about the compromise. Even though it's not their fault directly, they will want to take some kind of action to ensure that other innocent visitors don't experience the same infection. In fact, it's possible the people who run the ad service are unaware that one of their ads is infecting potential customers. There are many ways an attacker can compromise code served up by Web servers, without the knowledge or participation of the webmaster.

I decided the best way to get rid of this particular nuisance is to block the category of all Web advertisements. Who needs them, anyway? (Well as it turns out, some people do -- I received a couple of requests to unblock the ad category, but in general, ads are an annoyance that users don't want). So one outcome of this experience is that my company's Web browsing experience is slightly less annoying than it was before.

I think this is a sign of the times. The zero-day exploits like the one I wrote about recently are becoming more prevalent, and indirect attacks are now originating from trusted locations like the news service and the advertising company. This is a deadly combination that's harder to fight than a direct attack. In the old days, malware would spread itself once it got on your network. Now it comes in fresh from the Internet, still warm from its programmers' release. Maybe we should count ourselves lucky that these infections don't include self-propagation capability. But then again, maybe that's right around the corner.

This week's journal is written by a real security manager, "J.F. Rice," whose name and employer have been disguised for obvious reasons. Contact him at

Join in

To join in the discussions about security, go to

Computerworld's IT Salary Survey 2017 results
Shop Tech Products at Amazon