Google Urges Cooperation Against Bad Ads, Malware

A malicious ad surfaced in Google search results just as Google called for a more concerted industry effort against such scams...

As if to underscore its call for greater industry cooperation to fight malicious online ads and content, Google allowed a scam ad to appear briefly atop search results on Tuesday for the term "Firefox."

The sponsored link purported to take Google (NSDQ: GOOG) searchers to the official Firefox Web site, but in fact took them to a different domain, firefox.mozilla-now.com, according to Sophos, a computer security company.

More Security InsightsWhite PapersPop Goes the Trademark?: Competitive Advertising on the InternetNeutralizing the Spyware ThreatWebcastsGone in 6.0 Seconds: Protecting Laptops and Data from TheftSharePoint and Compliance Regulations- The Rules and How to Avoid Violating ThemReportsCybersecurity Balancing Act3G Safeguards: Incomplete, Getting BetterVideos

InformationWeek editor, John Foley, spoke with Calvin Lui, CEO of Tumri, about their interactive ad platform. With their new technology, ads dynamically change based on geography, demographics, psychographics, media type, sites, etc.Google appears to have removed the ad as a violation of the company's advertising policies.

A company spokesperson declined to comment on the Firefox ad in question, but acknowledged that the company does look for and remove ads that violate its policies.

"Google's advertising policy requires that the Web site address displayed in the ad must match the domain of the landing page for that ad in order to ensure that users clearly understand the destination Web site being advertised," the spokesperson said in an e-mailed statement. "We use a combination of manual and automated processes to detect and enforce these policies."

But the incident underscores the problem that Google and other online companies face in trying to thwart malicious advertising, or malvertising.

Malicious ads have also been spotted this year at nytimes.com. eweek.com, mlb.com, and foxnews.com, among other Web sites and such incidents are becoming more common.

ScanSafe, a security company, on Wednesday said that a large scale malvertising attack had hit popular Web sites, including drudgereport.com, horoscope.com and lyrics.com, over the weekend.

The company said that the ads were delivered by the several advertising networks, including DoubleClick, YieldManager and FastClick.

On Wednesday at the Virus Bulletin conference in Geneva, Switzerland, Eric Davis, head of Google's anti-malvertising team, part of the company's broader anti-malware team, urged ISPs and security companies to work together to fight malicious ads and content. He pointed to the Australian government's Australian Internet Security Initiative, a program to help ISPs identify hijacked PCs (bots) and regain control over them, as an example of cooperative security.

Along those lines, Google earlier this year introduced a custom service engine for conducting background research on online advertisers. In June, the company launched anti-malvertising.com as a home for its custom search engine and as a resource for those fighting malvertising.

 Information Week

Scareware And Bots Require Layered Defenses

Defense in depth is not a new idea in security, but the importance of taking a layered approach is more important than ever. The current rise in infections by bots and scareware, along with recent reports on anti-malware endpoint protection, demonstrate how we need to be doing more at every layer.

Maybe you're one of the lucky ones, but nearly every IT person I know has seen a considerable increase in malware infections. The majority of the infections are bots and scareware that have come through a Web-based infection vector -- sometimes exploits against the browser, and sometimes taking advantage of users through social engineering. So what's going on?

I think the first problem is an increase in the number of bad guys out there looking to make money using malware. Unfortunately, there's not much we can do about that, so we have to focus on both proactive measures to prevent the infections and reactive measures to deal with the infections as they occur.

Why both? If we put in preventive measures, then why do we need reactive ones? It's simple. Security controls fail. Something will get through. As I've said before, when it comes to security, failure is inevitable so you must plan for it.

The recent testing by NSS Labs of anti-malware products for consumers and enterprises is pretty disheartening -- especially if you're one of those folks still clutching your antivirus under the covers and whispering to yourself that it's all going to be OK. It's not. Take off the blinders because the report clearly shows the products we are paying to protect our users are not completely effective.

Dark Reading

Zero Day Threat...

If this doesn't scare you, you're not breathing...C.S.G.