Yahoo visitors got served with malicious ads
Posted on 06.01.2014
Visitors to the main Yahoo domain have been targeted with malicious ads that redirected them to an exploit kit serving different types of malware, the Dutch security audit firm Fox-IT has revealed on Friday.

It is still unknown how some of the ads in the form of iframes served by have been compromised, but they have been found redirecting unfortunate users to one of several domains (but all served from a singe IP address) hosting the Magnitude exploit kit.

The kit would attempt to exploit Java vulnerabilities on the targets' computer, and would serve one or more pieces of malware including the Zeus banking Trojan, advertisement clicking malware, the Dorkbot worm, and so on.

"The investigation showed that the earliest signs of infection were at December 30, 2013. Other reports suggest it might have started even earlier," noted Fox-IT researchers. Yahoo has subsequently confirmed that the malicious ads were served between December 31 and January 3.

The Internet giant has also noted that users in North America, Asia Pacific and Latin America, as well as Mac and mobile users were not affected, which consists with Fox-IT findings that say that the countries most affected are Romania, Great Britain and France.

"It is unclear which specific group is behind this attack, but the attackers are clearly financially motivated and seem to offer services to other actors," the researchers added.

Yahoo has acknowledged the unfortunate situation, and has moved to remedy it, but they have yet to clearly warn potentially affected users that their computers might have been compromised.

Fox-IT researchers estimate that around 27.000 computers are likely to have been infected each hour that the malicious ads were being served.


(IN)SECURE Magazine issue 45 released

(IN)SECURE Magazine is a free digital security publication discussing some of the hottest information security topics. Learn about personal data bankruptcy and the cost of privacy, security and compliance, delivering digital security to a mobile world, and much more.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Fri, Mar 6th