Malvertizing at variety.com?

sandi — Wed, 10 Dec 2008 00:34:58 GMT

Cite: http://www.google.com/support/forum/p/Webmasters/thread?tid=612707351ed6b298&hl=en

I disagree with the theory being espoused by some in that thread (that the site is hacked and/or htaccess has been manipulated). This is because:

the thread author is complaining that the redirects are occurring as he browses the site
it is not affecting anybody else who has posted to the thread

Such symptoms lead me to believe that there is malvertizing being displayed somewhere on the site - I agree with jwp_var. It is interesting that the behavior only seems to affect Firefox...

The complained of URL, proweb-info.com/soft.php?aid=075676&d=1&product=XPA&refer=dc77b3921 is definitely bad, leading the victim to the fraudware site advancedproscan.com.

ALERT: treat all content from Olympic Media (olympicmedia.net) with extreme caution

sandi — Tue, 09 Dec 2008 23:16:09 GMT

Olympic Media has been caught distributing malvertizing ... again (thanks to Kimberley for the heads up).

Why do I say again? Because a usatoday representative posted to my blog back in September claiming that Olympic Media had sold them a malvertizement.

Anyway, back to present day. This time Olympic Media are distributing a cyberipod malvert.

Adopstools results - you will see that it is not even one of the newer style, difficult to detect adverts:
http://www.adopstools.com/index.asp?page=quicklink&id=o0CVw0KNmEe0g8sv

When the advert is run, it reaches out to two domains - freegreenstats.com and statisticsmanager.com.

statisticsmanager.com drops a cookie for adnetserver.com before leading us to onlinestatsmanager.com. From there we end up at online-info-clicks.com, is which the first URL that exposes the victim to fraudware. online-info-clicks.com redirects the victim to anti-virus-live-scan.com.

The advert also uses _url within its code (which means it can change its behavior depending on where it is run from), and runs timezone checks (again, as a way to control the advert's behavior).

So, what does the various domains tell us? Kimberley has done already done the hard work so I shall refer you to her report. You'll note that she draws a connection between Olympic Media and a known bad actor, Atlantmedia.

Also, you'll see that another malvert was discovered on MSN (this time the Encarta site). Thankfully, that advert has been pulled from circulation.

BTW, note the spelling mistakes on the Olympic Media home page... "dvertising" instead of "advertising" appears twice.

Spyware Sucks : Vulnerabilities, viruses and exploits, safety and privacy on the Internet

Malvertizing at variety.com?

ALERT: treat all content from Olympic Media (olympicmedia.net) with extreme caution