group session: malvertising : how to detect and deal with malicious ads

9

Group Session: Malvertising: How To Detect and Deal With Malicious Ads Mike Nolet admonsters Ad Ops 360 July 17 th 2008

Upload: desirae-wheeler

Post on 02-Jan-2016

17 views

Category:

Documents

0 download

Report

Download

Tags:

Embed Size (px):

DESCRIPTION

Group Session: Malvertising : How To Detect and Deal With Malicious Ads. Mike Nolet admonsters Ad Ops 360 July 17 th 2008. What are “Malvertisements”?. Malware Ads, or “Malvertisements”, when displayed attempt to install spyware or adware or otherwise hijack a user’s browsing session - PowerPoint PPT Presentation

TRANSCRIPT

Page 1: Group Session: Malvertising : How To Detect and Deal With Malicious Ads

Group Session: Malvertising: How To Detect and Deal With Malicious

AdsMike Nolet

admonsters Ad Ops 360

July 17th 2008

Page 2: Group Session: Malvertising : How To Detect and Deal With Malicious Ads

What are “Malvertisements”? Malware Ads, or “Malvertisements”, when

displayed attempt to install spyware or adware or otherwise hijack a user’s browsing session

Often ads are built upon legitimate ads from legitimate vendors

In other cases, entirely fake marketing campaigns, complete with functional sites, are setup as fronts for buying ad-inventory

Affecting publishers from the long tail to the top – Yahoo, MSN, AOL have all been caught showing malware ads

Page 3: Group Session: Malvertising : How To Detect and Deal With Malicious Ads

Why you should care Do you want your users to see this when they

come to one of your properties?

Not to mention that recently passed legislation could potentially hold publishers liable for malware ads shown on their sites

Page 4: Group Session: Malvertising : How To Detect and Deal With Malicious Ads

Examples Some examples of legitimate advertisements

that were modified to install malware:

Page 5: Group Session: Malvertising : How To Detect and Deal With Malicious Ads

Examples An example fake website setup as a front for

an online marketing campaign that served entirely for malware:

Page 6: Group Session: Malvertising : How To Detect and Deal With Malicious Ads

Examples Tags with fake serving domain to appear like

an agency adserving system:

Page 7: Group Session: Malvertising : How To Detect and Deal With Malicious Ads

How to Prevent Malware Ads Use Common Sense On Direct Buyers

Who is the buyer? Does he have a known reputation? Could this buyer realistically have a relationship with

this advertiser? Is the offer just too good to be true? Pre-pays, high

CPMs, International focus Check Malware sites –

(msmvps.com/blogs/spywaresucks & mikeonads.com) When Dealing with Ad-Network

Don’t work with a network whose reputation you don’t know

Don’t place tags that contain too many redirects Make sure your ad-networks are educated and aware

of the various scams that have come up

Page 8: Group Session: Malvertising : How To Detect and Deal With Malicious Ads

How to Find Malware Ads What do you do if you receive a user complaint?

Ask for as much technical information as the user can give: screenshots, source URLs, page source

Find out the browser, timezone, country and IP address of the user

Do not push them away and assume that it is the user’s fault – angry users result in bad publicity and complaints with federal agencies, law enforcement and online advocacy groups

Try to emulate that user on your own property Use public proxy servers to emulate foreign IP

addresses Install a tool such as Firefox’s “Tamper Data” to sniff

URLs and look for suspicious behavior.

Page 9: Group Session: Malvertising : How To Detect and Deal With Malicious Ads

Useful Links My Blog: http://www.mikeonads.com/ Spyware Sucks Blog:

http://msmvps.com/blogs/spywaresucks/ Tamper Data FireFox Plugin:

https://addons.mozilla.org/en-US/firefox/addon/966

Fiddler Debugging Tool: http://www.fiddlertool.com/

Cybersecurity Awareness Training · malicious websites and drive-by downloads, P2P file sharing. malvertising, man-in-the-middle attacks, exploit kits. Social Engineering - Social

Detection Systems Signature Based Intrusioncaesar.web.engr.illinois.edu/courses/CS598.S13/... · Intrusion Detection Systems Detect malicious activities/attacks Hacking/ unauthorized

Hot Topics in Cybersecurity & Employee Privacy · 2017-11-13 · ‣Keylogger - logs sequential strokes to figure out login credentials ‣Malvertising - malicious online advertising

