Doubleclick Involved in Malware Distribution

Use Netsparker


We recently reported on thousands of people being hooked by big sites distributing malware, it now seems Doubleclick was the one at fault.

It’s a pretty neat trick and a good spin on Social Engineering leveraging on the trustworthy nature of the sites.

CNN even?

Rogue anti-spyware software that pushes fraudulent PC scans has found its way onto DoubleClick and legitimate sites, including CNN, The Economist, The Huffington Post and the official site of the Philadelphia Phillies.

DoubleClick officials told eWEEK that they have recently implemented a security monitoring system to catch and disable a new strain of malware that has spread over the past several months. This system has already captured and disabled about 100 ads, the company said in a statement, although it didn’t mention this episode in particular.

The bogus anti-spyware onslaught is only part of a bigger wave that’s also included porno ads being swapped for normal ads on sites such as The Wall Street Journal. It’s not yet clear whether the same fraudsters are behind both the porn and the fraudulent anti-spyware ads.

I really hope they do put some serious measure in place that don’t just use a signature for this particular case…something a little more intelligent I hope.

Sunbelt Software has confirmed that Trojans were being downloaded from ads served by DoubleClick as recently as Nov. 11. This malware is the kind that repeatedly pops bogus warning messages about computer infections in users’ faces until they give up in despair and pay $30 to $40 for a junk “security” program.

“The stuff that’s installed is this rogue anti-spyware software that … gives you fake alerts, [such as] ‘Your computer is infected, you must run this.’ Basically it’s extortion. … They try to push you to buy their software,” Sunbelt President Alex Eckelberry told eWEEK.

The malware application is a variant on WinFixer, a piece of malware that pretends to be a diagnostic tool.

I hope we can educate people about these kind of things, sad to say as some of the comments mentioned in the previous post…a lot of people will fall for this – why? Simply because they don’t know any better.

Source: eWeek

Posted in: Malware, Social Engineering


Latest Posts:


StaCoAn - Mobile App Static Analysis Tool StaCoAn – Mobile App Static Analysis Tool
StaCoAn is a cross-platform tool which aids developers, bug bounty hunters and ethical hackers performing mobile app static analysis on the code of the application for both native Android and iOS applications.
snallygaster - Scan For Secret Files On HTTP Servers snallygaster – Scan For Secret Files On HTTP Servers
snallygaster is a Python-based tool that can help you to scan for secret files on HTTP servers, files that are accessible that shouldn't be public and can pose a s
Portspoof - Spoof All Ports Open & Emulate Valid Services Portspoof – Spoof All Ports Open & Emulate Valid Services
The primary goal of the Portspoof program is to enhance your system security through a set of new camouflage techniques which spoof all ports open and also emulate valid services on every port.
Cambridge Analytica Facebook Data Scandal Cambridge Analytica Facebook Data Scandal
One of the biggest stories of the year so far has been the scandal surrounding Cambridge Analytica that came out after a Channel 4 expose that demonstrated the depths they are willing to go to profile voters, manipulate elections and much more.
GetAltName - Discover Sub-Domains From SSL Certificates GetAltName – Discover Sub-Domains From SSL Certificates
GetAltName it's a little script to discover sub-domains that can extract Subject Alt Names for SSL Certificates directly from HTTPS websites which can provide you with DNS names or virtual servers.
Memcrashed - Memcached DDoS Exploit Tool Memcrashed – Memcached DDoS Exploit Tool
Memcrashed is a Memcached DDoS exploit tool written in Python that allows you to send forged UDP packets to a list of Memcached servers obtained from Shodan.


6 Responses to Doubleclick Involved in Malware Distribution

  1. normalsecrecy November 15, 2007 at 8:16 pm #

    i wonder if it would be too much trouble for some of the consumer grade security software providers (mcafee, symantec) to enhance their products to block adservers like doubleclick from displaying content while browsing. i’m talking about modifying the hosts file to deny such servers or something like that…

  2. Pantagruel November 16, 2007 at 12:43 am #

    Seems like they are getting more aggressive at pushing there rubbish down viewers throats.
    Like -normalsecrecy- mentions, this might be good market potential for the likes of MacAfee, Symantec and others. Furthermore any plugin or add-on for IE of FireFox blocking such crap would be welcome to the everage Jane and Joe. On the high end you could consider filtering content to root out these pop-ups and potential mallware getting through.

  3. Goodpeople November 16, 2007 at 11:51 am #

    One would expect that a reputable company like Doubleclick has a mechanism in place to prevent this sort of thing from happening. Quite frankly, I’m shocked.

    This goes much further than educating endusers alone. Every company that makes money on the net should be primarily focussed on the security aspect of their business.

    Of course Doubleclick never intended anything like this ever to happen. But it did, and aside from taking steps to prevent this from ever happening again (which I’m sure they’re working on as we speak), I think they should be held accountable. After all, they are the facilitating party.

    I guess the guys at Google might want to reconsider..

  4. Nobody_Holme November 16, 2007 at 5:58 pm #

    And this is why my adblock is set to ban doubleclick content, google ads, and anything like that i see. Basically if I see an ad, the soure URL is added to my banlist. I think that file is up to 2mb of plaintext now…

    And as much as i hate to defend ad companies, I dont think this is doubleclick’s fault… And they did stop it. Meh.

  5. Goodpeople November 18, 2007 at 8:44 pm #

    I’m not saying that Doubleclick are the bad guys, but apparently this has been going on for some time.

    I expect Doubleclick and other adspace resellers to _at_least_ check every sold banner on a daily basis. That would prevent the bad guys from buying bannerviews with a totally innocent banner and later replacing the banner with a malicious one.

    It seems that they have a system in place now. But that doesn’t clear them of the responsibility. They could have foreseen.. etc.

  6. Nobody_Holme November 19, 2007 at 7:50 pm #

    NONE of them seem to check on a daily basis… And the “report bad ad” links some sites use are always long-winded and annoying, so nobody uses them… Thing is, i’ve been seeing malicious ads on a daily basis for so many years (high-speed flashing likely to cause epileptic fits, and downloading trojians/spyware sounds like malicious) from both doubleclick and google ads at least that I just gloss over them. Admitedly, I do spend a bit much time on sections of the web you have to be PC literate to know about, so they cant catch many people, BUT, they’ve been there for years, so its kind of like overdraft charges, or other long-running problems that need a high-profile action to bring to make them bother.