DBSA:2014-0001
Disclaimer: as technology changes, advisories may become out of date or may no longer be relevant, please refer to the "Date" section of the header to be sure the advisory is recent as pertains to your situation.
Contents
Digibase Security Advisory - Yahoo! Advertisement Network Compromise
Keywords: Yahoo, compromise, Yahoo!, malware
DBSA ID: 2014-0001
Regarding: Yahoo! Advertisement Network Compromise
Writeup: Kradorex Xeron (talk) 05:58, 6 January 2014 (EST)
Date: 2014 01 06
Last Modified: 20140106055833 by Kradorex Xeron
Who should take note: All Users
Classification
Priority: HIGH
Rationale: Users must take action to ensure their computers have not been compromised.
Severity: MODERATE
Rationale: Systems with adequate security solutions should be able to filter out most of the issue, however there is still risk that new malware may be being delivered.
Spread of Issue: MULTI-PLATFORM HIGH
Rationale: All users who access Yahoo! associated sites or sites that utilize Yahoo Advertisements are potentially affected.
Description
Yahoo! (herein written "Yahoo") has an advertisement platform in which itself uses to provide itself and other sites revenue from advertisements. Recently Yahoo had their advertisement platform compromised and was serving malicious code along with malware in a mass-infection attempt of thousands of systems who may load the bad advertisements.
The malware and malicious code would have originated from "ads.yahoo.com" and be provided by iframes to the following resources:
- blistartoncom.org (192.133.137.59), registered on 1 Jan 2014
- slaptonitkons.net (192.133.137.100), registered on 1 Jan 2014
- original-filmsonline.com (192.133.137.63)
- funnyboobsonline.org (192.133.137.247)
- yagerass.org (192.133.137.56)
Credit for this list: Fox-IT
Mitigation/Solution
Users are advised to utilize care and caution while accessing web resources, this includes having up-to-date anti-malware and anti-virus solutions along with being careful when a site provides a download without provokation or asks to install software to view content.
It may be prudent to insert the listed domains names into ad blocking blacklists or web filtering solutions to prevent loading of any content from said domains.
Users are advised to scan their systems and ensure no out-of-place software has been installed and monitor their systems for unauthorised activity.
