Malvertising: when the ad itself is the problem

Most advertising is annoying. A small part of it is dangerous, and that part has a name of its own: malvertising, from "malicious advertising".

The trick is that nobody has to visit a shady site. Ads are delivered by networks that are embedded on thousands of sites at once — reputable ones included. Booking an ad buys you space, not trust. If someone manages to slip a harmful ad past a network's review, it appears on sites that did nothing wrong.

What comes of it is usually one of three things.

The first is the fake prompt. A window appears claiming the browser is out of date, a plug-in is missing, the machine is infected. The button underneath downloads no update — it downloads a program. This works not because people are gullible, but because the message sits exactly where real messages sit.

The second is the redirect. A click somewhere on the page — or none at all — opens a new window with an address that resembles a familiar brand. From there it goes on, often through several stops, so the trail is hard to follow back.

The third is the quiet one: the ad loads code that goes looking for a hole in the browser. If it finds none, nothing happens and nobody notices. If it finds one, the user clicked on nothing at all.

An ad blocker helps at exactly one point, and that point should not be made bigger than it is: it stops the ad from loading in the first place. What never loads can open no window, redirect nowhere and look for no hole. That is effective because it acts early — but it is not a virus scanner. A blocker inspects no files, recognises no malware, and does nothing at all once something has been downloaded.

The second place to act is the address. Someone who lands on a page built to look like a familiar one often cannot see the difference — there is nothing in the shape of a Latin "a" that sets it apart from a Cyrillic one. A warning before anything is typed is worth more there than any explanation afterwards.

Together the two do not cover everything. They cover the route malvertising takes most often — and that route almost always begins with an ad being loaded.