3

One of my country's main TV channel has a website from which one can watch it live - in streaming. Obviously, it serves ads in the meanwhile, mainly from google partners. One night I had the website open while watching at my router logs and I noticed that - according to my router - I was being DDoSed by about 20 IP addresses.

I investigated further and found that this happens most times I open the website at peak time (20-23) and I allow third party Javascript. Specifically, it happens when I allow the domain partners.googleadservices.com, which in turns loads other javascript on a different domain, that in turn loads more external javascript, that in the end results in my IP being caught and "DDoSed" by the botnet.

The third level domain of the actual URL last loaded before triggering the event is listed online as a domain that a while ago had to do with the distribution/monetization of a malicious browser extension.

What the router calls "DDoS" actually consists of UDP packets being sent from random ports to random ports. The logs are not more specific and I didn't feel like forwarding all ports traffic to analyse it.

I have had a look at the machines behind those IPs and they seem to be compromised machines: they belong to various, very different, registrars and sometimes expose what look like vulnerable services (webservers, old routers interfaces, webcam controllers...).

The strangest thing is that the first time I whoised the originating IPs, most of them belong to my country (not a huge one) and the most frequent was actually from my home town - definitely not a big one! But probably it was only a coincidence since with more data the IPs seem to be distributed all over Europe.

Now I have two questions, and I hope it is appropriate to ask them here. 1) Is it what it looks to me? An ad that is either malicious or compromised and that triggers a botnet scan to recruit more machines? 2) Is this normal and common? what should one do? Ignore it? Tell the website owner? Tell the ad provider? Should/am-i-legally-allowed-to investigate more?

Thanks!

  • Hi. Regarding your question #2, we on Stack Exchange can't speculate as to what is legal for you to do. You'll have to understand your own country's laws, and possibly seek a qualified lawyer's help. – John Deters Aug 22 '16 at 20:03
  • 1
    Some advertisements deliver malware, even occasionally from "reputable" ad servers, so it's not as uncommon as we'd like. As far as "what should I do?", have you considered using a tool like NoScript, Ghostery, Privacy Badger, or other similar browser plug-in to block external javascripts? You'll pretty much have to take care of this yourself, because on the web, no one else will. – John Deters Aug 22 '16 at 20:07
  • Thanks John. I am not too much concerned about my protection here; I was more interested in what one should do in terms of denouncing the thing, maybe just a way to give a reputation feedback of the url to the ad provider (in this case I'd say Google) or the ultimate website owner. But I understand the answer to this question is also probably tied to laws and regulations of the countries and organizations involved. – sowdust Aug 22 '16 at 20:15
  • Solution: Install an ad blocker. – Shadur Aug 23 '16 at 7:32
  • Shadur, unluckily this is not a solution. I am not sure why, but with ad block plus the problem still remains. Noscript obviously avoids it - unless you allow those domains. – sowdust Aug 23 '16 at 18:59
4

Very interesting analysis.

Malicious ads/creatives are becoming more careful and precise in their targeting, meaning that they increasingly include code that makes a decision whether the malicious payload should be deployed or not, and if not, a legitimate creative is delivered instead.

So it is not impossible and in fact not even unlikely that the operator controlling this malicious deployment is targeting a specific geographical area at a specific time, and that as a result of that targeting, there was some signal that your IP address should be invited to join the party, which was hopefully foiled by your router or by other defenses.

In terms of actions, I have two to suggest.

  1. Contact the website owner- the TV station. They have control over what kinds/providers of ads/creatives are allowed on their properties (inventory), and their reputation- not the advertiser or ad exchange- is impacted if malicious activity is detected by their customers or other monitors. So, definitely reach out to them with any details you can find.

  2. Check that the machine you were browsing from is not compromised, e.g. is not listening on those udp ports, or has unusual processes running, or is issuing strange outbound command-and-control requests.

  • Thank you very much Jonah. As of the latter part of your answer, how would be better to retroactively detect suspicious outbund requests without having a huge list of IoCs and just regular activity logs of a Unix machine? – sowdust Aug 22 '16 at 21:01
  • Sure, normal activity logs on a unix host will not say anything useful, would need to monitor netstat or lsof or run nmap from another host. But a unix host is unlikely to have been compromised anyway, very very few attacks like this even target Macs, much less some other unix. – Jonah Benton Aug 22 '16 at 22:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.