Malicious Ads on Legitimate Websites

Trouble from a site you trust

Someone in the office reads the news over lunch on a well-known website. A page loads, nothing seems to happen, and by mid-afternoon the shared folder is full of files nobody can open.

The news site was not hacked. The harmful code arrived inside an advertisement, bought like any other.

This is called malvertising. Earlier this year, ads on some of the best-known news and entertainment websites were found carrying code that tried to install ransomware on visitors' computers.

How a bad ad gets onto a good site

Most websites that carry ads do not choose them one by one. They give space to an ad network, which fills it, often through an auction run in a fraction of a second while the page loads.

Criminals take part as advertisers. A common trick is to run a harmless ad until it is approved, then swap in harmful code, or show it only to some visitors at some hours.

The site owner never sees it, and the network's checks often miss it.

What a malicious ad tries to do

• Probe the browser for an outdated plugin, then install malware without a click.
• Show a fake warning that the computer is infected, with a number to call.
• Offer a fake update for Flash or the browser.
• Redirect phones to a fake prize or virus page.

The first is the one updates prevent. It relies on a known flaw in an old browser or plugin, and a fully updated computer gives it very little to work with.

The others rely on people rather than flaws, which is why staff need to recognise them.

Why updates matter most

An infection that needs no click works by exploiting a flaw the software maker has usually fixed already. It succeeds on the computers that never installed the fix.

Chrome and Firefox update themselves but finish only on a restart, and some office computers keep the browser open for weeks.

Internet Explorer gets its fixes through Windows Update, and on Windows 7 and later only version 11 still receives them.

Plugins are the weak point. Flash, Java and Silverlight have been favourite targets for years, and on many computers they update separately from the browser, or not at all.

Plugins nobody uses

Many office computers carry plugins installed years ago for a single website: Java for an old supplier portal, Silverlight for a video service.

Open the browser's list of plugins or add-ons and remove whatever nobody needs. If one portal still requires Java, keep it in one browser used only for that portal.

Most browsers can be set to ask before running Flash, so it plays only when someone chooses. The rare page that needs it gets a click, and a malicious ad gets nothing.

Working day to day on a standard Windows account, not an administrator one, also stops much malware from installing itself.

A worked example

A wild bird store in a suburban strip mall sells seed, feeders and nest boxes, and keeps its supplier orders, price lists and newsletter list in a shared folder on the back-office computer.

Each morning before opening, the owner checked the weather and a regional birding forum on that computer. It ran Windows 7, a browser nobody had restarted in a month, and a Flash plugin two years out of date.

One morning an ad on the weather site used the old plugin to install ransomware. There was no click and no warning. By noon the shared folder was encrypted.

The store restored its files from a backup drive the owner took home every Friday, and rebuilt the week's orders from emails.

The computer was wiped and reinstalled. Java, which nothing used, was removed; Flash was set to ask first; Windows Update was set to install automatically; and the owner now browses from a standard account.

Fake warnings and the phone call

Many malicious ads infect nothing. They fill the screen with a message that the computer is infected, sometimes with a recorded voice, and a phone number for help.

Whoever answers asks for remote access to the computer, then for payment to fix problems that never existed. Some leave real malware behind.

Give everyone who uses a work computer one plain rule: a warning inside a web page is an advertisement, not a message from Windows. Close the browser, using Task Manager if it refuses, and never call the number.

If someone has already called and allowed access, disconnect the computer, change the passwords used on it, and have it checked before it goes back into use.

If your own site shows ads

Some businesses run ads on their own pages: a community events site, a recipe blog, a local guide. That makes them publishers, and their visitors can be hit the same way.

Use established ad networks that let you block categories and report a bad ad. When a visitor reports a pop-up or redirect, send the page, the time, the device and a screenshot to the network the same day.

And ask whether a business site needs third-party ads at all. On a page meant to win customers, every ad is someone else's code running in front of your own call to action.

Pop-ups on a site with no ads

If customers report pop-ups or redirects on your website and you run no ads, the cause is more urgent: the site itself may be hacked.

Hacked sites often inject their own ads or redirects, sometimes only for visitors on phones, so the owner sees nothing wrong from the office.

Have the site checked from a phone on mobile data, and scanned by whoever maintains it. The Security Issues report in Search Console is worth a look too.

The counter-case

Malicious ads are rare compared with ordinary ones, and an up-to-date computer used carefully is unlikely ever to be infected by one.

None of this is a reason to distrust every website. The danger lies in old software and in believing pop-ups, not in reading the news.

Updates, unused plugins removed, and staff who know a fake warning when they see one cover most of the risk.

On every office computer

1. Restart every browser so updates install.
2. Check Windows Update on each computer.
3. Remove Java and Silverlight where nobody needs them.
4. Set Flash to ask before it runs.
5. Use standard accounts for daily work.
6. Tell staff never to call a number from a pop-up.
7. Check a backup that is kept disconnected.

Step one is the simplest and the most often missed. A browser that has downloaded a fix but not been restarted is still running the old, vulnerable version.

The same kind of attack arriving by email is covered in ransomware disguised as an invoice.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.