{"id":1636,"date":"2016-10-03T20:54:04","date_gmt":"2016-10-03T18:54:04","guid":{"rendered":"https:\/\/blog.mi.hdm-stuttgart.de\/?p=1636"},"modified":"2023-08-06T21:53:45","modified_gmt":"2023-08-06T19:53:45","slug":"malvertising-part-1-internet-advertising-basics","status":"publish","type":"post","link":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/2016\/10\/03\/malvertising-part-1-internet-advertising-basics\/","title":{"rendered":"Malvertising – Part 1: Internet advertising basics"},"content":{"rendered":"

\"bildschirmfoto-2016-10-03-um-20-53-58\"<\/a>Imagine surfing the web on a normal trustworthy website. On the top of the page you see an ad for something that interests you, e.g. the newest smartphone you like for an unbelievable cheap price. You click on the ad. Why wouldn\u2019t you? You\u2019re on a trustworthy site after all. The ad turns out to be a hoax, there are no smartphones for a price that cheap. Over the next few days you notice some strange behaviour from your computer.  Turns out, your computer is infected with some malware. How could this happen? In this case, you\u2019ve been a victim of malvertising. Malvertising is a word composed of Malware and Advertising. As you probably already suspect right now, it means infecting users with malware via advertising on the internet. In this series of articles, I want to give you an introduction to malvertising, first by looking at some basics of advertising on the internet.<\/p>\n

<\/p>\n

The business model of most websites is based on revenue generated by showing advertisements to its users. By generating revenue in this way, businesses can offer services at no other cost for the users. The market for advertisers is steadily growing, especially on mobile devices. According to the Internet Ad Revenue Report by IAB<\/a>, the revenue of advertisers grew on average by 17% each year in the last 10 years.<\/p>\n

To explain internet advertising, first you need to know some basic terms. First of all, there are advertisers<\/strong>. Advertisers are companies that offer advertisements of their product to websites. The websites showing them are called publishers<\/strong>. Publishers get paid by the advertisers. Usually in web advertising, a publisher is paid per impression<\/strong>, i.e. the ad is shown to a visitor. Other payment types are per click on the ad or per conversion, i.e. a visitor buys the product advertised.<\/p>\n

\"Ad<\/a>
Schema of an ad network<\/figcaption><\/figure>\n

The two groups, advertisers and publishers are connected by a common market, the so called ad networks<\/strong>. These networks manage an inventory of ad spaces from publishers and sell parts of it in advance to advertisers. The ads are then delivered to the publishers by the ad network. In order to do this, ad networks need to forecast, how many ad spaces they have to sell. The ad impressions also need to be tracked for later payment. Ad buys over an ad network can be targeted towards a special audience. For this, the networks categorize the publisher\u2019s pages, e.g. in interest areas (news, computers, cars etc.) or in targeted audiences (e.g. women, people under 30 etc.). This helps the advertisers sell their product to a specific audience. Examples for ad networks are Google AdSense<\/a> and Yahoo! Bing network<\/a>. Advertisers often sell their ads not only on one ad network but on many to maximise their target reach.<\/p>\n

\"Real-time<\/a>
Schematic overview of real-time bidding in an ad exchange<\/figcaption><\/figure>\n

While these ad networks have been around for almost 20 years now, there is a newer solution that simplifies the relations between advertisers and publishers, ad exchanges<\/strong>. An ad exchange is like an ad network a market place between publishers and advertisers. The difference lies in the real time manner of ad exchange. While ad networks offer an inventory of publisher ads and need to forecast at a prior time, how many ad spaces they have available to sell, an ad exchange sells ad spaces immediately as a user visits a publishers page. This is called real time bidding. When a user visits a page that contains ad spaces that are on offer in an ad exchange (1 in the graphic above), a series of actions is triggered. The publisher requests an ad for that page on the ad exchange. The ad exchange offers this ad space to advertisers , providing further information about the site for targeting. Then, an auction process starts, in which advertisers can offer a certain amount for this ad space (2). This auction only lasts for a few milliseconds. The ad of the winning advertiser is then delivered by the ad exchange to the user (3). This whole process only takes a few milliseconds and is unnoticeable for the user. By doing real time bidding, ad exchanges don\u2019t need to forecast inventory of ad spaces or measure the impressions of an ad, since the bidding is done for one impression at a time. This also brings with it a direct competition between advertisers for each user. Another advantage is the targeting for each impression. With real time bidding, advertisers can utilise more specific targeting, for example they want to target a man aged between 30-50 from Germany. With more specific information available about each visitor, e.g. from cookies, advertisers can target such a group of people more reliable by using an ad exchange than by using an ad network. The most important ad exchange is Google\u2019s DoubleClick<\/a>. Another significant ad exchange is AppNexus<\/a>.<\/p>\n

