Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

6/14/2012
02:31 PM
Connect Directly
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Google, Facebook, Twitter, AOL Fight Badware

Tech giants, Internet Advertising Bureau, and StopBadware form the Ads Integrity Alliance to battle malicious advertising.

Google and Facebook may be cutthroat competitors but they share a common enemy: bad advertising. That's "bad" in the sense of harmful rather than ineffective or cringe-inducing. If enough Internet users start seeing online ads as a source of malware or as untrustworthy, they could take steps to block ads. That would be ruinous for revenue.

So it is that Google and Facebook, along with AOL, Twitter, and the Internet Advertising Bureau (IAB) on Thursday joined with StopBadware to announce the formation of the Ads Integrity Alliance, an industry partnership to fight bad advertising.

Bad advertising includes malvertising--malware delivered via ads--and ads that deceive or violate policies.

The Ads Integrity Alliance aims to serve three primary functions: developing and sharing industry best practices; coordinating information sharing about those attempting to abuse online ad systems; and sharing trend data with regulators and law enforcement agencies.

[ ICANN's plan to approve new domain names spurs competition for desirable suffixes. Read New Domain Names Tempt Amazon, Google, Microsoft. ]

If you listen, you may be able to hear echoes of past industry ad security initiatives. Google was among the Internet companies that backed the formation of StopBadware in 2006, along with Sun Microsystems and Lenovo. Back then, there was more concern about adware: downloadable applications--the term had not yet been shorted to "app"--that presented unwanted ads and sometimes stole information.

The group was also concerned about spyware, software that collects personal information without the user's consent. That was before companies figured out that they could collect personal information with user consent by burying information collection practices in lengthy "privacy policies" and making acceptance of those policies a requirement for service usage.

In 2009, Google launched a website called Anti-Malvertising.com, a custom search engine and website to help its ad network partners identify potential providers of malicious advertisements. It also maintains a Google Groups mailing list called the DoubleClick Anti-Malvertising Group that posts alerts about websites hosting malware and ad networks distributing malicious ads.

In 2008, Google security engineer Niels Provos said in a blog post that about 2% of malicious websites were distributing malware through advertising, based on an analysis of about 2,000 known advertising networks. The company declined to update that particular metric but did post vaguely related figures last month.

Google says it disabled over 134 million ads and the accounts of over 824,000 advertisers for policy violations in 2011--so only a small subset of these ads carried malware. This is up sharply from 2010, when Google disabled 54.7 million ads and 248,000 advertiser accounts.

Nonetheless, Google insists its efforts are working. David W. Baker, director of engineering for Google's advertising group, said in a blog post last month that Google reduced the percentage of bad ads shown in 2011 to half what it was in 2010.

StopBadware did not provide specific figures about the prevalence of bad ads, but a spokesperson for the group said, "We speak daily to owners and administrators of compromised websites, and in our experience bad ads are almost exclusively the cause of site compromise on well-regarded, high-traffic websites."

The Enterprise 2.0 Conference brings together industry thought leaders to explore the latest innovations in enterprise social software, analytics, and big data tools and technologies. Learn how your business can harness these tools to improve internal business processes and create operational efficiencies. It happens in Boston, June 18-21. Register today!

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Bprince
50%
50%
Bprince,
User Rank: Ninja
6/16/2012 | 1:55:06 PM
re: Google, Facebook, Twitter, AOL Fight Badware
Twitter just bought Dasient I believe in January along the same lines. @ readers - Have malicious advertisements changed your surfing habits on the Web in any way?
Brian Prince, InformationWeek/Dark Reading Comment Moderator
Commentary
How SolarWinds Busted Up Our Assumptions About Code Signing
Dr. Jethro Beekman, Technical Director,  3/3/2021
News
'ObliqueRAT' Now Hides Behind Images on Compromised Websites
Jai Vijayan, Contributing Writer,  3/2/2021
News
Attackers Turn Struggling Software Projects Into Trojan Horses
Robert Lemos, Contributing Writer,  2/26/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Sure you have fire, but he has an i7!
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-27314
PUBLISHED: 2021-03-05
SQL injection in admin.php in doctor appointment system 1.0 allows an unauthenticated attacker to insert malicious SQL queries via username parameter at login page.
CVE-2019-18630
PUBLISHED: 2021-03-04
On Xerox AltaLink B8045/B8055/B8065/B8075/B8090 and C8030/C8035/C8045/C8055/C8070 multifunction printers with software releases before 101.00x.099.28200, portions of the drive containing executable code were not encrypted thus leaving it open to potential cryptographic information disclosure.
CVE-2021-25344
PUBLISHED: 2021-03-04
Missing permission check in knox_custom service prior to SMR Mar-2021 Release 1 allows attackers to gain access to device's serial number without permission.
CVE-2021-25345
PUBLISHED: 2021-03-04
Graphic format mismatch while converting video format in hwcomposer prior to SMR Mar-2021 Release 1 results in kernel panic due to unsupported format.
CVE-2021-25346
PUBLISHED: 2021-03-04
A possible arbitrary memory overwrite vulnerabilities in quram library version prior to SMR Jan-2021 Release 1 allow arbitrary code execution.