Drive-by download attack on Facebook used malicious ads

This 'malvertisement' scam does not require any user action, making it much more dangerous

Antivirus vendor Trend Micro has recently detected a drive-by download attack on Facebook that used malicious advertisements to infect users with malware.

"We encountered an infection chain, wherein the user is led from a page within Facebook to a couple of ad sites, and then finally to a page that hosts exploits," the company's security researchers warned Tuesday. "When we traced the connection between the ad sites and Facebook, we found that the ad providers were affiliated with a certain Facebook application. We checked on the said app, and found that it is indeed, ad-supported."

"Malvertising" attacks are usually the result of lax background screening practices on behalf of advertising networks or ad sale teams. Attackers usually impersonate legitimate advertisers in order to get their ads approved and later swap them with malicious code.

A lot of popular websites and big ad networks have fallen victim to such attacks over the years. Facebook also dealt with this form of abuse in the past, but in those cases the ads were used to display fake security alerts that led to scareware.

However, malvertisements that bundle drive-by download exploits for vulnerabilities in popular browser plug-ins, or even the browser itself, are much more dangerous since they don't require any user interaction.

In this case, users were directed to a page that loaded Java and ActiveX exploits, but while the attacked ActiveX vulnerability was patched in 2006, the Java ones were more recent, dating from 2010.

Facebook is usually plagued by other types of attacks. Trend Micro's research identified the three most common threats on Facebook: "likejacking," where users are tricked into posting a status update for a page they didn't actually intend to give a "like" to, rogue applications, and spam campaigns.

Unfortunately, the design of Facebook's platform, where thousands of third-party app developers can work with whichever advertisers they wish, favors malvertising. There's not much Facebook can do about it, so the task of fending off such attacks ultimately falls with the users.

Statistics collected this year by security companies from live drive-by download toolkit installations show that Java exploits have the highest success rate, exceeding those of PDF or Flash exploits.

This is mainly because users do a poor job of updating the software, a lot of them not even knowing what Java is or that it's installed on their systems. In fact, since there's little Java content on the Web anymore, some security experts recommend that users should disable the plug-in from their browser if they don't remember ever using it.

Keeping all software programs up to date, especially those that are accessible from the Web, is critically important for staying secure on the Internet. So is using an antivirus program capable of scanning Web traffic and detecting exploits.

Power users can resort to more advanced methods of protection such as the NoScript Firefox extension, which thanks to its opt-in approach to third-party scripts, blocks the majority of drive-by downloads, including those executed through malvertising.

Join the CSO newsletter!

Error: Please check your email address.

Tags advertisingInternet-based applications and servicestrend microsecuritysocial networkingExploits / vulnerabilitiesinternetFacebook

More about FacebookTrend Micro Australia

Show Comments

Featured Whitepapers

Editor's Recommendations

Solution Centres

Stories by Lucian Constantin

Latest Videos

  • 150x50

    CSO Webinar: The Human Factor - Your people are your biggest security weakness

    ​Speakers: David Lacey, Researcher and former CISO Royal Mail David Turner - Global Risk Management Expert Mark Guntrip - Group Manager, Email Protection, Proofpoint

    Play Video

  • 150x50

    CSO Webinar: Current ransomware defences are failing – but machine learning can drive a more proactive solution

    Speakers • Ty Miller, Director, Threat Intelligence • Mark Gregory, Leader, Network Engineering Research Group, RMIT • Jeff Lanza, Retired FBI Agent (USA) • Andy Solterbeck, VP Asia Pacific, Cylance • David Braue, CSO MC/Moderator What to expect: ​Hear from industry experts on the local and global ransomware threat landscape. Explore a new approach to dealing with ransomware using machine-learning techniques and by thinking about the problem in a fundamentally different way. Apply techniques for gathering insight into ransomware behaviour and find out what elements must go into a truly effective ransomware defence. Get a first-hand look at how ransomware actually works in practice, and how machine-learning techniques can pick up on its activities long before your employees do.

    Play Video

  • 150x50

    CSO Webinar: Get real about metadata to avoid a false sense of security

    Speakers: • Anthony Caruana – CSO MC and moderator • Ian Farquhar, Worldwide Virtual Security Team Lead, Gigamon • John Lindsay, Former CTO, iiNet • Skeeve Stevens, Futurist, Future Sumo • David Vaile - Vice chair of APF, Co-Convenor of the Cyberspace Law And Policy Community, UNSW Law Faculty This webinar covers: - A 101 on metadata - what it is and how to use it - Insight into a typical attack, what happens and what we would find when looking into the metadata - How to collect metadata, use this to detect attacks and get greater insight into how you can use this to protect your organisation - Learn how much raw data and metadata to retain and how long for - Get a reality check on how you're using your metadata and if this is enough to secure your organisation

    Play Video

  • 150x50

    CSO Webinar: How banking trojans work and how you can stop them

    CSO Webinar: How banking trojans work and how you can stop them Featuring: • John Baird, Director of Global Technology Production, Deutsche Bank • Samantha Macleod, GM Cyber Security, ME Bank • Sherrod DeGrippo, Director of Emerging Threats, Proofpoint (USA)

    Play Video

  • 150x50

    IDG Live Webinar:The right collaboration strategy will help your business take flight

    Speakers - Mike Harris, Engineering Services Manager, Jetstar - Christopher Johnson, IT Director APAC, 20th Century Fox - Brent Maxwell, Director of Information Systems, THE ICONIC - IDG MC/Moderator Anthony Caruana

    Play Video

More videos

Blog Posts