NCSC For Startups: taking on malvertising

Malvertising, or 'malicious advertising', is when an attacker uses online advertising as a delivery method for malicious activity. It's particularly insidious because it often doesn't require any user interaction (such as choosing to run downloaded files) to cause problems, offering attackers unique opportunities to commit fraud and deliver malware.

When something bad happens, such as a scam or malware appearing on a device, it can be really difficult to identify the source of that attack. For this reason, it’s hard to measure the full impact of malvertising; what we do know is that malicious activity within online advertisements is on the increase. According to the ad-Tech security company Confiant, 0.14% of the 650 billion ads they scanned violated security controls. Whilst that sounds like a tiny percentage, this equates to 910 million ads that would have otherwise been displayed to unsuspecting users. And these were just the ads that were detected.

To help keep people safe online, the NCSC want to hear from startup organisations who have novel ideas for providing visibility into malvertising campaigns, measuring the scale, and providing good data on where campaigns originate from.

Equally, we want to hear from those startups who are able to identify bad ads, block them, track the attackers behind them and contribute to removing these attacks from the internet. Attackers are always getting better at evading defences, and we need innovative solutions to identify new attacks.

Through initiatives such as our Takedown Service, the NCSC have been able to have some impact on these malicious campaigns. In a perfect world, the malicious ads that direct you to that site would never appear on your screen in the first place; ad-networks would detect and block everything passing through their platform before they reached the user.

Better still, the fraudsters would never be allowed to sign up to the advertising networks. Unfortunately, this is not the case and hundreds of millions of malicious ads are still displayed on user’s devices every year.

The pandemic has seen a rise in online scams and consumers are reporting increasing incidents of cyber enabled fraud. Whilst most of us are used to receiving scam phone calls, emails or SMS, we’re less vigilant when it comes to spotting malicious advertising. This is why we’re looking forward to working with startups to improve the online safety of the UK population.

If you’d like to help us to develop, adapt and pilot solutions that tackle ransomware, please visit the NCSC for Startups website. Or to find out more, please get in touch with Plexal’s innovation team at [email protected].

James N
NCSC Industry Relationship Manager