What you Need to Know about Ad Blocking and Malvertising

Online advertising is certainly divisive, often disruptive and sometimes malicious for people browsing the internet, but conversely it supports publishers and the free online content that we have come to rely on.  While everyone has an opinion about these often-annoying ads that follow us as we browse or pop up when we try to read an article online, not all ads are created equal. Some are even helpful when searching for items to purchase, later finding out they are on sale through targeted ads that remember us and our browsing history. However, many are badly designed, intrusive, and in some cases, harmful to users. Privacy issues aside, users should be aware of an even bigger issue – malvertising. Simply put, malvertising is the use of online advertising to spread malware to our devices.

In this blog we’ll discuss the most common questions that arise around the issue of ad blocking and malvertising and why simply blocking ads isn’t enough to protect your privacy and your personal data.

Ad blocking or ad filtering utilizes various technologies to block the delivery or exposure to advertising.

Online advertising exists in many forms, such as banners, pictures, pop-ups, animations and embedded audio and video. Ad blockers target and block these ads allowing users to browse the internet without interruption or distraction. All browsers offer ways to alter or remove ads, either by targeting technologies that are used to deliver them, URLs that are the source of the ad or by targeting behavioural characteristics.

Aside from being generally annoying and disruptive, online ads can be malicious. Many ads that appear on credible and popular websites today contain malvertising. Because these seemingly innocent ads are often delivered by credible publishers’ people often don’t hesitate to click on them, thus infecting their desktop or mobile device with malware. The primary publisher of a site often subscribes to ten or more ad delivery / profiling companies at any one time. Since they provide links to these third-party servers, they have no idea what is being delivered by these services. As a result, it is relatively easy for bad actors to insert seemingly innocent looking ads onto these sites which may hide more sinister behaviour. Often these third-party services also aggregate and share information with each other enabling them to build a detailed profile on each user accessing the site.

By blocking ads, you can help protect yourself from malware and data profiling activities.

Malvertising has been a popular technique with cybercriminals for over 10 years, with the first documented attack occurring back in 2007 when bad actors abused an Adobe Flash campaign targeting visitors on sites such as MySpace. Cybercriminals use a variety of approaches but malvertising continues to be a popular technique to prey upon unsuspecting users. These malicious ads look like any other ad and can be found on any website, in fact, larger and more popular websites are most often targeted due to the level of trust and exposure of the publication.

Publishers rely on third party vendors and software to schedule, track and display online ads to generate revenue. The advertising inventory is then sold to potential advertisers who then have then ability to upload their ads, because space is typically allocated by a bidding system, the cost for cybercriminals can be quite low. Publishers and third-party vendors are aware of the risks of malvertising and attempt to filter them out. Conversely, criminals are aware of the methods used to detect them and focus on creating ads that avoid detection. These ads typically focus on duping a user into clicking a link to trigger the download, or the attacker uses a drive-by download technique to expose the user to malicious content. The malicious code is then used to steal the user’s data or infect the device with ransomware or latent malware such as a RAT (Remote Access Trojan).

Cybercriminals are relentless in their pursuit of easy financial gain and malvertising is a tried and tested technique which allows them to access your personal and/or corporate data. Your data has value and a price and is often later sold to criminals on the Dark Web. In addition to stealing your personal information, cybercriminals can also infect your device with a virus, delete information, hijack your device, engage in crypto-jacking or even spy on you using the microphone and camera. We also can’t ignore the issue of ransomware, a form of malware that locks you out of your device and forces you to pay a ransom to regain control. Witness the devasting effects of such attacks in local governments that were forced to pay over US$500k to regain control of their systems.

Unfortunately, it is easy to accidently tap an ad on a smartphone. People often fall prey to malicious ads when playing a game on their mobile device, tapping a screen in the game and accidently tapping a strategically placed malicious ad. Malvertisements don’t differentiate between intentional and unintentional clicks, so once clicked the malware is being loaded. As more of us depend on our mobile device for everyday activities like shopping and online banking they are becoming a more attractive form factor for cybercriminals, especially as users typically have no protection installed to mitigate these risks.

There are many different free products available for download, AdBlock and AdBlockPlus are popular options.

There are many options available but AdBlock and AdBlock Plus are often referenced as the better solutions in the free category. However, like most things, you get what you pay for. You may need 4 or 5 browser plugins to protect you from the various types of network attacks. Even then, you will only have protection on your browser, not the rest of your device, allowing rogue applications and other system based malware to infect your device.

Commercial solutions, such as BlackFog Privacy, offer a broader array of protection, against not only malvertising, but privacy, crypto-jacking, profiling and the Dark Web to name a few. In addition, BlackFog will monitor the collection of data in real-time and stop the outbound flow of data to ensure that no unauthorized data ever leaves the device. You can download a free trial on blackfog.com for iOS, Android, Mac and Windows.

Yes, in most cases users will notice a change in their browser speed when using an ad blocker because they rely on the browsers built-in scripting technology. Other techniques, such as those employed by BlackFog, operate at a much lower level. BlackFog operates on the network layer of the operating system and therefore offers much greater performance and works across every application on your machine, not just a browser. As a result it is able to provide broader protection not just against ads, but 12 layers of defense against ransomware, spyware, phishing, unauthorized data collection and profiling. This will subsequently increase your browsing speed and page load times by more than 200%.

While Ad blocking itself is not illegal there is some debate around this issue and legalities may vary by country. In 2018 the company behind Adblock Plus won an important, highly publicized legal victory in Germany. The German supreme court ruled that AdBlock Plus is not breaking the competition law by charging publishers for inclusion on its whitelist. You can read more about the legalities of ad blocking in this article.

As with most applications you install for the first time you are likely to see a notification like this, “AdBlock can read, modify, and transmit content from all web pages. This could include sensitive information like passwords, phone numbers, and credit cards.” Whilst this is fairly standard it is recommended that users add an extra layer of security to their devices. A privacy solution that monitors the flow of outbound data from your device to prevent data profiling and unwanted data collection will ensure that your personal data is secure.

Yes this is a free product.

The short answer is, yes. For now. Technology is constantly changing, and it is a constant game of cat and mouse with ad vendors and ad blockers. Some products are less likely to be detected by virtue of the way they operate.

Ad Blockers can typically be detected by websites if desired. Since they operate at the browser level and use scripting to read a web page it is relatively easy to detect if a site has been modified by such a tool. New techniques are constantly being developed to work around the detection, but it is very difficult given the way they operate.

Software such as BlackFog Privacy, uses a different technique. Since it operates at the network layer it is less likely to be detected by anti-adblock techniques. Because it does not technically modify the page content the site is not able to detect any change and therefore can run undetected. In addition, by using outbound data blocking it is able to monitor all callbacks.

• Privacy protection
• Malvertising protection
• Reducing the number of HTTP cookies
• Protection from intrusive ads and pop ups that often lead users to scam sites
• Fewer distractions
• To save battery on mobile devices
• Better user experience
• Less cluttered pages
• Faster content loading
• Prevent undesirable websites from making ad revenue out of the user’s visit

Hackers are going to get in, that’s inevitable. Cybercrime pays and criminals are getting smarter. The good news is that there is technology available to stop them in their tracks. BlackFog is able to spot attackers in real-time when an attacker has infiltrated the system, so hackers are prevented from removing any of your data, so even if you click on a malicious ad your data and device won’t be compromised.

Every application you use or website you visit collects information about what you’re doing, and users are giving away unauthorized data every time they go online. Online advertising which can be ‘malvertising’ is certainly a threat that users need to be aware of but it’s only part of the modern threat landscape. Rather than focussing solely on blocking ads users should also block the exfiltration of data. A proactive solution like BlackFog Privacy can prevent unwanted data collection and profiling whilst also blocking 99% of online advertising.

In conclusion, blocking ads will enhance a user’s online experience and help to provide important protection from a specific attack vector. However, it is important to emphasize that the threat landscape we see today is infinitely more sophisticated than just a few years ago. Individuals need to adopt a multi-layer defence system to protect their privacy, prevent data loss and put a stop to unauthorized data profiling and data collection. Deploying a solution that blocks outbound data flow will ensure that no unauthorized data ever leaves your device.