This concludes the short overview over the advertising market on the web. In the next article of the series I will explain the really interesting stuff: What is Malvertising?<\/strong><\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

Imagine surfing the web on a normal trustworthy website. On the top of the page you see an ad for something that interests you, e.g. the newest smartphone you like for an unbelievable cheap price. You click on the ad. Why wouldn\u2019t you? You\u2019re on a trustworthy site after all. The ad turns out to […]<\/p>\n","protected":false},"author":6,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[26,651],"tags":[],"ppma_author":[693],"class_list":["post-1636","post","type-post","status-publish","format-standard","hentry","category-secure-systems","category-system-designs"],"aioseo_notices":[],"jetpack_featured_media_url":"","jetpack-related-posts":[{"id":1701,"url":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/2016\/11\/14\/malvertising-part-2\/","url_meta":{"origin":1636,"position":0},"title":"Malvertising Part 2","author":"Jonathan Peter","date":"14. November 2016","format":false,"excerpt":"Welcome to the second part of my series about malvertising. In this second post, we\u2019ll get to the important stuff: What is malvertising and how often do these attacks happen? As previously mentioned, the word malvertising is composed of advertising and malware. It\u2019s an attack form in which a victim\u2026","rel":"","context":"In "Secure Systems"","block_context":{"text":"Secure Systems","link":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/category\/system-designs\/secure-systems\/"},"img":{"alt_text":"bildschirmfoto-2016-10-03-um-20-53-58","src":"https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2016\/10\/Bildschirmfoto-2016-10-03-um-20.53.58.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2016\/10\/Bildschirmfoto-2016-10-03-um-20.53.58.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2016\/10\/Bildschirmfoto-2016-10-03-um-20.53.58.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2016\/10\/Bildschirmfoto-2016-10-03-um-20.53.58.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":8818,"url":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/2019\/09\/09\/cryptomining-malware-how-criminals-use-your-devices-to-get-wealthy\/","url_meta":{"origin":1636,"position":1},"title":"Cryptomining Malware – How criminals use your devices to get wealthy!","author":"Alex Christian Mainka","date":"9. September 2019","format":false,"excerpt":"Has your computer ever been slow and you couldn\u2019t tell what the problem was? Nowadays, illicit cryptomining can cause those performance problems. It dethroned ransomware as the top cybersecurity threat in 2018. (Webroot Threat Report 2018) A simple website visit can start the mining process as a javascript running in\u2026","rel":"","context":"In "Allgemein"","block_context":{"text":"Allgemein","link":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/category\/allgemein\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2023\/08\/usa138-2.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2023\/08\/usa138-2.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2023\/08\/usa138-2.png?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":21790,"url":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/2021\/09\/29\/home-sweet-home-office\/","url_meta":{"origin":1636,"position":2},"title":"Home Sweet Home Office","author":"Sarah Schwab","date":"29. September 2021","format":false,"excerpt":"Working from home has many advantages but also numerous risks During the global pandemic in 2020 the German government has decided to restrict social contacts as much as possible. Companies increasingly allowed their employees to work from home.\u00a0 According to the statista website, only 4% of all those surveyed have\u2026","rel":"","context":"In "Allgemein"","block_context":{"text":"Allgemein","link":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/category\/allgemein\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2023\/08\/SSP0ESn8CSUl9QvkUJbmFZ1jRVeWgdxZA0iAmDMVpnoTKp4KPsA-jhGc4MlNlzagJ4rghEnhX-EXgLKtRTqVeT7epHP6141Gz4laFF0pc95Co6jjJq9rH_ftebU9OphKrQk4kJURs0.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2023\/08\/SSP0ESn8CSUl9QvkUJbmFZ1jRVeWgdxZA0iAmDMVpnoTKp4KPsA-jhGc4MlNlzagJ4rghEnhX-EXgLKtRTqVeT7epHP6141Gz4laFF0pc95Co6jjJq9rH_ftebU9OphKrQk4kJURs0.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2023\/08\/SSP0ESn8CSUl9QvkUJbmFZ1jRVeWgdxZA0iAmDMVpnoTKp4KPsA-jhGc4MlNlzagJ4rghEnhX-EXgLKtRTqVeT7epHP6141Gz4laFF0pc95Co6jjJq9rH_ftebU9OphKrQk4kJURs0.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2023\/08\/SSP0ESn8CSUl9QvkUJbmFZ1jRVeWgdxZA0iAmDMVpnoTKp4KPsA-jhGc4MlNlzagJ4rghEnhX-EXgLKtRTqVeT7epHP6141Gz4laFF0pc95Co6jjJq9rH_ftebU9OphKrQk4kJURs0.