Online advertising endangers user security, privacy
The online ad industry should offer better protections against 'malvertising' U.S. Senate probe finds
IDG News Service - The current state of online advertising endangers the security and privacy of users and the U.S. Federal Trade Commission should force the industry to offer better protections through comprehensive regulation, the U.S. Senate said in a report.
The report includes findings and recommendations of the Permanent Subcommittee on Investigations of the Senate's Committee on Homeland Security and Governmental Affairs following an investigation into the distribution of malware through online ads -- also known as "malvertising." It was followed by a hearing Thursday that included testimony from Yahoo and Google about their efforts to combat such threats.
"Consumers can incur malware attacks [through online ads] without having taken any action other than visiting a mainstream website," the subcommittee said, referencing two attacks that involved malicious ads distributed through Yahoo and Google ad networks.
The Yahoo incident happened at the end of December and the Google one in February. In both cases affected users didn't have to click on anything and a simple visit to a website where the malicious ads were displayed was enough to expose them to malware.
"Similar attacks have struck across many online advertising platforms," the subcommittee said, noting that cybercriminals have numerous methods to evade security measures, from stealing credentials of advertising network employees to posing as legitimate advertisers.
Some ad industry companies use automated systems to scan for malicious ads, but cybercriminals can learn the location of such scanners and not serve the ads to them, the report said. In other cases, attackers can change the content of a benign advertisement after it's been scanned and cleared.
"The online advertising industry has grown in complexity to such an extent that each party can conceivably claim it is not responsible when malware is delivered to a user's computer through an advertisement," the subcommittee said. "An ordinary online advertisement typically goes through five or six intermediaries before being delivered to a user's browser, and the ad networks themselves rarely deliver the actual advertisement from their own servers. In most cases, the owners of the host website visited by a user do not know what advertisements will be shown on their site."
This makes it impossible for ordinary consumers to avoid malicious ads, to identify their source and to determine whether the website they visited or the ad network could have prevented the attack, the report argued.
The complexity of the online advertising ecosystem also poses risks to consumer privacy risks, because in most cases users can't control what data is being collected, who collects it and how it's used.
For example, a visit to a popular tabloid news website triggered interactions with 352 other Web servers, the report said. "Many of those interactions were benign; some of those third-parties, however, may have been using cookies or other technology to compile data on the consumer. The sheer volume of such activity makes it difficult for even the most vigilant consumer to control the data being collected or protect against its malicious use."
- Top 10 Reasons to Strengthen Information Security with Desktop Virtualization Regain control and reduce risk without sacrificing business productivity and growth
- Preventing Sophisticated Attacks: Anti-Evasion & Advanced Evasion Techniques McAfee Next Generation Firewall applies sophisticated analysis techniques specifically to detect advanced evasion techniques (AET).
- The Security Industry's Dirty Little Secret The debate over advanced evasion techniques (AETs) This report summarizes the findings of a McAfee commissioned research group to determine the level of understanding IT security professionals have about AETs...
- Demand More, Get the Most from the Move to a Next-Generation Firewall Beyond the basics in a next generation firewall, to protect your investment you should demand other valuable features: intrusion prevention, contextual rules, advanced...
- What should I look for in a Next Generation Firewall? SANS Provides Guidance With so many vendors claiming to have a Next Generation Firewall (NGFW), it can be difficult to tell what makes each one different....
- Responding to New SSL Cybersecurity Threat The featured Gartner research examines current strategies to address new SSL cybersecurity threats and vulnerabilities. All Security White Papers | Webcasts
Our new bimonthly Internet of Things newsletter helps you keep pace with the rapidly evolving technologies, trends and developments related to the IoT. Subscribe now and stay up to date!