Quote:
Originally Posted by Landis  Jude, which antivirus are you using on the computers you're trying to replicate it on? If you have a random crap computer lying around the house, install AVG/Avast which will give you pop up notices for anything it does and make sure you're using a basic version of IE. Most modern antivirus/internet security software will automatically block pop ups and so on without telling you, so basic and free is the way to go for replication.
|
A big problem with trying to track down where a malvertisement came from is that the malvertisement authors are very tricky. They use all sorts of obfuscation, redirection, and other tricks to hide where they came from. One trick they use is IP address geolocation. They'll only serve up the exploit to IP addresses from certain areas. They do this to hide and to also make it more difficult to track down or find. For example, if an ad network is headquarted in Germany the malvertisement will not do its nasty stuff to any IP address from Germany. But connect from Australia and blamo, and even then it may be random. They'll also block based on IP addresses from specific companies and users. They do that so when the advertising network or website admin checks the ad it comes up clean.
It becomes very difficult for the web site owner to even figure out which ad network came from even if you provide a screenshot.
There are some logging tools that you can run that will track where a malvertisement came from. Security researches run those sorts of tools. But you have to be running the logging software when the malvertisement pops up. You can't trace or log after the fact.
