Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

6/14/2012
02:31 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Google, Facebook, Twitter, AOL Fight Badware

Tech giants, Internet Advertising Bureau, and StopBadware form the Ads Integrity Alliance to battle malicious advertising.

Google and Facebook may be cutthroat competitors but they share a common enemy: bad advertising. That's "bad" in the sense of harmful rather than ineffective or cringe-inducing. If enough Internet users start seeing online ads as a source of malware or as untrustworthy, they could take steps to block ads. That would be ruinous for revenue.

So it is that Google and Facebook, along with AOL, Twitter, and the Internet Advertising Bureau (IAB) on Thursday joined with StopBadware to announce the formation of the Ads Integrity Alliance, an industry partnership to fight bad advertising.

Bad advertising includes malvertising--malware delivered via ads--and ads that deceive or violate policies.

The Ads Integrity Alliance aims to serve three primary functions: developing and sharing industry best practices; coordinating information sharing about those attempting to abuse online ad systems; and sharing trend data with regulators and law enforcement agencies.

[ ICANN's plan to approve new domain names spurs competition for desirable suffixes. Read New Domain Names Tempt Amazon, Google, Microsoft. ]

If you listen, you may be able to hear echoes of past industry ad security initiatives. Google was among the Internet companies that backed the formation of StopBadware in 2006, along with Sun Microsystems and Lenovo. Back then, there was more concern about adware: downloadable applications--the term had not yet been shorted to "app"--that presented unwanted ads and sometimes stole information.

The group was also concerned about spyware, software that collects personal information without the user's consent. That was before companies figured out that they could collect personal information with user consent by burying information collection practices in lengthy "privacy policies" and making acceptance of those policies a requirement for service usage.

In 2009, Google launched a website called Anti-Malvertising.com, a custom search engine and website to help its ad network partners identify potential providers of malicious advertisements. It also maintains a Google Groups mailing list called the DoubleClick Anti-Malvertising Group that posts alerts about websites hosting malware and ad networks distributing malicious ads.

In 2008, Google security engineer Niels Provos said in a blog post that about 2% of malicious websites were distributing malware through advertising, based on an analysis of about 2,000 known advertising networks. The company declined to update that particular metric but did post vaguely related figures last month.

Google says it disabled over 134 million ads and the accounts of over 824,000 advertisers for policy violations in 2011--so only a small subset of these ads carried malware. This is up sharply from 2010, when Google disabled 54.7 million ads and 248,000 advertiser accounts.

Nonetheless, Google insists its efforts are working. David W. Baker, director of engineering for Google's advertising group, said in a blog post last month that Google reduced the percentage of bad ads shown in 2011 to half what it was in 2010.

StopBadware did not provide specific figures about the prevalence of bad ads, but a spokesperson for the group said, "We speak daily to owners and administrators of compromised websites, and in our experience bad ads are almost exclusively the cause of site compromise on well-regarded, high-traffic websites."

The Enterprise 2.0 Conference brings together industry thought leaders to explore the latest innovations in enterprise social software, analytics, and big data tools and technologies. Learn how your business can harness these tools to improve internal business processes and create operational efficiencies. It happens in Boston, June 18-21. Register today!

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Bprince
50%
50%
Bprince,
User Rank: Ninja
6/16/2012 | 1:55:06 PM
re: Google, Facebook, Twitter, AOL Fight Badware
Twitter just bought Dasient I believe in January along the same lines. @ readers - Have malicious advertisements changed your surfing habits on the Web in any way?
Brian Prince, InformationWeek/Dark Reading Comment Moderator
GitHub Named in Capital One Breach Lawsuit
Dark Reading Staff 8/14/2019
The Mainframe Is Seeing a Resurgence. Is Security Keeping Pace?
Ray Overby, Co-Founder & President at Key Resources, Inc.,  8/15/2019
The Flaw in Vulnerability Management: It's Time to Get Real
Jim Souders, Chief Executive Officer at Adaptiva,  8/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-8103
PUBLISHED: 2019-08-20
Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation ...
CVE-2019-8104
PUBLISHED: 2019-08-20
Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation ...
CVE-2019-8105
PUBLISHED: 2019-08-20
Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation ...
CVE-2019-8106
PUBLISHED: 2019-08-20
Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an out-of-bounds read vulnerability. Successful exploitation ...
CVE-2019-8058
PUBLISHED: 2019-08-20
Adobe Acrobat and Reader versions, 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2017.011.30142 and earlier, 2015.006.30497 and earlier, and 2015.006.30498 and earlier have an use after free vulnerability. Successful exploitation coul...