In our Q2 violations report cyber criminals ramped up their attacks for Spring, AdSecure observed a major increase in detections for Adware and Scareware violations compared to Q1.
Continue reading
This new integration is designed to drive a more secure digital advertising ecosystem for clients of both companies.
Continue reading
Uncommon protocols are very annoying to end users because they can lead to automatic prompts to open or send a message in Facetime or via SMS, launch Skype calls, or automatically open apps like iTunes without the user consenting to the action.
Continue reading
The effective use of residential proxies is key to stopping one of the most evasive attack methods cyber criminals can deploy: ad cloaking via IP blacklisting.
Continue reading
Welcome to Inside AdSecure, our ongoing series that dives into different aspects of the platform, to ensure our partners always get the most out of our solution.
In this installment we're looking at an easily enabled function that allows for a deeper level of analysis of the user experience when they opt to engage fully with banner and native ads: the click-on button.
The Fundamentals: What happens to the user post-click?
While many attacks injected within a banner creative can trigger without proactive engagement from users visiting the website where the bad ad is displayed, some attacks are more deceptive, hiding their attacks on the other side of the ad after the user has engaged and clicked on the banner. Once an infected ad has been clicked, attacks can happen at multiple points within the complete redirection path, leaving the user hit with a nasty malware to deal with, or a phishing URL extracting their personal and financial details.
However it's not just banners that can have this sort of fraud hiding on the post-click side of the ad. This is exactly the same technique that is used when fraudsters launch malicious threats within Native ads, and it is highly effective. Native ads have become very popular as a format because they are less intrusive than other banners and pops, and flow with the other content on the site. This leads to a higher click rates from users, and it's when they engage by clicking on the native ad where they can fall victim to a redirection hijack that sends them to a malicious page, a ransomware attack, or any other number of digital threats.
The Pro-tip: Enable the click-on feature for complete insights into the user journey
AdSecure's click-on button couldn't be easier to enable for any projects that are monitoring native ad campaigns, where it is crucial to explore what happens post-click continuously, or for projects analysing your banner ad campaigns where you want to know if there is something dangerous waiting for the user on the other side.
To enable the click on projects created manually within the AdSecure user interface, you can do this easily during the initial project set up by enabling the click-on button located just above the proxy location options in the set-up window, as seen below.
Should you decide that you want to add the click to an already existing project, you can always open the project and enable the click function at any time while the project is running.
Once the project has been submitted and the analysis complete, the report AdSecure generates detailing the analysis will include a page that details the results both for the initial scan of the ad and the results for the post-click content here. You can easily toggle through each report to get insights on every step in the redirection path by clicking on each option.
Clicking on native ads is THE best way to ensure the end users engaging with these ads remain safe while doing so, and it provides an extra layer of security for your banner ad campaigns by uncovering what could be waiting on the other side of the interaction.
If you would like additional support with how best to utilise our click-on feature within your projects, please contact us at support@adsecure.com
Welcome to Inside AdSecure! This is the first article in a new ongoing series. For this first installment we are taking a look at one of three options you can use to be notified in real-time whenever AdSecure uncovers violations lurking within your ad campaigns: the callback URL.
Continue reading
We analysed over 200,000 ad campaigns across multiple GEOs, devices and browsers between 1st January to 31st March, check out our findings and insights into cyber-criminal behaviour during Q1.
Continue reading
Dublin, 13 May 2019. AdSecure has formed a new partnership with global ad network Traffic Factory to be their ad security technology provider and drive the continued safety of their network.
AdSecure's innovative technology will scan ad campaigns for suspicious activity before they launch on Traffic Factory's network and then further analyse those campaigns while they are live. Suspicious activity can range from quality issues that damage the user experience, such as auto-redirects, back button hijacks, and auto-downloads, to harmful user security threats like malware, browser lockers, phishing URLs, and ransomware. AdSecure will provide constant detection and notification for these and many other digital threats for Traffic Factory, allowing them to immediately halt the offending campaigns and take the appropriate action to maintain user security and provide an amazing experience, every time.
