Disclaimer: as technology changes, advisories may become out of date or may no longer be relevant, please refer to the "Date" section of the header to be sure the advisory is recent as pertains to your situation.
Digibase Security Advisory - Yahoo! Advertisement Network Compromise
Keywords: Yahoo, compromise, Yahoo!, malware, Magnitude Exploit, Java
DBSA ID: 2014-0001
Regarding: Yahoo! Advertisement Network Compromise
Date: 2014 01 06
Last Modified: 20140106071756 by Kradorex Xeron
Who should take note: Everyone
Rationale: Users must take action to ensure their computers have not been compromised.
Rationale: Systems with adequate security solutions should be able to filter out most of the issue, however there is still risk that new malware may be being delivered.
Spread of Issue: MULTI-PLATFORM HIGH
Rationale: All users who access Yahoo! associated sites or sites that utilize Yahoo Advertisements are potentially affected as this exploit utilizes a potentially cross-platform mechanism involving Java.
Yahoo! (herein written "Yahoo") has an advertisement platform in which itself uses to provide itself and other sites revenue from advertisements. Recently Yahoo had their advertisement platform compromised and was serving malicious code along with botnet malware in a mass-infection attempt of thousands of systems who may load the bad advertisements.
The malware and malicious code would have originated from "ads.yahoo.com" and be provided by iframes to the following resources:
- blistartoncom.org (18.104.22.168), registered on 1 Jan 2014
- slaptonitkons.net (22.214.171.124), registered on 1 Jan 2014
- original-filmsonline.com (126.96.36.199)
- funnyboobsonline.org (188.8.131.52)
- yagerass.org (184.108.40.206)
Credit for this list: Fox-IT
These resources then proceed to load further resources ultimately resulting in a compromise if the Java-related exploit involved is successful.
Users are also advised to utilize care and caution while accessing web resources, this includes having up-to-date anti-malware and anti-virus solutions along with being careful when a site provides a download without provokation or asks to install software to view content.
It may be prudent to insert the listed domains names into ad blocking blacklists or web filtering solutions to prevent loading of any content from said domains (possibly including ads.yahoo.com to prevent future incidents).