The digital media giant of Real Media has recently been known to host malware to unsuspecting recipients.  Earlier, hackers were able to break into one of Real’s servers and establish it to deliver their malware.  An example of how this malware could be distributed is that an unsuspecting user may stumble into a site which has a pop-up advertisement.  While this ad may look normal on the outside, it will actually install some form of malware secretly (providing the target machine was unpatched).  It just goes to show you to always keep your systems updated.

Hackers have rooted into a server owned by internet advertising network 24/7 Real Media and used it to serve malware-laced banner ads that tried to circumvent security mechanisms on end users’ machines, Symantec researchers said. The malware exploited a previously unknown vulnerability in Real Player that was patched on Friday.

While Real Media no longer appears to be serving the tainted ads, it’s possible competing ad networks are launching the same attack, said Alfred Huger, vice president of software engineering at Symantec Security Response.

“There is a very real chance this is not the only server serving up this bad content,” he told The Register.

People who use RealPlayer should download a patch, available here as soon as possible, he said. Symantec Antivirus was updated on Thursday to detect the attack. By now, competing antivirus programs are likely to have followed suit.

Real Media has become the latest ad network to be outed as an unwitting ally to cyber crooks. In September, it was disclosed that Yahoo!-owned Right Media served about 12 million ads over three weeks, which silently installed a Trojan back door on unpatched Windows machines. The ads were served on MySpace, PhotoBucket and other popular web destinations.

The complex web of networks provide an ideal vehicle for spreading malware because they attack users who are visiting sites deemed trustworthy. Ads also make it easy to disguise malicious payloads by allowing cyber crooks to infect end users only during certain hours located only in certain geographic parts of the world: in Europe between 12 and 6 a.m., for instance. That makes it harder for researchers to detect and repel the attacks.[more]

Tags: Malware