Weeding out malvertising

It’s difficult to spot, is often found lurking on even the most popular websites and is able to expose your personal information to criminals.

Malvertising, which is the term for when malware is slipped into online advertisements, is displayed on web pages across the world, is on the rise and affecting more people than ever.

According to technology company Cyphort, there has been a 325 per cent increase in malvertising in 2014 alone. The proliferation of digital advertising and the increasing complexity of ad formats has proven to be the perfect cover for criminal activity.

Malvertising is particularly threatening because it does not require the user to click or even interact with the advertisement to be exposed. Simply reading a page that contains a malvertisement programmed to download upon reading is enough to expose a computer and, by extension, a user’s personal details, to cyber criminals.

Worst of all, malvertising is finding its way, however briefly, onto some of the biggest, most trustworthy sites on the web. In October 2015, British news site Daily Mail , which sees millions of visitors daily, fell foul to a malvertising attack that exploited vulnerabilities in Internet Explorer, making users vulnerable to ransomware that took control of user’s computers and forced them to pay to get access to their device again.

Advertisers beware! This phenomenon, therefore, presents a serious problem to advertisers and a threat to their revenues for a number of reasons. First, every malvertisement that is paid for and displayed on a network puts the advertising company at risk of repercussions. Technology site The Register estimated that a $12,000 outlay for malvertising by cyber criminals in the past year has returned over a billion dollars, making advertisers unwitting assistants to cyber crime.

Second, malvertisements damage the already fragile trust in digital advertising. By exposing users to potential security breaches, advertising networks and sites that fail to clamp down on malvertisers will contribute further to a decreasing faith in digital advertising.

And with advertising blockers that automatically prevent advertisements from loading — proving one of the best ways to avoid malvertisements — the loss of trust could translate into serious damage to revenues. With companies such as PageFair reporting that advertising blockers could cost publishers $22 billion in revenues in 2015, malvertisements could drive that number even higher by giving users legitimate reasons to put their guard up.

So, what can advertisers do to stop malvertising in its tracks? The answer isn’t simple. Though advertisers want to stop malicious adverts slipping into their networks, the rise of programmatic self-service advertising options and the sheer volume of global advertising traffic means it is difficult to eradicate.

The counterattack There are some ways that advertisers can help to fight back against this digital crime wave, though. The first is to educate users about the risks from criminal advertisement. By helping them to understand what malverts are, and explaining that they exploit vulnerabilities in older versions of browsers and plug-ins, in particular, advertisers can help users to become the first line of defence against malvertising.

Second, advertisers need to work with publishers to filter and report malvertising as quickly as possible. Allowing sites to opt out of featuring ads from untrusted sources will help publishers to filter shiftier providers, while creating rapid feedback systems between advertiser and publisher to alert companies faster to malvertising is crucial.

Finally, advertising networks and advertisers need to do as much as they can from their end to examine and identify malverts before they are ever distributed on the web. Offering self-service advertisers as few opportunities as possible to insert their own code into a campaign, or switch previously approved copy for something unapproved, is one way to limit troublesome malvertisements. And actively discovering, identifying and banning malvertisers should be seen as a key objective across the industry.

The scourge of malvertising is something that has only recently been noticed and will take time to rectify. But if advertisers recognise that the problem exists, work with publishers to solve the problem and educate consumers about how to avoid it, big strides could be made to protect both people and advertising revenues from this insidious criminal activity.

Rohan Patil is Managing Director, AppLift India

COMMENT NOW