Google’s DoubleClick Serves Up Malware

Researchers at Malwarebytes noticed strange behavior on sites like Last.fm, The Times of Israel and The Jerusalem Post. Ads on the sites were being unusually aggressive, setting off anti-virus warnings and raising flags in a number of Malwarebytes systems. After some digging, researcher Jerome Segura realized the problem was coming from Google's DoubleClick ad servers and the popular Zedo ad agency. Together, they were serving up malicious ads designed to spread the recently identified Zemot malware. A Google representative has confirmed the breach, saying "our team is aware of this and has taken steps to shut this down."

Malware served through ad units (or "malvertising") is nothing new, but this incident is notable because of the unusually broad reach of the attack. "It was active but not too visible for a number of weeks until we started seeing popular sites getting flagged in our honeypots," Segura says. "That's when we thought, something is going on." The first impressions came in late August, and by now millions of computers have likely been exposed to Zemot, although only those with outdated antivirus protection were actually infected.

Zemot is focused on computers running Windows XP, although it can also infect more modern operating systems running on x86 and 64 bit machines. Zemot is designed to bypass a system's security before infecting computers with additional malware, so it's difficult to exactly what effect the attack would have on a system once security had been breached. And while the conditions needed for a successful attack are quite specific, the broad reach of the ads suggests that whoever is behind the attack came away with more than a few successful compromises. "Even if there were only 5% of vulnerable machines," Segura says, "we are still looking at a very large number of infections."

Source: TheVerge