Abstract
Malvertising is a malicious activity that leverages advertising to distribute various forms of malware. Because advertising is the key revenue generator for numerous Internet companies, large ad networks, such as Google, Yahoo and Microsoft, invest a lot of effort to mitigate malicious ads from their ad networks. This drives adversaries to look for alternative methods to deploy malvertising. In this paper, we show that browser extensions that use ads as their monetization strategy often facilitate the deployment of malvertising. Moreover, while some extensions simply serve ads from ad networks that support malvertising, other extensions maliciously alter the content of visited webpages to force users into installing malware. To measure the extent of these behaviors we developed Expector, a system that automatically inspects and identifies browser extensions that inject ads, and then classifies these ads as malicious or benign based on their landing pages. Using Expector, we automatically inspected over 18,000 Chrome browser extensions. We found 292 extensions that inject ads, and detected 56 extensions that participate in malvertising using 16 different ad networks and with a total user base of 602,417.
Original language | English (US) |
---|---|
Title of host publication | WWW 2015 - Proceedings of the 24th International Conference on World Wide Web |
Publisher | Association for Computing Machinery, Inc |
Pages | 1286-1295 |
Number of pages | 10 |
ISBN (Electronic) | 9781450334693 |
DOIs | |
State | Published - May 18 2015 |
Event | 24th International Conference on World Wide Web, WWW 2015 - Florence, Italy Duration: May 18 2015 → May 22 2015 |
Publication series
Name | WWW 2015 - Proceedings of the 24th International Conference on World Wide Web |
---|
Other
Other | 24th International Conference on World Wide Web, WWW 2015 |
---|---|
Country/Territory | Italy |
City | Florence |
Period | 5/18/15 → 5/22/15 |
Funding
National Science Foundation under Grants No. CNS-1017265, CNS-0831300 and CNS-1149051
Keywords
- Adware
- Browser Extension
- Malvertising
ASJC Scopus subject areas
- Computer Networks and Communications
- Software