Millions of people visiting drudgereport.com, wunderground.com, and other popular websites were exposed to attacks that can surreptitiously hijack their computers, thanks to maliciously manipulated ads that exploit vulnerabilities in Adobe Flash and other browsing software, researchers said.
The malvertising campaign worked by inserting malicious code into ads distributed by AdSpirit.de, a network that delivers ads to Drudge, Wunderground, and other third-party websites, according to a post published Thursday by researchers from security firm Malwarebytes. The ads, in turn, exploited security vulnerabilities in widely used browsers and browser plugins that install malware on end-user computers. The criminals behind the campaign previously carried out a similar attack on Yahoo's ad network, exposing millions more people to the same drive-by attacks.
Malvertising is a particularly pernicious form of attack because it can infect people who do nothing more than browse to a mainstream site. Depending on the exploit, it can silently hijack computers even when visitors don't click on links. Some browser makers have responded by implementing so-called click-to-play mechanisms that don't render Flash or Java content unless the end user actively permits the plugin to run on a particular site. Some users have resorted to ad blockers, which have the unfortunate side effect of depriving publishers of much-needed advertising revenue.
Disconnect, the not-for-profit company behind the eponymous online privacy tool and “malvertising” blocking service, released a new version of its virtual private networking and privacy protection service for iOS, Android, Windows, and Mac OS X this morning. Disconnect has offered versions of its service on these platforms in the past, but the latest edition is the first to bring an enhanced version of what the company first introduced on the privacy-oriented Blackphone to these other operating systems.
The service is available through Apple’s App Store and the company’s website (not the Google Play or Windows stores), and it adds filtering of cell provider “supercookies” and other common tracking data captured by websites and mobile applications. Disconnect has also inked a deal with Deutsche Telekom to offer its software and services as a promotional bundle to DT customers.
The new Disconnect app and service comes in free and premium versions. The free application simply provides the user with a visualized record of tracking performed by websites and mobile applications, showing what tracking cookies are used and whose cookies they are. It also shows any unsecured connections within sites using otherwise secure HTTPS connections.