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":10415,"url":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/2020\/08\/19\/ai-cyberattacks-deepfakes\/","url_meta":{"origin":1636,"position":3},"title":"The Dark Side of AI – Part 1: Cyberattacks and Deepfakes","author":"Micha Christ","date":"19. August 2020","format":false,"excerpt":"Introduction Who hasn't seen a cinema production in which an AI-based robot threatens individual people or the entire human race? It is in the stars when or if such a technology can really be developed. With this series of blog entries we want to point out that AI does not\u2026","rel":"","context":"In "Allgemein"","block_context":{"text":"Allgemein","link":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/category\/allgemein\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2020\/08\/screen-shot-2018-08-03-at-10-34-32-1.jpg?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2020\/08\/screen-shot-2018-08-03-at-10-34-32-1.jpg?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2020\/08\/screen-shot-2018-08-03-at-10-34-32-1.jpg?resize=525%2C300&ssl=1 1.5x"},"classes":[]},{"id":27367,"url":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/2025\/02\/26\/kunstliche-intelligenz-zur-erkennung-von-sicherheitsbedrohungen-in-unternehmensnetzwerken\/","url_meta":{"origin":1636,"position":4},"title":"K\u00fcnstliche Intelligenz zur Erkennung von Sicherheitsbedrohungen in Unternehmensnetzwerken","author":"Maike K\u00f6nig","date":"26. February 2025","format":false,"excerpt":"Anmerkung: Dieser Blogpost wurde f\u00fcr das Modul Enterprise IT (113601a) verfasst. Einleitung Stellen Sie sich vor, Sie sind ein Wachmann in einem riesigen Unternehmen. Jeden Tag patrouillieren Sie durch die G\u00e4nge und halten Ausschau nach Eindringlingen, die versuchen, an sensible Informationen zu gelangen. Doch was, wenn diese Eindringlinge keine menschlichen\u2026","rel":"","context":"In "Allgemein"","block_context":{"text":"Allgemein","link":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/category\/allgemein\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1393,"url":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/2016\/09\/05\/botnets-structural-analysis-functional-principle-and-general-overview\/","url_meta":{"origin":1636,"position":5},"title":"Botnets – Structural analysis, functional principle and general overview","author":"Michael Kreuzer","date":"5. September 2016","format":false,"excerpt":"This paper provides an overview on the most important types of botnets in terms of network topology, functional principle as well as a short definition on the subject matter. By exploring the motivation of botnet operators, the reader will gain more insight into business models and course of actions of\u2026","rel":"","context":"In "Secure Systems"","block_context":{"text":"Secure Systems","link":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/category\/system-designs\/secure-systems\/"},"img":{"alt_text":"wiat wektor","src":"https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2016\/09\/Fotolia_67526425_M-300x169.jpg?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2016\/09\/Fotolia_67526425_M-300x169.jpg?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/blog.mi.hdm-stuttgart.de\/wp-content\/uploads\/2016\/09\/Fotolia_67526425_M-300x169.jpg?resize=525%2C300&ssl=1 1.5x"},"classes":[]}],"jetpack_sharing_enabled":true,"authors":[{"term_id":693,"user_id":6,"is_guest":0,"slug":"jp067","display_name":"Jonathan Peter","avatar_url":"https:\/\/secure.gravatar.com\/avatar\/f102831b1dc3df8ea388e5d3cc39f26d24b79a54e1ee1cee521ff9fd513ee1ae?s=96&d=mm&r=g","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":""}],"_links":{"self":[{"href":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/wp-json\/wp\/v2\/posts\/1636","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/wp-json\/wp\/v2\/comments?post=1636"}],"version-history":[{"count":3,"href":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/wp-json\/wp\/v2\/posts\/1636\/revisions"}],"predecessor-version":[{"id":24706,"href":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/wp-json\/wp\/v2\/posts\/1636\/revisions\/24706"}],"wp:attachment":[{"href":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/wp-json\/wp\/v2\/media?parent=1636"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/wp-json\/wp\/v2\/categories?post=1636"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/wp-json\/wp\/v2\/tags?post=1636"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blog.mi.hdm-stuttgart.de\/index.php\/wp-json\/wp\/v2\/ppma_author?post=1636"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}