- Jul 22, 2014
- 2,525
An advertising network is hiding in-browser cryptocurrency miners (cryptojacking scripts) in the ads it serves on customer sites, and has been doing so since December 2017, according to revelations made over the weekend by the Qihoo 360 Netlab team.
Further, this malicious advertising network has also found an efficient trick at avoiding users with ad blockers, a trick it use to make sure both its ads and the cryptojacker reach all intended targets.
Ad network borrows well-known malware trick
The advertising network —whose identity researchers did not reveal but only referred to as DGA.popad— uses a trick normally utilized by malware families —namely a domain generation algorithm (DGA).
Malware strains —mostly banking trojans— use DGAs to generate unique domain names for each day to which infected hosts connect to receive new commands from the main command and control (C&C) server.
DGAs are highly efficient because only the malware's author know how the DGA algorithm works and they register domains in advance, knowing the malware will connect to it at a point in the future. When security researchers break DGA algorithms, usually this helps authorities take over the malware's infrastructure.
How the ad network uses DGAs
..
..
Further, this malicious advertising network has also found an efficient trick at avoiding users with ad blockers, a trick it use to make sure both its ads and the cryptojacker reach all intended targets.
Ad network borrows well-known malware trick
The advertising network —whose identity researchers did not reveal but only referred to as DGA.popad— uses a trick normally utilized by malware families —namely a domain generation algorithm (DGA).
Malware strains —mostly banking trojans— use DGAs to generate unique domain names for each day to which infected hosts connect to receive new commands from the main command and control (C&C) server.
DGAs are highly efficient because only the malware's author know how the DGA algorithm works and they register domains in advance, knowing the malware will connect to it at a point in the future. When security researchers break DGA algorithms, usually this helps authorities take over the malware's infrastructure.
How the ad network uses DGAs
..
..