URLDoc: Learning to Detect Malicious URLs using Online Logistic Regression

Apply machine learning techniques to detect malicious

PEIMA: Harnessing Power Laws to Detect · PEIMA: Harnessing Power Laws to Detect Malicious Activities from Denial of Service to Intrusion Detection Traffic Analysis and Beyond Stefan

Feature-based Malicious URL and Attack Type Detection ... · machine learning algorithms like the Support Vector Machine (SVM) to detect malicious URLs, RAkEL and ML-kNN learning

AppFA: A Novel Approach to Detect Malicious …downloads.hindawi.com/journals/scn/2018/2854728.pdfSecurityandCommunicationNetworks F :Exampleofkey-valuepairs. signs, and the packet

Malicious Node detection in Vehicle to Vehicle Communicationdetection algorithm [9] is used at the receiver side to detect malicious node. To further reduce the verification delay

Static Analysis of Executables to Detect Malicious Patterns

MalwareBytes - Malvertising and Ransomware

Analyzing New Features of Infected Web Content in ... · Figure 1. The model of the detection process for malicious web pages. features, it cannot detect the malicious web page contents

Can Voters Detect Malicious Manipulation of Ballot Marking ... · Can Voters Detect Malicious Manipulation of Ballot Marking Devices? Matthew Bernhard, Allison McDonald, Henry Meng,

Uncovering The Secrets of Malvertising · Uncovering The Secrets of Malvertising Jérôme Segura, @jeromesegura, Lead Malware Intelligence Analyst Chris Boyd, @paperghost, Lead Malware

Learning to Detect and Classify Malicious Executables in the Wild

Detection Systems Signature Based Intrusionweb.engr.illinois.edu/~caesar/courses/CS598.S13/slides/philip_IDS... · Intrusion Detection Systems Detect malicious activities/attacks

Static Analysis of Executables to Detect Malicious …pages.cs.wisc.edu/~mihai/publications/SAFE Static Analysis For... · Static Analysis of Executables to Detect Malicious ... itself

Detecting Malicious Web Links and Identifying Their Attack ... · Proposed a machine learning approach to detect malicious URLs and to identify attack types. • Method Collect various

Malvertising: The Hidden Threat

Static Analysis of Executables to Detect Malicious Patternspages.cs.wisc.edu/~jha/jha-papers/security/usenix_2003_tr.pdf · Static Analysis of Executables to Detect Malicious Patterns

Learning to Detect and Classify Malicious Executables in

MALWARE ANALYSIS USING MACHINE LEARNING ......¨ Kolter, J. Z., & Maloof, M. A. (2006). Learning to detect and classify malicious executables in Learning to detect and classify malicious

An Online Malicious Spam Email Detection System Using ... · The objective of this paper is to detect the malicious spam emails so that general users can be protected from being re-directed

Integrity of the Ad Supply Chain Anti-Malvertising Best ...•Malvertising: can generally refer to “malicious” advertising of various sorts; connotation today is malware drive-by

PE-Miner: Mining Structural Information to Detect ...homepage.divms.uiowa.edu/~mshafiq/files/raid09-zubair.pdf · PE-Miner: Mining Structural Information to Detect Malicious Executables

Detecting malicious files with YARA rules as they traverse the … · David Bernal @d4v3c0d3r I want to help blue teamers detect malicious files on the network using YARA rules, Zeek

Knowing Your Enemy: Understanding and Detecting ......frauds, etc. To understand the gravity of these malicious adver-tising activities, which we call malvertising, we perform a large-scale

Shady Paths: Leveraging Surﬁng Crowds to Detect …chris/research/doc/ccs13_shadypaths.pdf · Shady Paths: Leveraging Surﬁng Crowds to Detect Malicious Web Pages Gianluca Stringhini,

Advertsing Integrity: Malvertising, etc

Using Data Science Techniques to Detect Malicious Behavior

Malicious Packet Dropping : How It Might Impact the TCP Performance & How We Can Detect It

Malware's Most Wanted: Malvertising Attacks on Huffingtonpost, Yahoo, AOL

Knowing Your Enemy: Understanding and Detecting Malicious ......• Malvertising is a significant threat to the internet revenue model • much of the internet funded by advertising

URLDoc: Learning to Detect Malicious URLs using Online Logistic Regression Presented by : Mohammed Nazim Feroz 11/26/2013

Beyond Blacklists: Learning to Detect Malicious Web Sites from