Have You Heard of “Malvertising”?

You know you need to protect your personal information while online. You're careful with your social security number, your phone number and address, and your other personal information. But, the world of malicious online attacks and theft has gotten much deeper and now includes those sites and advertisements that look completely legitimate. This is known as "malvertising." Malvertising is referred to as malicious advertising and involves threat actors injecting malicious code into digital advertisements that may infect computers and mobile devices of unsuspecting victims visiting legitimate, reputable websites.

What is Malvertising?

Let me break it down for you. Malicious Advertising. Yes that’s right, criminals controlling advertisements on the internet.  Usually through our browsers.  So what may look like legitimate online advertising is used to distribute malware and other threats to your computer with little to no interaction. 

Systems can become infected pre-click and post-click. A common misconception is that infections happen only when a user clicks on a malvertisement; however, scripts that auto execute and download malware may be embedded in the web page.  These scripts can also auto-redirect users to malicious websites.

navitend recommends that users maintain their browser, browser plug-ins, operating system, and anti-malware software at vendor-supported versions with all available security updates installed.  Users should review their browser extensions and plug-ins, and consider configuring the settings for those you wish to keep to “click-to-play” in order to avoid them from auto-executing.  Users should also consider using script management add-ons. As most ads and scripts are automatically implemented, you can use a script blocking browser extension to control your web content. 

How do you protect against malvertising?

• First, tighten up vulnerabilities on your computer and mobile device. Keep your operating system, your applications, and web browsers (plug-ins included) up to date with the latest security patches. Remove any software (especially Flash or Java) that you don’t use or need, because malvertising searches for ways to exploit weaknesses in these types of software.

• Always think before you click on anything. Be skeptical about any suspiciously alarming notices and watch out for the “too-good-to-be-true” pop-up offers you receive. Never clicking on suspect ads still won’t protect you against any malvertising living on reputable sites, but it will decrease your odds of getting hit by much of what the criminals send to you because malvertising relies on your click to deliver its malware payload.

• Enable click-to-play plugins on your web browser because click-to-play plugins keep Flash or Java from running unless you specifically tell them to (by clicking on the ad). A large percentage of malvertising relies on exploiting these plugins, so enabling this feature in your browser settings will offer excellent protection.

• You should seriously consider using ad blockers, which can filter out a lot of the malvertising noise, thereby stopping dynamic scripts from loading dangerous content. By blocking all advertisements from displaying on websites, you remove any chance of viewing and clicking on an ad that is potentially harmful. Ad blocking also results in additional benefits, from reducing the number of cookies loaded on your machine, to protecting your privacy by preventing tracking, saving bandwidth, loading pages faster, and prolonging battery life on mobile devices.

• The best way to protect yourself and your equipment from falling victim to malvertising (and any malware, for that matter) is to scan your system regularly with a professional quality cybersecurity program.

Wow, that’s a lot to take in.  Does this sound confusing to you?  Using a Managed Services Provider such as navitend can help solve these and other issues before they become bigger problems.