Tags containing: "malware"

Advertising | Industry-Research | Perspectives | Supporter Spotlight

Prospering in the increasingly dangerous open programmatic market

January 21, 2022 Gavin Dunaway, Product Marketing – The Media Trust

It was a fourth quarter to remember…and a fourth quarter to forget. The main reason to remember is so other Q4s will look positively luminous in comparison. I’m not just talking about the wrath of Omicron, which ruined holidays for countless families and continues to cause illness, death, and emotional distress across the globe. I’m talking about an alarming rise in malvertising that endangers publisher revenue and consumers’ online safety.

As publishers struggle more than ever to balance user experience and monetization, the perils of the open programmatic marketplace require higher levels of vigilance, lest audiences be lost in a storm of malware. Let’s explore the factors behind the rise in malvertising and what publishers can do to combat its impact.

Malware incidents on the rise

*While malvertising typically subsides in the fourth quarter with higher inventory prices, Q4 2021 malware levels were disturbingly high.*

In the digital ecosystem, The Media Trust detected a 64% increase in malware incidents during the final quarter of 2021 — which can account for thousands of impressions or hits — as compared to the same time period in 2020. And 2020 levels were already high as the programmatic marketplace struggled to snap back during the early days of the pandemic.

Malvertising levels this high at the end of the year are unusual. It typically subsides a bit in the fourth quarter. Because increased advertiser demand enables publishers to increase CPMs and raise programmatic floors most malvertisers are priced out of the market.

However, Q4 2021’s record malware numbers weren’t the result of a few blanket attacks. The industry was assaulted by a wide variety of malicious code and content:

Redirects peaked in October, growing 170% over the course of the year.
In November, Digital media was awash in FizzCore, a notorious form of malicious clickbait that employs cloaking technology to hide its devious content. The amount of FizzCore detected grew 9X over two months.
An outbreak of fake antivirus/software update ads also hit hard in November, marking a 50% rise since the beginning of the year.
E-skimming typically increases in Q4 as bad actors hunt for consumer credit cards, but the amount detected in Q4 2021 was 63% higher than the year prior.
Scam ads, which surged in 2021 and made up nearly a third of malware in the space, stayed high and ticked up an extra 9% in December — nearly exceeding the summer peak.

A most malicious year

*While 2020 saw a surge in malvertising caused by advertisers’ pandemic pullback, the amount of malware in the digital ecosystem in 2021 has been dramatically higher.*

Unfortunately, these numbers are representative of 2021 as whole, where malware simply exploded. The Media Trust’s Digital Security and Operations team managed an average 2,210 malware incidents daily. That’s a 64% increase over 2020 and well above the ~1,000 historical average. During the summer — the height of the 2021 malware blitz — average daily malware incidents stayed above 3,000.

Overall, The Media Trust identified 26,664 new malware incidents in 2021, a ~30% increase over the number cataloged in 2020. And our creative blocker, Media Filter, halted four times more malware than in the year prior.

The proliferation of malvertising is simply breathtaking.

What’s behind the rise in malvertising

Certainly the 2020 surge in malvertising followed advertisers’ pause in spend; bad ads flooded the programmatic advertising space as publishers lowered floors to grab whatever revenue they could. But even as the pandemic drags on and on, programmatic markets seem to have rebounded. So, what’s behind this incredible 2021 surge in malware?

First, from a programming perspective, the malvertising barrier to entry is very low. The dark web is full of malware kits for sale including turnkey phishing solutions and the ever-popular ransomware-as-a-service. There’s a whole black market ecosystem for selling pilfered data and access to infected devices — and often no legal repercussions for bad actors (though there were some impressive arrests in 2021).

Secondly, research from eMarketer found that private marketplaces account for more RTB spend than the open programmatic marketplace. With $15.4 billion in advertiser spend in 2021, private marketplaces made up 56% of all RTB-transacted dollars. The open marketplace sat at $12.3 billion and had a 44% share.

According to eMarketer, the shift to private marketplaces is only going to accelerate in 2022. Spend is predicted to increase another 21% and make up 59% of all RTB spending. However, the open marketplace will only grow 5% and dwindle to a 41% share of RTB spend.

We also see premium advertisers are investing heavily in connected TV (CTV) — although they’re struggling with campaign measurement — direct, and programmatic. These advertisers shifting their buying power away from the open marketplace is likely depressing CPMs. It is also making more room for bad actors to spread a variety of malicious wares.

Is it time to give up on open programmatic?

So, if the open marketplace is suffering from a rapidly growing malware infestation, am I suggesting publishers turn off their open programmatic pipes post-haste? Heavens, no! That’s not really an option for most digital publishers. Can you imagine the amount of revenue left on the table? All the unfilled inventory?

It’s obvious why private marketplaces are increasingly attracting advertiser dollars: high viewability, actually engaged human beings rather than bots, and impressions on well-respected publications. We’ll see top-tier publishers layering in high-impact audience segments that will likely outperform third-party cookies.

But the challenge with private marketplaces has always been getting them to scale. I still hear publishers lament long-lingering Deal IDs with laughable fill rates. Truly getting private marketplaces to hum requires time and resources, something many publishers in the “fat middle” struggle with.

Premium advertisers will keep buying in the open market. This may be to cherry-pick super-cheap inventory on premium publishers or for prospecting purposes. Smaller advertisers may find it easier to reach target audiences across a wider crop of publishers. Publishers also use the open marketplace to find new advertiser prospects and evaluate the market value of various types of inventory and audience segments.

Your best defense against malvertisers is high quality data

The open programmatic marketplace may be getting seedier but diligent publishers can still drive a ton of revenue. It’s just going to take more work to keep audiences safe from all the fraudsters spread across the programmatic pipes.

Having a page/app-level creative blocker to bat away malware before it hits your property is table stakes. But with this massive expansion of malware in open programmatic, the quality of data fueling your blocker is more important than ever. Publishers can’t go cut-rate. Their ad-quality provider should be pumping data into the blocker in real-time from an in-house team of malware analysts. Third-party malware data isn’t going to be fresh enough. It may also lead to revenue-bleeding false positives.

