Home Online Advertising OpenX Shuts Down Its OnRamp Ad Server After Big Malware Attack

OpenX Shuts Down Its OnRamp Ad Server After Big Malware Attack


hacker-activityHas OpenX’s open source ad server been hacked to death? After a serious attack on Saturday, OpenX abruptly pulled the plug on the OnRamp product yesterday, leaving customers scrambling to find new ad servers and reconstruct insertion orders.

OpenX announced the shutdown this morning in a retroactive forum post, and offered little comfort to existing customers regarding when OnRamp may be up and running again. Indeed, the post all but tells site owners to look elsewhere for their ad serving needs. “At this time, we cannot predict when, or whether, the OnRamp system will be operational again,” it says.

In recent months OpenX has been called out for escalating malware activity through the self-serve OnRamp product. (It still operates an enterprise grade ad server.) A January story in  ITWorld criticized the company for ill-considered approaches to monetization of OnRamp partner inventory through the OpenX Market ad exchange. That piece describes how malware has been easily spread through a vulnerability known as an “append” attack, where hackers using the OpenX Market plugin can inject malicious code into OnRamp customers’ ad space through an append/prepend database column.

Many OpenX customers expressed surprise on Twitter about the suddenness of the move. Rival ad server Adzerk said new customers were signing up yesterday at more than three times the normal rate. CEO James Avery said these customers are upset they can’t extract their data, creative, or campaign details from the OnRamp systems. To cope, many have been forced to dig through through email to locate insertion orders and reconstruct campaigns.

While ad serving products can be shut down – for instance due to acquisition – such events typically happen with at least a 30 or 60-day notification to customers.

Here’s the ful text of OpenX’s forum post:

“OpenX’s security team is committed to the security of our services. OpenX OnRamp is a no-cost SaaS service based on our open source ad serving product (unlike our other enterprise grade offerings which run on a separate code base), which we have run as a free service to the community.

OnRamp has been the subject of escalating hacker activity in recent months, culminating in a serious attack that occurred Saturday, February 9, 2013. We have made the difficult decision to suspend the OnRamp service to protect our customers as we investigate the breach further and assess the ability of the OnRamp service to withstand future threats. At this time, we cannot predict when, or whether, the OnRamp system will be operational again.

We will post additional information in this forum as it is available. We sincerely apologize for any inconvenience caused. Other OpenX services, including OpenX Enterprise and OpenX Market, continue to operate normally.”

Update: In a post on Wed. Feb 12, OpenX confirmed it will shut down OnRamp for good.



Must Read


Perion Shutters Content IQ, Its Made-For-Advertising Division

Laptop fans can rest a little easier. A network of well-known MFA sites operated by Perion-owned Content IQ have been taken offline.

‘Incrementality’ Is The Buzzword That Stole Prog IO

Well, that’s a wrap on Programmatic IO Las Vegas 2024! The AdExchanger editorial hopped on stage for a live recording of The Big Story to round up all the moments that made us go “a-ha” this week, including observations on commerce media, CTV and generative AI.

Paramount And Shopsense Add Programmatic Demand To Their Shoppable Ad Network

What if the new storefront is a person sitting on their couch and scrolling their phone?

Privacy! Commerce! Connected TV! Read all about it. Subscribe to AdExchanger Newsletters

Scott’s Miracle-Gro Is Seeing Green With Retail Media

It’s lawn season – and you know what that means. Scott’s Miracle-Gro commercials, of course. Except this time, spots for Scott’s will be brought to you by The Home Depot’s retail media network.

Walled Garden Platforms Are Drowning Marketers In Self-Attributed Sales

Sales are way up; ROAS is through the roof across search, social and ecommerce. At least, that’s what the ad platforms say.

Comic: Working Hard or Hardly Working?

Shadier Than Forbes? Premium Publishers Are Partnering With Content Farms To Make A Quick Programmatic Buck

The practice involves monetizing resold subdomains jammed with recycled MFA articles produced by notorious content farms.