Takanori Kanto, Sales Director at Traffic Factory commented, "It is with great pleasure that we announce our official partnership with AdSecure, a disruptive new force within the field of ad verification and the fight against malvertising. This collaboration will continue to ensure that our network is 100% secure for both publishers on our network and of course, their end users."
Bryan Taylor, Sales Manager at AdSecure added, "We are delighted to come together with Traffic Factory to launch this great new partnership. Traffic Factory serve over 6 billion daily impressions, and the integration of our ad security solution on Traffic Factory's network ensures that we can work together to protect millions of internet users from today's most modern and pernicious digital threats, and solidify the security of the ads served to Traffic Factory's premium quality traffic sources.
AdSecure provides constant detection and notification of security, compliance & quality issues within the digital ad supply chain. To find out how AdSecure can provide protection for your online business visit www.adsecure.com
TrafficFactory is a global provider of high quality traffic. We've harnessed the most up-to-date, accurate Geo-targeting technology , and combined with our Real-Time Bidding model, our clients get the high quality traffic they deserve at a price they can feel good about. To learn more, please visit the site www.trafficfactory.com
For further press information
Contact press@adsecure.com
It should come as no surprise to anyone involved in the digital advertising ecosystem that fraudsters are always looking for new methods to target users with sophisticated digital attacks. As soon as innovative new ways of engaging with users are developed, cyber criminals aren't far behind with a method for exploiting these innovations, particularly when there's money to be made. Now, as push notification ads grow in popularity, a new threat to user security that capitalises on the push notification flow itself has arrived: push lockers.
Upon identifying these push notification specific lockers, between February and March AdSecure saw a 563% increase in the detection of browser locker attacks, and at the time of writing this article, we have protected our partners from more than 20 unique push lockers in under 24 hours.
What is a push notification ad?
Push notification ads are simple clickable messages, accompanied by a small image, that are delivered to desktop browsers or mobile devices, but only once a user has consented to receiving them. This is a key point, as the users have agreed to see the ads, leaving the perception that they are less intrusive than traditional formats, and develop a higher level of engagement from the user.
Push notifications work by displaying an initial permission request — managed by the browser — when a user is visiting a site for the first time. Once the user agrees to receive these push notifications, they will receive them based on the frequency set out by the publisher. Should a user opt not to see push notifications, the browser logs this choice as well, and they won't be asked to subscribe to them again.
What is a push locker?
The push notification format, while relatively new, is growing in popularity within the online marketplace for all the reasons mentioned previously: users have to opt-in to see them at all, and with that consent comes a higher rate of engagement. Brands using push notifications are seeing increased click through rates, and just as marketers are seeing the clear benefits the format provides, cyber criminals are becoming wise to the potential for driving malicious campaigns straight to users screens. What has developed out of these sinister intentions is a new form of browser locker specifically designed around the natural behaviour of a push ad.
How do push lockers work?
When you make the choice to opt-in, or out, of receiving push notifications on a particular site, the browser manages the request and saves the choice. However, it's the way the browser saves this choice — either by domain, or subdomain — that can expose the user to trouble. What happens if you opt out, but the website redirects you automatically to another subdomain? Can you guess what's coming? This allows the user to be prompted again to accept the push notification. So naturally, you decline this new request, and then you're sent to yet another subdomain and asked again, and again, and again. Suddenly you are trapped in an endless looping push notification nightmare, and escape can only be had by giving in and "consenting" to receive the push notification.
Incredibly annoying, right? But this is tame compared to what other push lockers are capable of.
What type of push lockers has AdSecure encountered?
