1

We've received a random email, which was of-course by the way it looks might be a marketing attempt - however, one always needs for a verification to be done. The email read the following:

We have identified that the website http://example.com/ is serving up malicious content. Attached is our initial report. Please can you confirm receipt of this email by directly replying to the sender.

When we find compromised websites, if we feel it is in the public interest, we inform search engine providers, Law Enforcement Agencies and our customers of the compromise to enable them to make appropriate steps. In some cases, we publish our findings within a reasonable time to ensure the general public are aware of any risks presented by the compromise.

We may be able to provide further information on the compromise as and when our research identifies it.

You have received this email because we notify sites by emailing to industry recognized email addresses for reporting compromised sites. If you have any questions then please feel free to contact us on the address used to send this email.

Post this email, we checked up with our Ad-Server for which I came across and inspected the domain which earlier had an open Unvalidated Redirect Vulnerability but was a business use-case and was needed at production system. The URL looks like below:

hxxp://banners.xxx.com/www/content/afr.php?zoneid=737&target=_blank&cb=1708201502

Although a Unvalidated Redirect could be used to redirect users to malicious sites but I am aware our internal servers are not sending any malicious code (we verified this from internal security inspection of all consistent & active code at production Ad-Server). It's hence sending no malicious content from insider organization servers to any external entities.

My question is, why all the Ad-severing servers are termed as CnC in most reports like they claimed in this below report and how do we respond?

enter image description here

Can we otherwise deploy a known tool to detect if there are any certainty on our Ad-Server for the results delivered in end-reports or treat it as a complete marketing agenda since with manual inspection, we looked down to header level & packet level data which shows false positive.

Improve this question

1 Answer 1

Reset to default
1

My question is, why all the Ad-severing servers are termed as CnC in most reports like they claimed in this below report and how do we respond?

Because the way advertisement is done today on the internet make it easy to use ads to serve malware or do social attacks. There is already the term Malvertisement for malware delivery through advertisements and as far as I know all of the major advertising networks were affected already. If you search for malvertisement you will find lots of examples, reports that it is rapidly increasing and that is even used in micro-targeted attacks.

Unfortunately there is no sure way to find out if a place you offer for advertisement will serve malware. The process of including the advertisement is very dynamic and lots of parties are involved and real time bidding makes it easy to include the malvertisement only at specific times, for specific browsers, specific source IP address or similar. This way it is impossible to find out with random inspection if there will be malvertisement or not.

Part of these malvertisement attacks are compromised ad-servers, like the one from Yahoo in 2014, OpenX several times or MadAdsMedia 2015.

Improve this answer
15
  • ActiveX restrictions at browser level determines a controlled environment detection and prevention. I don't see any threats for a CVE-2015 which isn't verified. Also, is there any specific deployment tool we can use to at-least verify!? Compliance requires this.
    – Shritam Bhowmick
    Jan 30, 2016 at 17:19
  • 1
    @ShritamBhowmick: I'm not sure why you refer to ActiveX and some unspecified CVE from 2015. The majority of malvertisement in 2015 was probably with Flash and in 2014 with Java and there were lots of different exploits involved.
    – Steffen Ullrich
    Jan 30, 2016 at 17:22
  • 1
    @ShritamBhowmick: since there are no details how the ads are delivered by you and how you control the content of the ads it is impossible to suggest any improvement of this process. But unless the (unknown) sender of the mail you received tries to sell you something I would believe that you actually served malware. It is not uncommon for ad-servers to get compromised.
    – Steffen Ullrich
    Jan 30, 2016 at 17:26
  • If Ad-Servers get's compromised, does that it scope of internal organization!?
    – Shritam Bhowmick
    Jan 30, 2016 at 19:00
  • 1
    @ShritamBhowmick: sorry, but I'm not able to understand what you ask in this comment. Maybe you could provide an example to make it more clear.
    – Steffen Ullrich
    Jan 30, 2016 at 20:55

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .