Malvertising was once again on the rise in 2016, increasing 132% over 2015 according to RiskIQ's 2016 Malvertising Report. Out of the approximately two billion ads we scanned, 7,623,099 had an associated blacklist incident, an occurrence rate of almost 0.4% meaning one in every 250 ads is associated with a blacklist incident.
This sharp increase, the reporting of which has become an annual tradition for threat researchers, comes as no surprise—the rise of programmatic advertising has introduced similarly sophisticated profiling capabilities, which threat actors can use to target precise groups of users to boost their return on investment. Malvertising is particularly effective, as it’s difficult to detect and take down because malicious ads are delivered through ad networks and not resident on web pages.
Threat actors perform Malvertising all kinds of ways. Sometimes it's via a drive-by-download, where the target user doesn't even have to be tricked into clicking on a malicious link; the ad downloads the infection from the iframe, often without their knowledge. Sometimes, the ad will download software which collects information on the user's computer, or adbots that add to a wide-ranging fraudulent ad network. Ransomware is also a malvertising method, encrypting the unfortunate victim's files and charging money to get them unencrypted.
Malvertising is so nefarious because it’s a direct attack on the lifeblood of the internet as we know it. Digital media marketing is what funds the “free” websites we all enjoy online, and the success of the internet and all the people that rely on it is inextricably linked to its success. According to a report compiled by eMarketer, worldwide paid media market, which accelerates every year, is at $542 billion—lower than eMarketer’s previous forecast.
Meanwhile, partly fueled by the looming threat of malvertising, Ad blocking in the US will continue to temper the growth of digital advertising. According to eMarketer, ad blocking will grow by double digits. In 2016, 69.8 million Americans were expected to use an ad blocker, an increase 34.4% over last year. In 2017, that figure is projected to grow by another 24% or 86.6 million people.
To combat this problem, RiskIQ scans over 2 billion pages and nearly 20 million mobile apps per day, resulting in a curated blacklist of malicious ads from across the Internet. This proprietary list sets RiskIQ apart, enabling customers to vet new demand sources and prevent malware within their ad infrastructure. RiskIQ is unique in that our crawling infrastructure allows us to capture the entire ad redirect chain and creative sources, which indicate which part of the ad-serving process was compromised, helps us identify the entity responsible for the threat.
In 2016, we improved our crawling and machine learning technology and augmented our traditional signature-based approach to identifying threats. Using a method called ‘representation learning,’ we teach our system by just showing it what a threat looks like rather than telling it exactly how to detect it, so it can evolve to identify threats as they change. As you'll see in the 2016 Malvertising Report, these improvements have increased our ability to identify injections (compromised legitimate assets), malicious distribution systems, scams (by a large degree), and scareware/browser lockers.
Download RiskIQ's 2016 Malvertising Report for the entire breakdown of the malvertising incidents found by RiskIQ in 2016, and how they compare to 2015: