{"id":66982,"date":"2016-12-09T14:26:47","date_gmt":"2016-12-09T22:26:47","guid":{"rendered":"https:\/\/securingtomorrow.mcafee.com\/?p=66982"},"modified":"2025-08-31T20:21:27","modified_gmt":"2025-09-01T03:21:27","slug":"stegno-malvertising-campaign","status":"publish","type":"post","link":"https:\/\/www.mcafee.com\/blogs\/internet-security\/stegno-malvertising-campaign\/","title":{"rendered":"Millions Possibly Affected by Newly Discovered Stegno Malvertising"},"content":{"rendered":"

<\/u><\/u>When it comes to deception, cybercriminals have many options at their disposal. There\u2019s phishing<\/a>, where crooks posing as an authority figure attempt to trick victims into giving up sensitive information. There\u2019s man-in-the-middle<\/a>, where cybercriminals intercept traffic on a public or easily-accessed Wi-Fi network. But there\u2019s one method of deception that\u2019s exceptionally ingenious, and is a new play on an old trick.<\/p>\n

The method in question is called \u201csteganography<\/a>,\u201d a technique used to hide secret messages in plain sight, often within a document or picture. By embedding code into images, and passing the corrupt image off as something innocuous as, say, internet banner ads, cybercriminals are easily able to execute code on vulnerable systems. And they are<\/a>.<\/p>\n

Cybersecurity researchers have discovered a two-year long cybercriminal campaign using steganography techniques on some of the most popular websites in the UK, Australia and Canada. The long-lasting attack delivered corrupt images through online ad networks for news sites like Channel 9, Sky News and more, according to The Register<\/a>. If vulnerable, readers may have been infected with malware capable of collecting keystrokes, footage from webcams, and account or email credentials. It\u2019s a method as effective as it is troublesome, since it takes advantage of often ignored, but prominent and critical, services for news websites. Those services: ad networks.<\/p>\n

Ad networks facilitate the delivery of ads for news websites. While some networks screen ads for malicious activities, most do not. This may be how some malicious advertisements, or malvertisements<\/a>, often wind up affecting millions of site visitors.<\/p>\n

But the newly discovered malvertising campaign, dubbed \u201cStegno\u201d by its discoverers, is different. Its malicious code is well hidden in an image\u2019s pixels, making it difficult for even competent or advanced ad networks to detect. It covers its trails well, executing itself only after it verifies a user isn\u2019t running a virtual machine, security software or actively collecting data packets in order to better hide from cybersecurity researchers.<\/p>\n

Still, despite its advanced techniques, Stegno can only infect users if they meet certain criteria. Namely, the victim\u2019s computer needs to run a vulnerable version of both Internet Explorer and Adobe Flash, Ars Technica reports<\/a>. Both applications have patches designed fix the abused vulnerabilities. Still, Stegno could afflict millions of users across the globe.<\/p>\n

Stegno is effective because it preys on the some of the most common assumptions when it comes to the digital world today: that users don\u2019t need to update their devices; that (some) ad networks don\u2019t need to carefully screen their ads; and that cybersecurity researchers can detect all malware while taking known, standardized precautions to run a \u201cclean\u201d computer for security research purposes. Sometimes these assumptions carry validity, but most of the time they ignore the necessary investments we need to make in online security.<\/p>\n

Tips to Protect Yourself from Malvertising Campaigns<\/h2>\n

So what can you do to protect yourself from sophisticated malvertising campaigns like Stegno? Here are a few tips:<\/p>\n