2

I have recently started seeing interactive ads in free applications I use on Android. I'm used to ads that come in the form of images, gifs or videos. Now, a lightweight, seemingly HTML5-compatible version of a game being advertised is automatically loaded, ready to be played. The only mention of any security implications connected with these interactive ads are outlined in this article.

What are the security risks of malicious interactive ads appearing? Are there user practices (not clicking, closing, configuring any settings) that mitigate the risk?

Improve this question
1
  • 1
    Not a full answer, so just a comment: To mitigate, you can (should) install an ad blocker for Android, such as AdAway available on the F-Droid app store. AFAIK all ad blockers on Android need root access.
    – A. Hersean
    Jan 4, 2019 at 10:57

2 Answers 2

Reset to default
2

Maybe, maybe not. This will primarily depend on the ad wrapper used by the application. Most applications don't write their own libraries to display ads, instead they used a library provided by the ad vendor. This library in turn will call the WebView to display the ads.

If there are vulnerabilities in the WebView or in the wrapper library, then it may possible for a malicious ad to break into the system.

WebView, just like browsers, are designed so it can handle running untrusted JavaScript code. However, WebView, due to its nature of being embedded into another applications also have holes in the sandbox that is used so it can communicate with the host application. If the host application is written carelessly, it is possible for of these communications to expose a functionality that introduces a vulnerability that can be used to break out of the sandbox.

Improve this answer
2

As the famous quote says "If something is free, you are the product". So, most of the free applications in order to generate revenues use ads as a means. However, the ecosystem around the ads isn't really secured and this is where malicious actors abuse the underlying vulnerabilities. In another terms, this can be referred to as Malvertising.

A good read on how steganography is used to exploit at https://www.zdnet.com/article/malicious-code-hidden-in-advert-images-cost-ad-networks-1-13bn-last-year/

Also, HTML5 seems to be heavily abused by Threat actors in the recent days and more on this at https://mediatrust.com/blog/html5-safe-haven-malware

Hope this helps!

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .