Revive ad servers being hacked to distribute malicious ads

mood · Apr 22, 2020

Revive ad servers being hacked to distribute malicious ads
April 22, 2020
https://www.bleepingcomputer.com/ne...ers-being-hacked-to-distribute-malicious-ads/

The Tag Barnakle malvertising group is hacking into Revive ad servers to inject and deliver malicious advertisements on unwary visitors.

One open-source self-hosted platform that has been around for the past ten years is called the Revive ad server.
Just like any application, Revive has had its share of vulnerabilities that can be used to inject malicious advertisements into web sites that utilize the ad server.

In a new report by advertising security firm Confiant, we can see how one malvertiser known as Tag Barnakle is mass-compromising Revive ad servers to inject their own code into a publisher's existing advertising campaigns.

"In recent months, we have seen a wave of malvertisements that are attached to Revive creatives spanning dozens of instances of ad servers, including those owned and operated by publishers and ad networks," Confiant security researcher Eliya Stein explained in a report.
Click to expand...

Stein told BleepingComputer that these fake Adobe Flash player updates install the Shalyer Trojan or other botnet bundlers onto macOS systems.

For Windows users, the sample shared with BleepingComputer installs an adware bundle such as InstallCore that is known to infect victims with ransomware, information-stealing Trojans, unwanted browser extensions, and other malware.
Compromised ad servers have a long reach
In one compromised RTB ad provider, Confiant saw up to 1.25MM malicious ad impressions being pushed out in a single day.

"If we take a look at the volumes behind just one of the compromised RTB ad servers — we see spikes of up to 1.25MM affected ad impressions in a single day. For context, Tag Barnakle has compromised ~60 ad servers in total," Confiant stated in their report.
Click to expand...

Confiant: Tag Barnakle: The Malvertiser That Hacks Revive Ad Servers, Redirects Victims To Malware

Minimalist · Apr 19, 2021

Millions of web surfers are being targeted by a single malvertising group

Hackers have compromised more than 120 ad servers over the past year in an ongoing campaign that displays malicious advertisements on tens of millions, if not hundreds of millions, of devices as they visit sites that, by all outward appearances, are benign.
Click to expand...

https://arstechnica.com/information...ad-servers-to-target-millions-of-web-surfers/

Rasheed187 · Apr 20, 2021

Minimalist said: ↑

Millions of web surfers are being targeted by a single malvertising group

https://arstechnica.com/information...ad-servers-to-target-millions-of-web-surfers/
Click to expand...

So ad-blocking stays important. Also, especially on adult sites I sometimes notice aggresive techniques, like for example scripts that open multiple tabs. uBlock could not block this.

Log in or Sign up

Revive ad servers being hacked to distribute malicious ads

mood Updates Team

Minimalist Registered Member

Rasheed187 Registered Member