And finally, publishers need to be a lot more discriminating when it comes to their open marketplace partners — and by extension, those partners’ partners. Especially during the pandemic, publishers have been willing to install most demand sources that might give them an edge with bid density. But open programmatic is getting too dangerous to be carefree about the companies you monetize with. Ensure all your demand partners are scrutinizing both tags and landing pages (preferably from a variety of device and geographic profiles). And if a high percentage of the ads they bring you get shot down by your malware blocker, maybe they’re not the right fit for you.

Open programmatic is definitely becoming a more dangerous place for monetization. But that doesn’t mean it’s not worth the revenue. With the right tools and policies, publishers can make bank — and keep their audiences safe and happy.

Advertising | Perspectives | Revenue | Supporter Spotlight

When browser extensions attack: Meet LNKR, an ad ecosystem nightmare

August 11, 2021 Gavin Dunaway, Product Marketing – The Media Trust

My toddler and I share a love for the misadventures of Shaun the Sheep. In particular, we love the episode where sheepdog Bitzer is cleaning the farmhouse window. But the Farmer keeps pointing out specks that Bitzer, try as he might, cannot see.

After countless elaborate attempts to clean the windows, Bitzer notices a chunk of dirt on the Farmer’s coke-bottle glasses. The windows were spotless. The Farmer’s smudgy glasses caused him to see phantom blemishes and incite a great deal of (highly entertaining) chaos on the farm.

Recently, this episode came to mind when talking to a DSP about why a slew of their ads were being blocked on various publishers sites (by a different ad quality provider). The DSP shared the report with us. As we examined the wide variety of blocked ads, we confirmed they were clean. There was no cloaking or malicious code, no compromised landing pages. They were basically spotless. After some analysis, it clicked: We were witnessing fallout from LNKR.

LNKR is the smudgy glasses problem transported to digital media. However, it is far more devious and likely to wreak havoc throughout the digital advertising ecosystem.

The trouble with browser extensions

At heart, LNKR is the browser extension heir to the malicious toolbar, a classic form of adware. Browser toolbars tended to create extra ad slots on publisher pages to serve ads. (These sometimes came with even more noxious malware.) However, LNKR simply injects malicious code right into one or more existing ad placements—on top of publisher-served ads. Most often, the malignant code prompts an auto-redirect with a fake software upgrade or antivirus tool download. (Surprise—it’s really more malware!).

Consumers knowingly (perhaps looking for some unique feature like “change text into pirate speak,” ya landlubber), or unknowingly, install a browser extension with LNKR code. Once that’s done, the LNKR operators can deliver redirect code into any ad slot at any time when the infected browser visits any website. If the malicious code is injected and the redirect is served, the consumer comes under attack.

Reputation and revenue

To compound the problem, they they’ll think that the publisher they just visited served them malvertising. The publisher’s brand is damaged even though it had nothing to do with the attack. (That character defamation also gets passed upstream to the SSPs and DSPs serving ads to the user.)

A publisher’s bad-ad blocker may shut down legitimate ads because users with the LNKR-infected extension have unwanted code injected on top of them. That could rob publishers of revenue. That’s because every single ad campaign served to the infected user will be mistaken for malware and slapped away.

If not corrected at the user level, or discounted from malvertising reporting, most eligible creative sent to an infected user will eventually be blocked. Thus, the scenario in the be bad ads ad infinitum. SSPs will scream at DSPs for pushing malware through the pipes when the accused advertising creative and supply chain is legit. This can further come back to bite the publisher if SSPs pause or cut off relationships with lucrative DSPs.

The publisher and its demand partners end up becoming patsies for LNKR’s bad deeds, because with these malicious extensions… The malware is coming from inside the browser!

A greater danger

Of course, this confusion damages relationships between AdTech platforms. (And let’s face it, they already have serious trust issues). But beyond that, it muddies the waters for malware hunters. More and more innocuous ads are falsely labeled malvertising. This distracts ad quality providers from the job of tracking down the real bad apples—which are always employing clever new evasive measures to avoid detection.

LNKR also represents more of a danger to consumers beyond a malware delivery channel. The browsing of infected users can be tracked and LNKR can also grab search parameters when a user employs any kind of search engine. LNKR has already exhibited the ability for advanced microtargeting. It can infect actual web pages where a user has write access, enabling it to spread to additional users.

Worse, information from infected browsers—as well as access to them—is sold on the dark web to malevolent actors with more malignant schemes. Indeed, LNKR is a key player in the ransomware ecosystem. It’s an ideal tool for extracting personal data that can be exploited for great harm.

Consumer awareness is critical

*Distinct LNKR incidents, with each one accounting for thousands of individual hits, have been on the rise since the beginning of 2021.*

LNKR is an effective malvertising tactic. The number of incidents (which can account for thousands of individual hits) detected by The Media Trust has been swelling since the beginning of 2021. Nipping this ever-growing threat in the bud relies on something that’s long been difficult for the digital advertising industry: consumer education.

Browser extensions are sticky. And consumers often forget what they’ve actually installed. Unused extensions can easily pile up and extension apathy is exactly what the bad actors behind LNKR prey on. That’s where the smudgy glasses issue hits full stride: infected consumers keep getting hit with redirects. They also have no idea that a browser extension causes the issue, let alone which specific extension.

Alongside software updates, operators of the main browsers often prompt users to check their extensions to make sure they’re only housing ones they want. In addition, users need to keep their approved extensions updates—not always a simple task. But older versions of extensions can have unseen vulnerabilities and be compromised.

The rest of the industry needs to spread the truth wherever possible. We must explain that LNKR is a bigger threat than just some annoying redirects. Extension hygiene may not be sexy, but it’s key for an overall good experience on the web and helping you stay clear from malware and unwanted data tracking.

Cleaning up the LNKR smudge

Publishers, though, need to demand more from their bad-ad-blocking services. Ad quality providers must be able to identify LNKR and confirm blocks are not false positives, discount LNKR from bad-ad counts. In addition, the creative blocker needs to ensure it’s stopping the delivery of adware that will further spread the LNKR menace. That’s right: They must block pop-ups, scams, and ads distributing unwanted programs.

