It looks like the malware guys are indeed getting more tricky, and this time it has an effect on multiple parties. It deprives Google of the impressions from the adverts and potentially can infect surfers with some nasty malware.
Again it’s using the hosts file, redirecting Google’s own ads to those from a nefarious source.
A security company has identified a Trojan horse program that replaces Google text advertisements on Web pages with ads from another source, depriving Google of revenue and potentially causing problems for end users.
Google may be powerless to stop the trick since it involves the modification of an internal PC file, called the hosts file, that is used to match domain names of Web sites with IP addresses, said Romanian security company BitDefender.
It’s a pretty interesting vector and I guess in the coming year we are going to see a lot more tricks like this as the bad guys get more tricky and start thinking of new ways to get to people.
BitDefender said in an advisory this particular malware directs a browser to download advertisements from a different server than Google’s ad server.
BitDefender named the malware Trojan.Qhost.WU and said it is not spreading fast and poses a “medium” risk of damage. It did not say how the Trojan is being circulated, and company representatives did not return a call for comment.
Besides costing Google ad revenue, there is a danger that those replacement advertisements could contain links to sites with malicious software, BitDefender said. Web site owners who buy ads through Google, as well as Google itself, can lose out on both Web traffic and revenue if people are diverted from its ads.
As stated in the article there’s not much anyone can do, apart from the end-user making sure they don’t browse any malicious sites or run any software from unknown sources that might change their hosts file.
Source: Network World
- Santoku Linux – Mobile Forensics, Malware Analysis, and App Security Testing LiveCD
- Appie – Portable Android Security Testing Suite
- Flash Zero Day Being Exploited In The Wild
- Google Eavesdropping Software
- New Password Stealing Trojan Targets WoW Players
- New Trojan Targets World Cup Fans – Troj/Haxdoor-IN
Most Read in Malware:
- Nasty Trojan Zeus Evades Antivirus Software - 77,403 views
- Hospital Hacker GhostExodus Owns Himself – Arrested - 47,512 views
- US considers banning DRM rootkits – Sony BMG - 44,947 views