UK celebrity gossip website Digital Spy has apologized after serving up banner ads laced with malware earlier this week. Digital Spy site is a high-traffic website and specialises in news about celebs and reality TV programs.
The mechanism or exact strain of malware featured during the attack remains unclear. News of the malware infected surfaced through numerous posts on Digital Spy’s forums. In response to requests for comment, Digital Spy offered a statement confirming the attack and pledging to revamp its procedures:
We can confirm that over the weekend it appears that Digital Spy was attacked by one or more ads containing some form of malware.
As a result of actions taken by our advertising operations team, we are confident that Digital Spy is malware-free and a safe site to use. We think that the attack happened through a practice known as chain buying, where inventory bought on our site is then re-sold to another provider, and possibly then others, making it progressively harder to verify the integrity of creative. We have made it very clear to our advertising partners that we do not find this practice being used as an attack vector in any way acceptable.
We have also changed, with immediate effect, our procedures when it comes to detecting a problem or receiving reports from our users of an issue.
What we would like to say is that we’re really sorry for the inconvenience and worry this has caused to some of our readers. We’re very disappointed that this happened and are changing the way we work both internally and with our partners to ensure we are less vulnerable to attack and that we deal with these incidents much faster.
Confirming the banner ads are laced with malware is tricky in cases where, as in the Digital Spy example, an “occasional” third party ad is probably behind the problem. Paul Baccas, senior threat researcher at Sophos, was not able to confirm anything but highlighted circumstantial evidence that ads served through the site contained malicious scripts.
“It looks like they have cleaned up and so cannot definitely confirm anything,” Baccas said. “The PDF linked to by mtwns DOT net is malicious and I will attempt to write some detection. The blueadvertise.com looks to be a GPT (Get Paid To) advertise site and they are notoriously dodgy,” he added.
Graham Cluley, senior technology consultant at Sophos, criticized Digital Spy’s handling of the incident and agreed with Reg readers that Digital Spy ought to have disabled banner ads while its investigated reports that they might be tainted with malware.
Underlining that warning, Symantec said that surfers visiting Digital Spy risk exposure to malware because of two drive-by download attacks. Users are reporting “strange behaviour” and attempts to install rogue security software after visiting the site. Over on the forum itself there’s talk of various types of Trojan associated with the compromise of Digital Spy.
Some commenters note the pattern of the attack against Digital Spy fits that associated with a much wider SQL injection based attack first spotted last week.
Credit: The Register
More on CyberInsecure: