How hack on 10,000 WordPress sites was used to launch an epic malvertising campaign

Security researchers at Check Point should quit messing around and fix their incredibly buggy security blades that charge arms and legs for.

Meh

Preaching to the choir.

It's not until stories like this make it to the front page of "mainstream" media, will anything happen. And considering we're 10 years and counting - I an't holding my breath.

Blocked for an Entire Organization

For the most part, nobody in the organization complains about this. Go figure. But, there was one news site, Forbes, that refused content when detecting blocked ads, and some people actually asked that it be allowed--which we didn't do. Last I checked, Forbes works a little differently now.

How to Fix It:

If you want to use ads to monetize content, it's either going to take an ad network or other vehicle that'll take responsibility for any infections. And, that might take being able to sue those who infect people by using tainted ad providers. But, I'm not holding out for this.

Lawyering up

> Check Point said the criminals made a laughing stock of the legitimate online advertising ecosystem.

The crims are really a bit late to that particular party. But at least they are making some money out of it.

None of this changes until someone starts suing the legitimate parts of the chain for actual damage incurred such as from a ransomware infection(*). IANAL - anyone know how that would/could/should work? Can a web site that serves up 3rd party malware legitimately be held responsible (in any jusrisdiction)?

I'm currently retaining the legal representation of Messrs. N. O'script, P. Badger and U. Block.

script blocking

by DEFAULT, EVERY browser should block every 3rd party cookie and javascript.

Some domains should be always blacklisted.

User can whitelist, once off.

Why do people have to install noScript (used to use it), uMatrix (current on Firefox on all my platforms), uBlock etc?

Far more effective than AV SW and speeds up rather than slows computer use!

It's incredibly difficult

The exact content users see depends on who they are, where they are, what device they're using and other variables. This makes it incredibly difficult for both publishers and ad networks to conclusively review every version of an advert for malicious content.

I don't see what the difficulty is. In the US, ad agencies are starting to be held liable for false advertising by their clients[1]. It is only a short step to hold them liable for distributing malware.

[1] https://www.retailconsumerproductslaw.com/2018/02/holding-agencies-accountable/

Uninstalling Flash, and installing uBlock Origin has stopped me getting an infection for years.

I don't miss all the crappy flash games, and I definitely don't miss the noisy flash ads.

There is a simple solution

"The ads often contained malicious JavaScript."

There is a simple solution to malvertising: ABSOLUTELY NO JAVASCRIPT, JAVA, FLASH, or SIMILAR IN ANY AD EVER, NO EXCEPTION! Advertisements used to work just fine without javascript, java, or Flash. What changed?

But this will never happen. Their greed trumps my security (and privacy) every day of the week, and twice on Sunday.

" at least 40,000 clicks on malicious adverts"

Who clicks on adverts? Has anybody here ever clicked an ad? Does anybody know somebody who has clicked on an ad?

I've accidentally clicked on ads twice. A casual survey of friends and family shows a similar pattern. Those 40,000 clicks can't all be accidental.

legit web ad ecosystem?

Doesn't exist.

Adkernel - leading white label technology firm's been wrongly classified as a player in this article

This is Yevgen Peresvyetov, CEO of AdKernel and we’d like to comment on the article above.

As a white label tech firm, we have ongoing and active technologies to detect fraud and we support all industry efforts to contain the issue. That said, unfortunately the article includes AdKernel as an actor in this fraud scheme which is 100% incorrect. Specifically, we are not now and have never been a reseller or ad network as the research blogpost suggests numerous times. Additionally, the errors in the original blogpost are compounded since Checkpoint assumed Adkernel owns domains: Junnify.com and Bikinisgroup.com. We do not! They are owned by ad network clients of AdKernel. Another factual error.

While the researchers did a great job discovering fraudulent and malvertising activities, they mistakenly included Adkernel as an "ad-network" or "reseller. We have we contacted Check Point requesting an immediate correction to the report since the information in the post in inaccurate.

Malvertising is the industry-wide problem. You can easily find articles about biggest ad networks on the planet has been compromized:

https://www.google.com/search?q=malvertising+leading+ad+networks&oq=malvertising+leading+ad+networks. We are constantly looking to improve ad-scanning techniques and growing our team of ad campaign reviewers & verification experts.

We are on the same side with CheckPoint here. Come on, CheckPoint, we are allies in this fight! You are blaming wrong ppl!