Finally, being able to recognize LNKR and alert publishers’ upstream partners ensures less legit creative gets caught in the crossfire. Discounting LNKR in malware reports will limit ire between AdTech partners that could eventually impact publisher revenue.

In real life, a little microfiber cloth makes quick work of a blemish on your glasses. Unfortunately, wiping browsers of the LNKR smudge is going to be a complex, industry-wide struggle. The first step, however, is widespread acknowledgement of the danger at hand.

Advertising | Perspectives | Supporter Spotlight

Opt out of the bad ads that ruin in-app gaming

July 27, 2021 Tobias Silber, CBO – GeoEdge

Since the inception of smartphones, mobile games have been one of the most popular app categories. However, there is one major downside to mobile gaming: the influx of bad ads.

Anyone who’s developed a minor addiction to a mobile game – be it a classic title like Candy Crush, Words with Friends, or a modern sensation, such as Roblox or Among Us – is all too familiar with the frustration of an intrusive ad. User expectations around in-app advertising differ for gaming vs. non-gaming apps. That said, all users draw the line at malicious advertising.

Striking the balance

For app publishers, trying to strike the right balance between monetizing your app effectively and not inundating users with ads is always a delicate process. However, that’s especially true for gaming apps. The success of mobile games is entirely dependent on the user experience. Therefore, a malicious, interruptive, or offensive ad can entirely derail the entire user experience. Ultimately, when it comes to advertising in-app, it’s about serving safe, relevant, and brand-suitable ads for your users.

The good news for app publishers is that gamers are receptive to advertising so long as it adds to the experience. When that happens, ads can enhance rather than detract from the gamer’s experience. Moreover, gamers are more than willing to view ads in exchange for in-game goods, such as extra lives, power-ups, new levels, and in-game currency. These ads help game makers monetize their titles. But they also make the game itself stickier, inducing users to play longer and more often.

Caution: Hazards ahead

Aside from an offensive ad creative, users are exposed to a myriad of threats after clicking on an ad. Because gaming apps appeal to consumers of all ages and all levels, apart from strict ad content parameters, app publishers must recognize the hazards of malicious advertising.

Recently, malvertisers have shifted their gaze from the ad itself to the landing page the ad leads to. And gaming users are often the target of malicious or deceptive attacks, both of which come at the expense of the user experience. Threats include cloaked landing pages leading to scams to father sensitive personal or financial data. Here, the challenge is sifting out the bad actors and ads with a fine-tooth comb to ensure that only high-quality ads make their way onto your app.

A virtuous circle

When it comes to in-app advertising, bad ads have an immediate impact on monetization and the ability to work with valued monetization partners. For instance, the top five in-app platforms avoid apps with a low rating. Additionally, low-quality ads lead to bad reviews, low ratings, user churn.

Unhappy users will to switch to competitors’ apps, and at the very worst, apps may be kicked out of the App Store/Google Play. Additionally, app developers may be banned from the digital ecosystem due to ads that violate Apple’s new ATT policy. To safeguard users and ensure high ad quality, app publishers can follow the three ad quality guidelines: Ads must not contain malware, disrupt the user experience, or feature off-brand or offensive content.

Closing the loop on bad ads

Here’s what tools in-app publishers can implement to maintain high ad quality:

Adopt a real-time bad ad-blocking solution to thwart all malicious attempts.
Use proactive low-quality ad filtering to eliminate user experience killing ads.
Leverage automated and manual content management tools to define and enforce ad content parameters.

Identifying bad actors is difficult. But, luckily for publishers, they can use ad monitoring tools to conduct automated, round-the-clock surveillance of their ad networks and root out bad ads before they ever have a chance to show up in their games.

The best philosophy is to block in real-time. This eliminates any lag in response time and saving energy while preventing bad users experiences from appearing. These days, it’s critical to be certain you are part of the proactive new world vs. a reactive, old world.

Advertising | Revenue

Don’t drive blind: Use benchmarks to navigate digital advertising

August 4, 2020 Cory Schnurr, Head of Marketplace Innovation – The Media Trust

A day in the life of Advertising/Revenue operations may sound monotonous, but no challenge is solved in exactly the same manner. Today’s redirects and malvertising attacks are very different from tomorrow’s inflammatory content or phishing schemes. It’s time to change course in ad operations, and take a route guided by a publisher-specific benchmark.

Privacy regulations and increasingly sophisticated attacks are becoming ever more prominent in digital advertising. So, publishers must shut down risks that negatively impact monetization efforts, or worse, drive regulatory penalties. Industry benchmarks allow you to assess your digital property’s distinct risk profile.

Understanding the risks

Raising awareness of these risks across media publishers is imperative. During the past six months, continuous scanning of dozens of B2C websites across a variety of industry segments uncovered the third-party code risks dwelling in their respective digital ecosystems.

For U.S. Media publishers, here’s what The Media Trust discovered during the past six months:

Security risks:

92% of executing code is attributed to third-party code, up from 81% in 2019
18% domain variability, reflecting the percentage of new domains to the publisher’s site compared to the previous month

Privacy Protection risks:

on average, ~1,500 cookies are dropped on user devices every time they access a media site, a factor that should be included in assessing CCPA compliance
37% of those cookies have a lifespan greater than 12 months, a violation according to existing regulatory regimes, including CNIL’s “French Cookie Law”
We find decades-long lifespan cookies from reputable partners every day across these properties, some approaching an 8,000+ year lifespan

Performance risks:

1.6MB is the JavaScript file size, approximately 60% more than the generally recommended 1MB polite limit
5.66 seconds is the aggregate total load time; if you’re experiencing page latency issues you should look at the contribution from third-party code

Addressing the issues

Publishers can no longer ignore the risks associated with unmanaged third-party code. Unfortunately, investments in resources to build the perfect customer experience and drive revenue often lead to unacceptable malware attacks, redirects, unauthorized collection of personal data, and more. Benchmarks provide a clear means to pinpoint and remediate issues out-of-sync with industry peers.

Brand integrity, regulatory compliance, and the bottom line are at stake. Ad operations must implement strategies that will control unmanaged third-party code. In the same way that brands exercise supply path optimization (SPO) efforts to understand pathways that impact performance and drive revenue, publishers should focus on identifying those vendors that cause problems.

Using these industry benchmarks, publishers can pinpoint which code and which corresponding vendors disrupt your customer experience. The ability to distinguish between what will cause security, regulatory, and performance issues (malware, data breaches) versus what will annoy your users (redirects, PII scams, and poor ad quality) is the first step.

The dangers of driving blind are self-evident. With benchmarks, ad operations teams can change their processes to focus on the vendors that cause problems, and better navigate a path to success.

Perspectives

Malware thrives in a blocking world

October 14, 2019 Chris Olson, CEO & Co-Founder—The Media Trust

Security professionals continue to tell us that the threat landscape is constantly evolving and it’s not uncommon for The Media Trust’s Digital Security & Operations (DSO) team to discover a new threat firsthand. For example, the industry has been testing the effectiveness of malware blockers in lieu of scrutinizing code in the ecosystem. Unfortunately, the result is that publishers are experiencing larger, more penetrating attacks.

A current attack, named Ghostcat-3PC by our DSO, involves malware running behind the scenes. It slips through third-party feed-based malware blockers in order to hijack mobile browser sessions in the U.S. and Europe. Over the course of three months, the DSO discovered more than 130 different outbreaks related to this attack that affected hundreds of well-known publishers.

We detected the malicious ad while analyzing suspicious code from ad files hosted on two cloud platforms, one of which had the URL: qing.js. The malware hid in an ad served to publisher websites. When the malicious ad was delivered to the browser, it lifted browser fingerprints and used them to check whether the ad was running on one of 100+ publishers it was targeting. Each campaign centered on code containing its own list of 100+ publishers that was distinct from the lists of the other campaigns.

Exploiting defense security weakness

The malware achieved persistence by disguising malicious code – either by cloaking it with additional characters at both ends or splicing with additional characters. Most blockers work by detecting known malicious code found in an ad tag or on a publisher site. If the malicious code fails to match any code on the blocker’s keyword list, it will run as designed. Any change to the targeted code, no matter how minor, will prevent the blocker from recognizing it as a threat.

Knowing blockers’ fundamental weakness, attackers split the URL of the malicious domain, qing.js. In this scenario, blockers on the lookout for “qing.js” failed to recognize the disguised URL and therefore allowed it to run. For good measure, the attackers also used hexadecimal encoding to add a layer of obfuscation to the concatenated URL and the JavaScript file that delivered it.

These changes to the URL, combined with the large number of subdomains in use, made the attacks hard to detect and, even once discovered, hard to follow. Obfuscation blurred any connection between the subdomains and the ads, making these links impossible to find except by experts who find and track evolving threat patterns.

Tracking the progress of this massive attack

The malicious attack was out of the ordinary — not only in sophistication but also in scale. The Media Trust identified and rebuffed more than 130 outbreaks linking back to 18 strikingly similar malicious campaigns over just three months. In that period, the malware script morphed into four different versions, each one concatenating URLs to hide from blockers. This method of foiling blockers enabled attackers to repeatedly infiltrate the supply chain—unimpeded—and infect hundreds of publisher websites and their millions of users.

We noted the malvertiser’s use of a host and file naming convention. The pattern emerged once the number of split URLs hosting the malicious script and the number of infected ad campaigns appeared to have reached a critical mass. The convention seemed to associate the script with and track each campaign.

To track the script’s progress, file names and hosts varied with each campaign, and included the JavaScript file name and the image width. Note the strict naming convention for JavaScript file names, which includes the use of Chinese words for:

Numbers (“ba” means 8 and “si” means 4)
Elements (“shui” means water)
Basic colors (“huang” means yellow, “zi” means purple, “qing” means green, “cheng” means orange)
Animals(“niu” means cow)
Vehicles (“che” means car, “sanling” means Mitsubishi)

The URL naming convention suggests the involvement of a group of hackers who continually morph their code and URLs to track their progress. Their tracking did not end here. They appeared to also track the presence of known signature-based security defenses, perhaps to find out how each would respond to the malware. In other words, they might be tracking whether these security tools have been updated to recognize the code and impede its progress.

Protecting the digital ecosystem from this threat

Today’s new and emerging threats are designed to fool signature-based security tools by combining a number of advanced techniques in obfuscation and morphing. In such a challenging environment, the best defense is one that involves collaboration with the entire digital supply chain on identifying and rooting out malicious actors.

Clearly, as publishers embrace blockers’ set-and-forget convenience, malicious actors are taking note. A single security solution will be no match against the thieves and fraudsters who continue to sharpen their saws. Nor will it fulfill the data security requirements of a rising number of data privacy laws like the upcoming California Consumer Privacy Act. More importantly, consumers are willing and able to vote with their feet—and file lawsuits. And they won’t entrust their business to companies that can’t be trusted with their data.

About the author

Chris Olson co-founded The Media Trust with a goal to transform the internet experience by creating better digital ecosystems to govern assets, connect partners and enable Digital Risk Management. Chris has more than 15 years of experience leading high tech and ad technology start-ups and managing international software development, product and sales teams. Prior to The Media Trust, Chris created an Internet-based transaction system to research, buy and sell media for TV, radio, cable, and online channels. He started his career managing equity and fixed income electronic trading desks for Salomon Brothers, Citibank and Commerzbank AG.

Advertising | Industry-Research

Malicious ads are down. But don’t rest easy yet.

August 28, 2019 John Murphy, Chief Strategy Officer – Confiant Inc.

Even among the largest SSPs, there is an enormous difference in quality: The worst performing SSP is 60 times more likely to deliver a malicious ad than the best. Premium publishers need to vet their SSP partners carefully and be aware of how each SSP deals with malicious, low-quality, and In-banner video ads.

Confiant recently conducted our fifth research study on malvertising and ad quality in the digital advertising ecosystem. Confiant’s Demand Quality Report analyzes a normalized sample of over 120 billion impressions and captures unique insights into the quality of ads served by the programmatic marketplace.

How’s the industry doing in Q2?

The chart below shows malicious, In-banner video (IBV), and low-quality ads as a percentage of total impressions over the past five quarters. In Q2, we saw a significant drop in malicious ads and In-banner video (IBV) ads. Malicious ads are down from a high of 0.54% in Q4 2018 to 0.25% in Q2 of this year, the lowest rate observed in our five reports. In-banner video ads are also at an all-time low at 0.10% of impressions in Q2, down from 1.40% one year ago. We suspect that if this trend continues, IBV ads will be all but extinct by the end of 2019.

However, this isn’t to say trouble isn’t lurking, given the highly dynamic nature of online advertising. Low-quality ads continues to be problematic with an increase from 0.14% in Q1 to 0.18% in Q2.

What’s driving these declines?

The decline of malicious and in-banner video ads defies a single explanation. However, trends suggest collaboration efforts from the following could be helping:

The near-universal adoption of ads.txt on top sites, which is driving out arbitrage and unauthorized resale.
Increased vigilance on the part of the SSPs when it comes to ad quality issues
The use of creative-verification solutions to improve industry defenses
Industry initiatives like TAG’s Certified Against Malware program
Better coordination between publishers and ad platforms, which narrows the brief window of time that malvertisers have before their exploits are detected and removed.

What challenges lie ahead?

Even with these improvements, we found that one in every 200 impressions are marred by a serious security or quality issue. We also found that rates of malicious activity vary significantly based on the day of the week. Impressions served on Sunday are three times more likely to deliver a Malicious payload than those served on Thursday.

Although we are seeing a decrease in malicious and In-banner video ads this quarter, security and quality issues continue to change and evolve. Our data identifies what’s on the rise and what publishers are monitoring and blocking in accordance with their business needs and expectations of their audience. The rate of ads that have audio on startup continue to be a top issue that publishers flag with 92% blocking them from their sites. We are also seeing a large increase of publishers blocking heavy ads (800kbs or higher), Audio on Click, and Audio on Hover. Lastly, Malicious ads remain a fairly concentrated problem, with over 50% of impressions coming from just five providers.

It’s worth it

There are huge disparities in quality across top SSPs. Thus, it’s imperative that publishers thoroughly vet SSPs prior to integration and monitor them on an ongoing basis. Ad quality issues are often highly concentrated. So, an informed publisher can minimize user-experience issues by avoiding poorly performing SSPs – often with little impact to monetization.

Industry-Research | Perspectives

WebRTC is the newest, trickiest front in the fight against redirects

April 19, 2019 Tobias Silber, CBO – GeoEdge

One of the great challenges in digital ad security is the fact that the bad actors always start this race in the lead. Whenever the legitimate ad industry gets to work eradicating one security threat, malvertisers find another point of entry to deploy their sinister wares.

For the past couple of years, the industry has had its sights on auto redirects, which can abruptly end the user’s session, prevent the affected publisher from monetizing that session, and potentially damage that user’s trust in the publisher’s site. The fight against redirects is ongoing. And now it’s complicated by a new attack vector—vulnerabilities in the commonly-used web WebRTC protocol. Those vulnerabilities are now responsible for a quarter of all identified redirects.

Exploiting a vulnerability

WebRTC is a framework that facilitates audio and video calls and chats across different web browsers and mobile apps, including VoIP tech (i.e., web phones). It’s used by a large number of major digital companies—Google, Apple, Microsoft, Mozilla, Opera. Back in 2015, media outlets reported WebRTC had a security flaw that could expose users’ real IP addresses. At that time, this was treated as a risk for users who wanted to browse anonymously. Now, malvertisers have gotten in on the game, using that same point of entry to unleash redirects on users.

This rash of redirect attacks is particularly sinister because they take advantage of WebRTC, which is a distributed peer-to-peer service. Blacklisting doesn’t work here as a security method, because there’s effectively no server or domain to blacklist. The perpetrator of the attack will send the request for a redirect to a STUN server, which itself can’t be blocked because it’s used by legitimate companies (Google, Microsoft and so on) running legitimate scripts. If you were to block these attacks, you’d block any data from major cloud-based services.

Targeted and tenacious

The scammers’ strategy gets sneakier from there. WebRTC allows bad actors to identify whether the user already has a public IP or is outside of the targeted range for their attack. It even allows them to identify whether the “user” is likely to be a real person or merely an emulator set up as a security measure. If the user does not seem to be a real person within the desired range, they’ll simply be shown a legit ad from a third-party programmatic ad platform. If they “pass muster,” they’re served a redirect code. And now the perpetrator also has logged their VPN, IP and local network addresses.

In short, blocking any one entity launching these redirects is nearly impossible. Their code is written to evade at several possible security points, using channels that are already difficult to moderate because of their decentralized nature. In researching this problem, GeoEdge found some of these bad actors will evade detection even if it means leaving revenue on the table that they could potentially hijack.

The trouble with header bidding

Technically, any form of malvertising could sneak through WebRTC. But so far, the attacks we’ve identified have been redirects. The bad actors are exploiting vulnerabilities in the programmatic marketplace. In particular, they use header bidding, which has been exploited in 87% of redirects through WebRTC. All told, our research has shown that redirects are costing the digital ad industry $325 million per year, and 24% of those redirect attacks exploit the WebRTC loophole.

GeoEdge studied how these malvertisers operate by reverse-engineering scripts, discovering the malicious code, and using it to launch trial attacks. From that point, researchers could investigate how to block attacks via WebRTC without also breaking WebRTC’s functionality. Ad blockers, they found, were one possible method. However, at times, ad blocking technology can prevent WebRTC from working properly.

The real-time approach

A more effective strategy is one that is already becoming industry standard—analyzing code, recognizing when an unfamiliar script show similar characteristics or behaviors to a known threat, and blocking the problem code before it reaches the publisher’s page. This real-time approach has been embraced by a growing number of publishers in the fight against redirects from other vectors. It’s proven similarly effective in guarding the WebRTC entry point, without impeding the user’s ability to communicate with others across various browsers and devices.

The fight against malicious and low-quality ads will always find its way to new fronts. As it does, all legitimate digital companies, including ad security providers, must find those fronts and engage. When the bad actors manage to evade security methods the industry has relied on in the past, it is time to develop new technology. We may not know what risks we’ll face in the future, but for now, the industry’s best bet is to move toward real-time risk detection and blocking as table stakes in the digital security game.

To learn more, download the GeoEdge white paper. WebRTC Malvertising: fighting a new form of obfuscated attacks.

Industry-Research | Perspectives

How to build a malware-blocking defensive line-up

October 2, 2018 DCN

Popular malware blocking or filtering technologies can go a long way in preventing bad ads from impacting your business’ bottom line. But they’re not a one-stop solution. Much like a quarterback relies on the assistance of his teammates, blockers also function optimally when paired with other smart technologies and tighter security policies. The Media Trust Digital Security & Operations (DSO) team recently uncovered just how weak malware blockers can be when relied upon as a single malware solution. It’s vital that businesses recognize the danger of relying solely on malware blockers to thwart attacks. They must also take the time to build a better game plan to tackle incoming threats.

Obfuscation: The Quarterback Sneak

A big problem with treating malware blockers as a security solution is that they’re rife with issues. Take malicious domains, for example. Recently, a notable domain, known as “dq6375rwn2aoi.cloudfront.net” made its way onto many suppliers’ watch lists. Yet it still managed to sneak beyond malware blockers. The domain in question was disguised with additional code that made it unrecognizable and, therefore, unreadable by the blocker. This technique is known as obfuscation and it’s posing a massive problem in the malvertising space.

According to the DSO team’s analysis, when the right conditions are met, the malware presents users with a fake “you’ve won” pop-up that prompts readers to claim a reward. When users click OK, they are taken to a website that requests for sensitive, personal information like name, email and telephone. The DSO team quickly identified the malware and worked with the publisher to terminate the ads at the source, protecting its’ 900,000 weekly audience members. In just one day, the team uncovered similar obfuscated malware executing in 16 other client websites. All of them had one thing in common: They used the same malware blocking solution.

Blockers: A Narrow Lineup

There are several reasons why blockers provide only a partial solution to preventing bad ads. For starters, at least 90% of malware used in malicious mobile redirections are obfuscated. And that already-high number is growing. There’s also the conundrum of code that can identify and work around specific tools; if the malware detects the presence of a known provider’s tool, it will change tack and behave differently.

Finally, blockers often use third-party malware data which quickly goes stale, thanks to new malware being introduced quicker than the data can track. This issue is so rampant that the DSO team finds a new attack every 30 seconds and classifies at least 5,000 new active malicious domains each month. According to The Media Trust’s analysis, third-party malware data sources take an average of three to five days to identify and record malware. As a result, by the time a third-party filter is updated, 8,600+ attacks could have occurred over a three-day period. That’s at least 14,400 attacks over just five days. For context, a single attack can affect millions of devices.

It’s also important to note that some blockers shut down good ads or block legitimate digital partners like DSPs because of false positives in the data they use. This overzealous approach to rooting out bad ads and bad actors will reduce a publisher’s revenues and can undermine their reputation with a good digital partner. Additionally, when good ads are suppressed, the user experience becomes needlessly compromised. The fact is, while blockers can help, they cannot eliminate malvertising.

The Game Plan: How to Score Against Malvertisers with Blockers

Until machines can match the craftiness of human programmers, companies should supplement their preferred blocking solution with other measures to reduce risk. As regulations like the GDPR and the California Consumer Privacy Act evolve and spread, a single breach can have a huge impact on a company’s finances, performance and reputation. Businesses can mitigate falling victim to these consequences by staying one step ahead of the curve. A good place to start is by devising a game plan that analyzes the opponent’s behaviors and timing. Here are some tips on how companies can take — and keep — the lead.

1. Choose the Best Blocker

As mentioned, a new malware attack hits the ecosystem every 30 seconds. Many blocking solution vendors use compiled synthetic and data sources that are updated every three to five days. Companies should choose a blocker that offers more frequent updates, preferably around the time when new malware is discovered.

2. Understand Malware’s Many Moving Parts

Ad experiences consist of a creative, a tag and a landing page, each of which can be infected. Ten percent of malware that the DSO team detects infect only landing pages. This is likely because most blocking tools ignore these pages, along with site-level malware. Publishers should find out whether the blocker sees these different components, and whether or not they block them when they’re infected, and how.

3. Watch for URLs That Change Their Behavior

Blockers do a good job of rejecting ads with malicious URLs until the latter are obfuscated to avoid detection. Blockers should identify malicious URLs, along with malicious domains and bad hosts. This way, no matter what form the URL takes, the blocker can identify the malware via its host and domain.

4. Remember That Most Malware is Obfuscated

As we’ve seen, this is a huge and growing problem. Legitimate developers obfuscate code to protect intellectual property, while malware developers do it to escape detection. Obfuscation should be reason enough on its own to make companies want to tighten their security policies around malware.

Reviewing Game Day

Malware blockers can be useful tools, but not when they function as the only security tool. Keeping bad ads at bay absolutely requires that companies implement a multi-layered, proactive approach by incorporating other tools and policies into the mix. Regular monitoring of the website from a customer’s view will also allow companies to understand who and what is executing on the website to be able to take action to block code when required and stay compliant.

About the Author:

Uncategorized

Policing third-party code is essential to digital vendor risk management

August 17, 2018 Chris Olson, CEO & Co-Founder—The Media Trust

Some of the biggest companies including Saks Fifth Avenue, Lord and Taylor, Best Buy, MyFitness Pal, and Applebees have been the victims of breaches due to third party code. Third parties provide services around content recommendation engines, ads, customer identification platforms, data management platforms, social media widgets, and video players, to name a few.

Oftentimes, these third parties turn to their own third parties to help deliver their services. When unknown third (or nth) parties become part of a website’s support structure, they can introduce more risks than they were brought in to reduce, because they lie outside of a formal IT organization’s control. Gartner predicts these “shadow IT” will be the root cause of 33% of security problems by 2020.

Throwing light on digital shadow IT

Last year, one of the world’s largest magazine publishers was shocked to find their sites were supported by over 1,000 third parties. This year, they were able to winnow down that number to 100 of the most trusted. In July 2018, random sample of 350 of The Media Trust’s publisher clients showed that each of their domains was supported by an average of 140 third parties, which provided anywhere from 50-95% of each site’s code. For the magazine publisher and those in the random sample, most of these third parties (much less their activities) were unknown to them.

Recently, The Media Trust digital security and operations team found and foiled a malware campaign that affected close to 60 major publishers whose audiences span the globe. These publishers’ trusted digital advertising partners had unknowingly served an ad with malicious code that would replace the legitimate creatives of a globally recognized brand. The code would redirect visitors to a Facebook popup informing victims that they had won a prize and encourage them to enter personally identifying information.

What sets apart this campaign from other redirects is its scale and its targets: some of the world’s most popular online publications that deal only with reputable digital partners. While the campaign was effectively halted, it spotlights the growing challenges of managing the risks third parties and their own vendors can introduce to today’s ever-more dynamic, complex digital ecosystems.

Third-party code putting companies at risk

Third parties can pose risks in several ways. First, they tend to have weaker security measures. This makes them ideal attack vectors for bad actors. The headline-grabbing breaches of Target, Equifax, Ticketmaster, and, more recently, Adidas, prove how popular third parties are to exploit because of their vulnerabilities. In this scenario, when taking on a large organization, hackers will first target a third party and use it as a gateway to enter the larger network.

Second, third party code operate outside the website operator’s cybersecurity infrastructure. Their activities, authorized or otherwise, can neither be monitored nor remediated by the publisher’s marketing and IT departments. As a result, user experience can deteriorate and erode a publisher’s topline and reputation.

However, another, more serious consequence is the unsanctioned collection of user data, which in the EU will expose the publisher to the risk of infringing the GDPR and, soon, the ePR, whose scope is expected to be broader and penalties equally stiff. In fact, the ePR could potentially override the GDPR. Non-compliance is therefore a risk, and will figure prominently in other sought-after markets like Canada, which will enforce PIPEDA later this year, and California, which recently passed the California Consumer Privacy Act.

Reining in risk

Unless they have the tools to actively monitor third party-code, website owners will likely remain unaware of the broad range of code that execute on their sites and of how unexpectedly and frequently new, unknown code appear. The ability to identify, document and authorize these ever-changing vendors is critical to properly mitigate risk. Not only do most enterprises not know the full scale of vendors executing code, but they would be surprised at the amount of consumer data collection activity, i.e., cookie drops, pixel fires, device fingerprint, etc.

Continuous monitoring from your customers’ points of view helps IT teams pinpoint how these vendors and their actions—specifically the domains executed and cookies dropped—change according to user geography, browser, or device. Collecting this type of vendor intelligence provides clear insight into third party behavior to protect customers and brand reputation from cyber threats.

Working with third parties toward strong security posture

Third-party application security is essential for today’s IT security compliance, especially now that regulations are proliferating. Even if the security risk resulted from a third-party compromise, the legal responsibility falls on the primary organization. Therefore, it is crucial that organizations take sufficient steps to manage third-party risk and ensure a safer online environment for themselves and their users.

To do that businesses need to ensure that both their systems and those that look beyond their perimeter to third and nth party codes are secure. First, they should carefully vet all third parties by conducting a risk assessment before bringing any third parties on board. Second, they should maintain a continuously updated inventory of their direct and indirect third parties. Third, they should spell out security policies and standards and use contract clauses and SLAs to enforce them. Fourth, they should follow through by conducting periodic audits of third party security measures. Finally, they should conduct continuous, real-time scanning of their websites to identify any unauthorized code and activities and then compare their findings with what is executing on their visitors’ browsers outside their firewall.

These steps will help to mitigate risk and lock out bad actors from digital ecosystems. Taking a proactive approach to cleaning up and protecting websites will improve the company’s security posture, ensure customers’ safety and protect organizations from the high, upcoming fines of the GDPR and other regulations that follow it.

About the Author:

Research

Hiding in plain sight: The HTML5 security conundrum

June 4, 2018 Pat Ciavolella, Digital Security & Operations Director–The Media Trust

In recent years, as a growing number of security woes plagued Flash users, browser vendors and developers began to flee Flash for the more secure HTML5 and other open standards. Between 2014 and 2018, the percentage of people viewing a page in Chrome with Flash slid from 28% to 8%. Meanwhile, the percentage of websites that use HTML5 has grown to 70%.

In 2015, when the Interactive Advertising Bureau (IAB) updated its digital advertising guide with best practices for using HTML5, they cited security as the chief reason behind publishers’ adoption of HTML5. While the IAB was right that HTML5 offers far better security than Flash, it has a critical weakness. Hackers now use HTML5’s security functionality to hide malware. This should give pause to HTML5 devotees.

First identified in April, this malware appears to be part of a coordinated campaign that targets iOS devices. This is partly because they are popular, partly because they make detection even more challenging. It has produced at least 21 separate incidents affecting dozens of globally recognized online media publishers and at least 15 ad networks. Ironically, the malware by no means exploits an HTML5 vulnerability. Rather, it uses functionality that not only secures software from malicious attacks by making code difficult to understand, but also helps to deliver a rich experience.

