4 ms·

Here's the whitepaper in question: http://www.invincea.com/wp-content/uploads/2014/10/Micro-Targeted-Malvertising-WP-FINAL-10-18-14.pdf http://www.invincea.com

by btown 12y ago

Here's the whitepaper in question: http://www.invincea.com/wp-content/uploads/2014/10/Micro-Targeted-Malvertising-WP-FINAL-10-18-14.pdf http://www.invincea.com/wp-content/uploads/2014/10/Micro-Tar... > Most of the attacks featured here were not detected by standard Anti-Virus because the malware hashes constantly change. > Web proxy blocking updates, even in real time, will not stop new malvertising landing pages that appear and disappear within minutes. > Intelligence feeds from the premier intelligence providers, based on hostname, IP, URL or domain will not be able to block malicious malvertisers quickly enough. > ... opting out merely places a blocking cookie in your browser. This means that ad providers will not target or retarget based on cookies. But as shown above, the new targeted advertising is via IP intelligence. It seems like these are extremely difficult to mitigate without heuristic-based antivirus systems. And even if the bidding engines were to scrape them, malicious ad servers could simply serve benign content to all but the targeted IPs. That said, it's very possible that patterns would emerge in this type of targeted advertising that could be marked as fraudulent using machine learning (for instance, if a brand new ad server were to suddenly start requesting IP targeting). I'm sure the talented people at the larger ad-exchange-software companies like AppNexus will figure something out - or they already have!

meowface 12y ago
Actually, there are several ways to detect such attacks. I work in network security and incident response, and I immediately recognized the URLs in the infection chain from Figure 3 and Figure 20 in the whitepaper. They're using the Sweet Orange exploit kit, which has been around for a while and is not that hard to detect if you have any appliance screening HTTP requests and responses. Example URL patterns: http://malware-traffic-analysis.net/2014/10/06/index2.html http://malware-traffic-analysis.net/2014/10/06/index2.html Also, despite Invincea's claims to the contrary, good intelligence feeds and in some cases just proxy domain categorization are often fast enough to catch these for most organizations, at least in cases where the attack isn't specifically targeted at a single organization. This is on top of multiple layers of defense that any decent company should have, many of which could catch numerous indicators (domain patterns, URI paths, Javascript) tied to these exploit kits. The bidder has to prop up and supply the exploit kits themselves, and most of the time it's Sweet Orange, Nuclear, Rig, or Angler. But these are all "commodity" exploit kits and aren't even remotely custom made like they have been in some APT attacks. APTs may also go the ad bidding route and provide their own handcrafted exploit kits, but they may not want to go through a middleman like this and set up a corporate front. The only unnerving part is the ability to choose a specific target subnet. If the ad networks or second-tier middlemen of "spreaders" / "distributors" are promising clients exclusive access to a certain group of servers or even an entire ad network for a length of time, and if the client uses a specifically created new domain and maybe even a fresh IP, then that means no one may know about the compromised server/network until it's too late and several people from the targeted organization visit it. I don't know for sure since Invincea did not investigate more into the human aspect of this, but I suspect for this to be profitable there's probably a lot of "overselling" going on, and the bidders interfacing with the ad networks themselves are serving multiple customers' campaigns (or their own campaigns) on the same servers and ad networks, which makes it more difficult to successfully pull off targeted drivebys or "watering holes" as they will get detected and evicted. >I'm sure the talented people at the larger ad-exchange-software companies like AppNexus will figure something out - or they already have! AppNexus has been a major offender here for a long time. They've had numerous incidents of malicious ads over the years. I know because I've seen them myself when investigating malware incidents (e.g. adnxs.com as the Referer in an exploit kit chain). You can also see adnxs.com in Figure 21 of the whitepaper. I certainly hope they start caring more about security and establish a more stringent ad reviewal process.
- meowface 12y ago
  Also, just a follow up: many organizations in my industry are actually completely blocking most major ad networks (including AppNexus and DoubleClick) at their proxies due to all the issues caused by malvertising. My organization is currently looking into it. Malvertising is a much more serious problem than people think, though I think this article and whitepaper is slightly FUD.
  - Kalium 12y ago
    Seems a little short-sighted. I mean, shouldn't you be copying that traffic into something sandboxed to search for potentially new and interesting attacks?
__Joker 12y ago
Yes, centralized web content filter work better with these. As only centralized or aggregated requests could can detect these pattern. Proxies through request where the request and response in analyzed in a proxy server works better. I think spyware or malaware data might not be encrypted.
j_s 12y ago
There is also a webinar available: http://www.invincea.com/2014/10/webinar-targeted-malvertising/ http://www.invincea.com/2014/10/webinar-targeted-malvertisin... A recent HN discussion brought up the application virtualization tech Invencia offers, including some of its drawbacks: https://news.ycombinator.com/item?id=8428453 https://news.ycombinator.com/item?id=8428453