Since first discovering this new form of attack, our development team went on the hunt, uncovering various types of push lockers. In one particularly sophisticated case, users clicking somewhere on the page other than the buttons to allow or block the push would cause the browser to switch to full screen mode, preventing the user from doing anything else until they accepted the push notification, which in turn leads them to a scam offer, or the forced download of malware, or similar security threat. In a separate case, we encountered a push locker that kept users locked on the consent page until they accepted the push, all the while quietly mining cryptocurrencies in the background. Those who opted in were then redirected to a new offer page which also launched the cryptocurrency miner, leaving the user with no safe option to take.
When this type of push locker is implemented on a mobile browser, the entire device is rendered useless for the owner, again until they are forced to consent. In all cases, the looping push notification locks the user into an action they absolutely do not want to take, and puts them at severe risk of exposure to exploit flaws or other security breaches.
What is the solution?
The relative speed at which push lockers have appeared on the scene has caught some ad verification providers off guard. They either weren't aware of the problem quickly enough, or they aren't using the modern technology needed to detect push lockers with any degree of consistency and precision.
Push lockers are sophisticated and pernicious, and in order to catch them early and often, the scanning technology being used needs to be based on the most modern browser technology available. This is one of the reasons AdSecure — with a crawler powered by Chrome — was the first ad verification provider to uncover these looping push notifications, and continues to be the only provider catching them at high frequency, and a strong level of precision.
As more publishers and ad platforms begin to work with the push notification ad format, push locker attacks will spread across the digital ads landscape. Make sure your partners are working with an ad verification provider that has the resources and the knowledge needed to track down push lockers and keep them from hurting digital users.
AdSecure empowers ad platforms & publishers to take back control of their ad quality by providing constant detection & notification for ad security, compliance, and quality issues within the digital ad supply chain.
To learn more about how AdSecure is driving a safer digital world for everyone, contact us today.
Barcelona, 12 March 2019. EXOGROUP, the digital technology enterprise business group, today announced it is making a further significant investment in its online ad verification technology company AdSecure. AdSecure was launched in 2017 to provide ad networks and publishers with ad scanning technology to ensure safe, compliant and malware free ad delivery.
EXOGROUP's further investment of 1 million euros will be used to build more features for the AdSecure platform, grow the existing team and invest in marketing and sales strategies to continue to grow AdSecure's business.
EXOGROUP's CEO and Founder Benjamin Fonzé commented, "Ad networks and Publishers face many challenges in today's market. It is of paramount importance that the end user is protected from cybercriminal activity. AdSecure is constantly developing new AI technologies that intercept any suspicious activity hidden deep within online ad formats, be it in the creatives, ad formats or advertiser landing pages."
"The impact of malicious attacks on end users can have negative effects on business growth, profit and customer confidence. It's important that businesses have the tools available to stop end users being exploited by unscrupulous people who are looking for any opportunity to steal or misuse personal and confidential information as well as hijacking a users devices for malicious means."
"85% of Internet users prefer an ad-supported free Internet therefore it is the duty of all platforms to ensure that those users are fully protected. Our further investment in AdSecure is EXOGROUPs commitment to keeping the internet safe for all users."
AdSecure currently offers a comprehensive range of features that ad networks and publishers can utilise including:
Intelligent Scanning: Crawler technology that automatically scans ad tags, smart links, landing pages, programmatic RTB campaigns and native ads.
Fully automated platform: Easy integration with our powerful API.
Robust detection: Ensuring ads are compliant with client guidelines with extensive detection coverage.
Multi-targeting: Protection from cloaking practices and using behavioral targeting techniques, checking from multiple browsers, devices and locations including residential and mobile carrier IPs to ensure compliant ad delivery and advertiser landing pages.
Instant detection notifications: Whenever a violation is detected, AdSecure generates real-time notification alerts via a callback url or email. The notification provides advanced reports with forensic grade information and detail.
Spy tool: Access every single report, regardless of the detection outcome, allowing a deeper level of forensic analysis thanks to the complete ad redirection chain provided.
AdSecure intelligence: Real-time response feature applied to AdSecure's historical dataset allowing malicious domain blocking.
Ad performance: Monitor the horsepower of ads to stop SEO penalisation from slow ads, and regain control of website performance