Online advertising is big business. In 2013, U.S. online ad revenue reached $4.28 billion, surpassing broadcast television ads for the first time in history. That’s a 17% increase over the prior year. Unfortunately, as advertisers scramble to claim their slice of this growing pie, they sometimes leave the door open to cybercriminals who exploit weaknesses in the ad ecosystem to spread viruses and other malicious software through malicious advertisements or “malvertisements.”
Some industry insiders claim that malvertisements increased a whopping 200% in 2013, representing 12.4 billion malicious ad impressions. Symantec recently claimed that more than half of Internet website publishers have suffered a malware attack through a malicious advertisement.
The particularly insidious aspect of malvertisements is this: they increasingly appear on websites that most people trust. In December, two million Yahoo customers were exposed to a malicious advertisement that appeared for four days on Yahoo Mail and Yahoo IM sites. Yahoo is just a recent example. Since as far back as 2006, when MySpace inadvertently served up malware to over a million of its users, malicious ads have flummoxed online website operators who rely on banner ads for revenue. Malicious ads have also popped up on sites operated by Disney, Fox, MLB, Google, YouTube, and the New York Times, just to name a few. Our normal advice to only visit sites you trust is rendered completely ineffective when those trusted sites serve up ads that turn out to be malicious.
In a senate report issued last month, the Federal Trade Commission (FTC) and security groups have taken the online advertising industry to task for not doing more to stem the tide of these malicious ads. But the online ad ecosystem is complex and fixing it is proving to be a monumental undertaking. Many websites bring in content from other sites and it’s impossible for the website operator to vet those downstream websites for malicious content. To give you an idea of the scope of the problem, note that the popular website TMZ.com connects to a staggering 352 external websites to bring ads and other content to the users of their web pages.
Here are some tips to help minimize your risk of being infected through a malicious advertisement: • Be careful about clicking on ads. Not all malicious advertisements require you to click on them to infect your computer, but many do. • Keep your computer up-to-date with all patches, at least monthly. • Install antivirus and keep it updated. Many antivirus packages require an annual subscription, and if you don’t pay it, it stops working, sometimes without notice. If you can’t afford antivirus, talk to your Internet service provider. Hawaiian Telcom offers free antivirus to all its residential Internet customers, and some other providers do as well. There are also several well-respected free versions, such as AVG and Avast. • Enable the popup blocker in your browser, and consider an ad blocker browser plugin, such as Adblock, which is available for Chrome, Firefox and Internet Explorer (IE).