Bad Ad: Going After The Malvertising Threat
Posted by Tim Cranton
Associate General Counsel
Today, Microsoft filed five civil lawsuits, the first of their kind against a nasty phenomenon known as malvertising. That’s the industry term for malicious online advertising. Microsoft works with the other leading providers of online ad platforms to mitigate the threat posed by malvertising, but we’re now taking that effort a step further.
Our filings in King County Superior Court in Seattle outline how we believe the defendants operated, but in general, malvertising works by camouflaging malicious code as harmless online advertisements. These ads then lead to harmful or deceptive content. For example, ads may redirect users to a website that advertises rogue security software, also known as scareware, that falsely claims to detect or prevent threats on the computer. Malvertising may also directly infect a victim’s computer with malicious software like Trojans – programs that can damage data, steal personal information or even bring the users’ computer under the control of a remote operator.
The lawsuits allege that individuals using the business names “Soft Solutions,” “Direct Ad,” “qiweroqw.com,” “ITmeter INC.” and “ote2008.info” used malvertisements to distribute malicious software or present deceptive websites that peddled scareware to unsuspecting Internet users. Although we don’t yet know the names of the specific individuals behind these acts, we are filing these cases to help uncover the people responsible and prevent them from continuing their exploits.
We hope that today’s filings will help deter malvertising in the future, but meanwhile, adopting a few good habits can help you avoid online scams and ensure the safest computing experience possible:
- Make sure you’re using legitimate and up-to-date anti-virus, firewall and anti-malware/spyware tools.
- Be extra cautious about offers to secure or scan your computer with security software or programs you don’t recognize.
- Don’t give out personal information or credit card information unless you know the site is secure.
Microsoft works vigilantly, using both technology and the law, to fight illegal activity that undermines people’s trust in the Internet and online services. Today’s filings build on other recent actions we’ve taken against click fraud and instant messaging spam (aka “spim”).
This work is vitally important because online advertising helps keep the Internet up and running. It’s the fuel that drives search technologies. It pays for free online services like Windows Live, Facebook, Yahoo and MSN. Fraud and malicious abuse of online ad platforms are therefore a serious threat to the industry and for all consumers and businesses that rely on these free services.
We’ve posted copies of our court filings online:
• Microsoft Corp. and Microsoft Online Inc. v. John Does 1-20, d/b/a DirectAd Solutions: King Co. Superior Court Cause No. 09-2-34024-2 SEA
• Microsoft Corp. v. John Does 1-20, d/b/a Soft Solutions, Inc. King Co. Superior Court Cause No. 09-2-34021-8 SEA
• Microsoft Corp. v. John Does 1-20, d/b/a qiweroqw.com: King Co. Superior Court Cause No. 09-2-34020-0 SEA
• Microsoft Corp. v. John Does 1-20, d/b/a ote2008.info: King Co. Superior Court Cause No. 09-2-34022-6 SEA
• Microsoft Corp. v. John Does 1-20, d/b/a ITmeter Inc. : King Co. Superior Court Cause No. 09-2-34023-4 SEA
We’ll continue to blog about efforts to find and fight cybercrime in all its forms. In the meantime, the Microsoft Advertising team has also posted some additional thoughts on this issue on its blog. And as always, please visit http://www.microsoft.com/protect for more information about staying safe online.
