by Dan Moren

January 24, 2019 8:57 AM PT

Code embedded in images targeting Macs via ads

Ars Technica security guru Dan Goodin on a diabolical malware that hid JavaScript code in images served in ads:

The ads were served by a group security firm Confiant has dubbed VeryMal, a name that comes from veryield-malyst.com, one of the ad-serving domains the group uses. A run that was active from January 11 to January 13 on about 25 of the top 100 publisher sites triggered the image as many as 5 million times a day. In an attempt to bypass increasingly effective measures available to detect malicious ads, the images used steganography—the ancient practice of hiding code, messages, or other data inside images or text—to deliver its malicious payload to Mac-using visitors.

Just in case you needed yet another reminder that the current state of Internet advertising is likely causing way more harm than good.

This isn’t quite in the same category, but the recent preponderance of malicious ads that hijack a site (usually while viewing on mobile) and kick you to a “free gift card” scam has really ticked me off. Sites have little control over the ads, and the ad networks seems to be playing whack-a-mole trying to stop them, while the users are the ones who get screwed. (And said whack-a-mole leads to more examples like the story above, where the techniques used by bad actors get increasingly sophisticated.)

On top of that, add in recent stories on how most ad metrics are basically garbage and how sites have chased that bottom line, laying off employees along the way, all combines to make Internet advertising look like kind of a trashfire.¹

Oh, and for those that pivoted to video, the story’s not much better.

—Linked by Dan Moren