A group peddling rogue antivirus software has duped several major websites
into serving users with unwanted downloads.
Major League Baseball's
MLB.com, the
National Hockey League's
NHL.com, and
the website for business magazine
The
Economist have all fallen victim.
Security researcher Roger Thompson from
Exploit
Prevention Labs demonstrated the ads, which have since been removed, in a
video
hosted on
YouTube.
The video shows the advertisements 'hijacking' the browser to direct the user
away from the original site and attempt to perform an unsolicited software
download and installation.
The ads use a tactic known as 'scan and scare'. The user is offered a free
system scan which returns misleading results in an attempt to scare the user
into paying for the software.
'Scan and scare' is a favourite among rogue security vendors that sell
intentionally ineffective or malicious security software.
The ads were first believed to be coming from the
DoubleClick
network, although the company has since been cleared of any blame.
Researchers claim that the sites were contacted directly by the advertisers,
who then managed the ads through DoubleClick's Dart ad-serving system.
The malicious Flash files contain code which redirects traffic from the host,
past DoubleClick's servers and to a site which tries to serve the unwanted
download.
DoubleClick said in a statement provided to
vnunet.com that it is
updating its system to track down and remove the malicious ads.
"Unfortunately, there are bad actors who misrepresent themselves and purchase
advertising as an avenue to distribute malware," said the company. "We are going
to continue to take proactive and reactive steps."
DoubleClick recommends that publishers carefully research prospective
advertisers and keep a close eye on the behaviour of banner ads.
DoubleClick is hardly alone in the struggle to block out malicious and
intrusive ads. Ad vendors and researchers have long warned that rogue security
vendors use so-called
'bait and
switch' techniques to swap out normal ads with malicious files.
This has resulted in an ongoing cat-and-mouse game in which malware vendors
adopt new techniques to stay ahead of the screening systems used by the
advertising networks.
Do you agree?
Have your say on this article