Exploiting Weaknesses

In 2015, just as the exodus from Flash began in earnest, university researchers discovered several techniques to convert HTML5 into a safe haven for malware. The researchers found that if malware were written using the techniques to make code hard to read, it would avoid detection regardless of which browser web visitors used. When used to hide malware, these techniques were coupled with a drive-by download attack that followed these steps:

Redirection and Cloaking: The victim goes through a series of redirects that effectively hide attack’s source. The victim’s browser information is gathered and sent to a remote server. If the browser has any vulnerabilities commonly, a malware code is sent back to the client.
De-obfuscation: The malware code is obfuscated (broken into chunks) in order to prevent detection. Once vulnerabilities are found in the browser, the code is de-obfuscated (converted into clear-text and reassembled).
Environment Preparation: The malware puts together code that will exploit the vulnerabilities.
Exploitation: The malware injects the harmful code.

A Growing Problem

Over the course of the two years that immediately followed the publication of the research, malware developers appeared to make little use of HTML5. In 2016, they used a bug in HTML5 to freeze computers and obtain unsuspecting users’ phone numbers. Then, in 2017, The Media Trust malware team identified a small number of random HTML5 malware that made little to no impact on the broader digital ecosystem. It is possible that bad actors behind the malware were simply experimenting before staging a more coordinated attack in a larger scale.

What distinguishes this year’s HTML5 malware from earlier versions is the underlying campaign’s level of coordination and the style of attack. More specifically, the campaign reflects the malware developers’ understanding of the display advertising supply chain. In particular, they recognized the thousands of potential victims. They stage the attack without user interaction, relying instead on auto-redirection. The result is a quicker, much more widespread attack on numerous unsuspecting users.

The Malware Technique

Delivery: When a user visits a targeted online publication, an ad network delivers the malicious ad to the webpage.
Checking Criteria: As the user’s device meets each criterion—namely, whether it’s iOS and whether it’s connected to the user’s carrier—the code serving the HTML5 creative checks the criteria. Once the criteria are met, the malware is reassembled in a way that allows the malicious code to execute.
Auto-redirection: The redirect is executed. The user is taken to another page that requests their input of personal information.

Preventing the HTML5 Malware Spread Through Campaigns

Should advertisers and marketers stop using HTML5? The answer is no. HTML5 is still far more secure than Flash. However, the HTML5 malware, along with a burgeoning number of malware, are proving more difficult to detect and will require marketers to change how they secure their digital supply chain.

HTML5 malware fly under the radar of traditional security measures like antivirus. Thwarting it requires a more holistic approach where organizations collaborate with their digital partners and third parties on improving the security of their digital ecosystem. It also requires marketers to work with a cross section of teams outside of marketing — cybersecurity, compliance, etc. — in order to improve the security of their creatives and digital assets.

In the digital marketing and media world, hackers prefer easy targets like third parties because they often have weaker security postures than their clients. Once hackers break through a third party’s security measures, they can enter the client’s secure networks undetected through a trusted connection. Another easy target are online ads, which let hackers spread malware to thousands of users without having to compromise or infect a website.

Organizations can avoid third-party and online ad risks by putting in place a robust digital vendor risk management program to police every actor and every code that executes in their digital ecosystem. Such a program enables organizations to develop and continuously update their inventory of direct and indirect vendors.

In today’s complex, dynamic digital ecosystem, an organization’s mix of vendors can change daily. Keeping track of these vendors will require continuous, real-time scanning of digital assets. Second, it helps assess and document the risks from each of these vendors. Third, it enables organizations to share policies and work with vendors and digital partners on resolving issues. Finally, it enables organizations to terminate vendors who continue to violate policy after they have been put on notice.

About the Author

Patrick Ciavolella is Digital Security & Operations Director at The Media Trust. He has been working at the company for over 11 years, protecting clients’ digital ecosystems from the ever-evolving threat landscape. His experience gives him a unique perspective on how companies can defend against rapid, sophisticated and targeted malware attacks.

Industry-Research

Content Pirates and Ad Hijackers Earn $200 million a Year

May 22, 2015 Research Team—DCN

Digital Citizens Alliance and MediaLink have released a new edition of their “Good Money Gone Bad” report, which examines the impact of content piracy on the digital advertising ecosystem. While many of the players have changed since the first edition, the revenue numbers have remained stable: The 589 sites analyzed in 2014 generated an estimated $209 million in aggregate annual revenue from advertising alone, as compared with $227 million in 2013.

Even worse: The advertising profits garnered by content thieves do not equate with the losses incurred by the owners of the content. As the report points out “these losses are unquestionably greater by many orders of magnitude.”

And brands whose ads appear on content theft sites “take a double hit” according to the report: Their reputations suffer by association with content theft itself and with the illicit services whose ads also appear on the sites. In addition, they are being defrauded. The money they spent to advertise on legitimate sites is instead fueling content theft, and the impression counts are being boosted by bots and other fraudulent means.

MediaLink’s analysis of these ad-supported pirate sites provides additional insights into other aspects of the content theft ecosystem, including the continuing presence of premium brand ads, the danger to users who are exposed to malware, and the prevalence of ad fraud.

Here are a few other highlights from the report:

Premium Brand Advertisers Still at Risk:
Despite increased industry awareness of the problem, the reputation and value of legitimate brands continues to be threatened as their ads show up in increasing numbers on offending sites, often alongside offensive ads. There were 132 premium brands observed by MediaLink researchers on the sites, up from 89 the previous year.

Malware Threatens Consumers
One-third of the sites included links with the potential to infect users’ computers with viruses and other malware. In most cases the links are hidden behind Download or Play buttons, but in many cases, it is not even necessary to click on a link to spawn the unwanted download. These downloads earn site owners millions in annual revenue.

Fraud
Ad fraud has been in the spotlight over the past year as the advertising industry has tried to come to terms with the problem. This is a significant challenge for the industry as a whole, but is particularly virulent in the content theft business—not surprising for an industry that at its core is based on theft and fraud.

Video Streaming a Growing Model
As consumer appetites have shifted from downloading to streaming, content theft sites have followed suit. The number of video streaming sites in 2014 was up 40% from the original report, and revenue grew significantly due to video CPMs that are far higher than those for display ads. The profitability and ease of execution are the primary drivers of ad-supported content theft. The best chance to deter or degrade these activities is through legal, technical, or industry initiatives, which have made headway.