by btown 12y ago

meowface 12y ago

Actually, there are several ways to detect such attacks. I work in network security and incident response, and I immediately recognized the URLs in the infection chain from Figure 3 and Figure 20 in the whitepaper. They're using the Sweet Orange exploit kit, which has been around for a while and is not that hard to detect if you have any appliance screening HTTP requests and responses. Example URL patterns: http://malware-traffic-analysis.net/2014/10/06/index2.html http://malware-traffic-analysis.net/2014/10/06/index2.html Also, despite Invincea's claims to the contrary, good intelligence feeds and in some cases just proxy domain categorization are often fast enough to catch these for most organizations, at least in cases where the attack isn't specifically targeted at a single organization. This is on top of multiple layers of defense that any decent company should have, many of which could catch numerous indicators (domain patterns, URI paths, Javascript) tied to these exploit kits. The bidder has to prop up and supply the exploit kits themselves, and most of the time it's Sweet Orange, Nuclear, Rig, or Angler. But these are all "commodity" exploit kits and aren't even remotely custom made like they have been in some APT attacks. APTs may also go the ad bidding route and provide their own handcrafted exploit kits, but they may not want to go through a middleman like this and set up a corporate front. The only unnerving part is the ability to choose a specific target subnet. If the ad networks or second-tier middlemen of "spreaders" / "distributors" are promising clients exclusive access to a certain group of servers or even an entire ad network for a length of time, and if the client uses a specifically created new domain and maybe even a fresh IP, then that means no one may know about the compromised server/network until it's too late and several people from the targeted organization visit it. I don't know for sure since Invincea did not investigate more into the human aspect of this, but I suspect for this to be profitable there's probably a lot of "overselling" going on, and the bidders interfacing with the ad networks themselves are serving multiple customers' campaigns (or their own campaigns) on the same servers and ad networks, which makes it more difficult to successfully pull off targeted drivebys or "watering holes" as they will get detected and evicted. >I'm sure the talented people at the larger ad-exchange-software companies like AppNexus will figure something out - or they already have! AppNexus has been a major offender here for a long time. They've had numerous incidents of malicious ads over the years. I know because I've seen them myself when investigating malware incidents (e.g. adnxs.com as the Referer in an exploit kit chain). You can also see adnxs.com in Figure 21 of the whitepaper. I certainly hope they start caring more about security and establish a more stringent ad reviewal process.

meowface 12y ago
Also, just a follow up: many organizations in my industry are actually completely blocking most major ad networks (including AppNexus and DoubleClick) at their proxies due to all the issues caused by malvertising. My organization is currently looking into it. Malvertising is a much more serious problem than people think, though I think this article and whitepaper is slightly FUD.
- Kalium 12y ago
  Seems a little short-sighted. I mean, shouldn't you be copying that traffic into something sandboxed to search for potentially new and interesting attacks?

__Joker 12y ago

Yes, centralized web content filter work better with these. As only centralized or aggregated requests could can detect these pattern. Proxies through request where the request and response in analyzed in a proxy server works better. I think spyware or malaware data might not be encrypted.

j_s 12y ago

There is also a webinar available: http://www.invincea.com/2014/10/webinar-targeted-malvertising/ http://www.invincea.com/2014/10/webinar-targeted-malvertisin... A recent HN discussion brought up the application virtualization tech Invencia offers, including some of its drawbacks: https://news.ycombinator.com/item?id=8428453 https://news.ycombinator.com/item?id=8428453