Security

CryptoWall! crooks! 'turn! to! Yahoo! ads! to! spread! ransomware!'

Purple Palace not directly involved but maybe it should chat to these infosec bods

John Leyden
Published

Crooks are using Yahoo!'s advertising network to infect PCs with the CryptoWall ransomware, it's claimed.

Windows software nasty CryptoWall encrypts a victim's files using an OpenSSL-generated key pair before demanding a ransom to decrypt the data. It communicates with its masters using RC4-encrypted messages to command servers hidden in the Tor network, we're told.

It was initially spread by spamming email inboxes with "incoming fax" scans or links to files held in cloud storage that were booby-trapped with malicious code.

The malware then evolved to use poisoned web advertisements – or malvertising – to spread across the internet.

Typically, when someone clicks on an ad, the site displaying the advert, and the advertising network serving it, take a small fee for referring the visitor to the advertiser's website. It appears CryptoWall victims are lured into clicking on adverts, which refer the browser along a chain of websites until it reaches a server that exploits a vulnerability to infect the computer.

Since the end of July, researchers at security defence biz Blue Coat have been tracking the spread of CryptoWall through online advertising networks; websites referring on visitors have been set up in India, Myanmar, Indonesia, France and other countries.

According to Blue Coat, Yahoo!'s ad network is favored by the crooks because it has a huge reach – its ads appear on a large number of sites – and can therefore funnel more victims towards the exploit sites than shady ad slingers, which are much smaller.

“What looked like a minor malvertising attack quickly became more significant as the cyber criminals were successfully able to gain the trust of the major ad networks like ads.yahoo.com,” Chris Larsen, a senior malware researcher at Blue Coat, explained in a statement.

“The interconnected nature of ad servers and the ease with which would-be-attackers can build trust to deliver malicious ads points to a broken security model that leaves users exposed to the types of ransomware and other malware that can steal personal, financial and credential information."

Larsen later told The Register on Friday that "ads.yahoo.com was not among the sites directly connected to the CryptoWall-infected sites. It was, however, among the referrers to one of the malvertising sites that was directly connected."

There is no suggestion of any wrongdoing by Yahoo!. The web giant had not responded to a request for comment at time of publication. ®

security yahoo cybercrime

AI

Infosec

FOSS