Slashdot Mirror
Banner Ad on Myspace Serves Adware to 1 Million
An anonymous reader writes "Washingtonpost.com's Security Fix blog reports that a banner ad running on MySpace.com and other Web sites used a Windows security flaw to push adware and spyware out to more than one million computer users this week. The attack leveraged the Windows Metafile (WMF) exploit to install programs in the PurityScan/ClickSpring family of adware, which bombards the user with pop-up ads and tracks their Web usage."
Darwinism works!
And they wonder why consumers want to block all ads. Its because of illegal virus ads like this. If they prosecuted spyware companies the way they do with other virus creators we would not have as much of a problem with people setting up shop as if this is a legitimate business and then hijacking people's computers for profit and waiting for enough complaints to pile up that maybe the state attempts an enforcement action which at worst closes the company and more likely a few small fines and promises to behave in the future. Either way the owners of these companies never serve a day in prison for releasing their viruses.
This way we don't even have to read the article if we want to! We can just comment about the comments of the article. =D
His solution to the hack that destroys a section of your profile is not that he will fix the site, but that you should install Flash 9.
Hah, that's like finding a loaded diaper in a garbage dump and then complaining about the level of sanitation.
"It's called My Space not Your space for a reason."
-MySpace Vice President In Charge Of Revenue Generation
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
If your OS puts out a security fix, it's probably for a reason. This could have been avoided for everyone just by keeping up-to-date.
1. Use Mozilla Firefox.
2. Uninstall Flash, you don't need that proprietary junk, 99% of all flash animations are ads/banners anyways.
3. Maybe you want to "block loading of images from third-party sites".
4. Use the Adblock extension for Firefox, you can get it at http://adblock.mozdev.org/ and get some rules for it.
5. Use a more secure operating system.
I hate Myspace, it is a website that caters to retards, it is so dumb.
How about Myspace as well? It is easily argued that Myspace controls the banner space and content added to the 'global' site (ie every page). This is akin to aiding and abetting.
The sad thing is that a million PCs were infected, and probably 500,000 of them will -stay- infected. And will this even remotely hurt Myspace's market share/traffic? I seriously doubt it.
Please help metamoderate.
My solution to solve this problem is to block the domains of the servers that host these ads such as (pagead2.googlesyndication.com) by using a dns server. This is better than firefox ad-blocking or most other systems. This system prevents any connection to the advertising server. I have a dns server for ad-blocking that is publicly avaiable at 68.147.32.114.
Click here to see if you configured your dns properly.>> Makes me question myspace, you'd think they have people watching for these sorts of attacks.
.. 'shit happens.'
Yes, and you're 100% right. Since they are syndicating it, showing 'due diligence' in making sure they aren't syndicating harmful code is their responsibility.
The question comes down to , reasonably, what is a good percentage to equate with 'due diligence' in checking what they syndicate. They have a few million pages, videos and photos to police, as well as watching what their advertisers are using their network to display.
So even if they go way above and beyond the 80% catch rate of abuse prior to it leaving their network, stuff like this is still going to happen. I'd imagine they only catch about 70% of illegal use involving their network, and considering its size and attractiveness to bad-doers, that's not bad.
Of course its an age old argument, who is most at fault. The person who shot the gun or the company that provided it?
I am also noting a rather old vulnerability was exploited, and people not updating their systems need to share some of the blame.
So I guess in essence
Exactly - every time you delete a cookie an american flag bursts into flame.
Ads can be a growing security risk in the future. I'd like to ban all ads at work, but I can't do that since IE6 is the only allowed browser here and no extra software is allowed to be installed. Once I surfed to Dilbert website for comics that I thought would be safe, but Errorsafe malware tried to install itself to my machine (by ActiveX component in an ad). See http://koti.mbnet.fi/jnyman/dilbert.html screen capture here (the dialogue text is in Finnish, but the bottom line asks "Do you want to install Errorsafe program to your computer to check your computer for free (recommended)?". I complained about this to Dilbert website's webmaster and to Scott Adams and they replied that they're looking at the problem, but after that nothing. Haven't visited Dilbert website since at work. Hope this is not a growing trend.
I'd ban the advertising company from my site after a stunt like this, no matter how much money they bring in.
Let me guess, you generally don't receive advertising money.
When I was a kid, we only had one Darth.
The shocking part is that there are still people using Windows. I've got a laptop sitting around here with Windows on it that I use as a novelty once in a while, but it's not like it can really do anything useful. The package management system is horribly antiquainted, the dependancy checking leaves a lot to be desired, and then there are the security holes in the stock applications that come with the OS. Maybe some day it will mature enough to be useful, but for now it's just a novelty that still isn't up to being used in a production environment.
While I agree with you about myspace, the exploit is not by any means MySpace specific.
On previous occasions Falk AG has served exploits like this through websites like www.theregister.co.uk. In that case Falk had their ad delivery servers broken into.
This is not the first time and as the time goes we will see much more of this.
Baker's Law: Misery no longer loves company. Nowadays it insists on it
http://www.sigsegv.cx/
God kills an American kitten.
Please stop APK.. you're only hurting yourself.
You mean like the government wants our ISPs to track and monitor our web usage and keep copies of all our IM's, searches and emails? Or how about our libraries revealing what books we check out? Maybe AT&T could provide a log of all your phone calls. How about the banks reveal all your financial transactions?
Oops, I forgot - the Patriot Act, among other obscure laws, already allow this.
Innocent until proven guilty no longer applies in the land of the free - why should it apply to corporate America any different? Oh yea, I forgot, they own the politicians.
Why can't Microsoft patch the holes in it's software? Why can't MySpace screen it's advertisers? They aren't showing porn site ads, because they 'screened' the ads, correct? So, how come they are serving adware?
If it's ok for the government to be constantly running background checks (illegally I might add) on it's own citizens in a 'FREE' country, then MySpace should also be responsible for spreading viruses and spyware. Of course, they won't ever have to answer for it. News Corp may as well be owned by the GOP...
Only if Myspace knew what was going on (which they almost certainly did not).
I'll make this very simple for you: Is myspace responsible for the content they put on their site, or not?
When you are a website the size of myspace, failing to vett your advertising borders on gross negligence and incompetence.
Furthermore, if you study how 'responsibility' plays out in the business world, particularly with lawsuits- the first party on the food chain is responsible. If that company wants to take action against its employees, suppliers, etc- so be it. But the buck, figuratively, stops at "round one".
Please help metamoderate.
Yes, it's an online dating site. No, I haven't met anyone on there yet. Shut up.
Most people on MySpace have so much spyware to begin with that no change was noticed in their daily activity.