Hackers Use Banner Ads on Major Sites to Hijack Your PC

The worst-case scenario used to be that online ads are pesky, memory-draining distractions. But a new batch of banner ads is much more sinister: They hijack personal computers and bully users until they agree to buy antivirus software. And the ads do their dirty work even if you don't click on them.The malware-spiked ads have been spotted on various legitimate websites, ranging from the British magazine The Economist to baseball's MLB.com to the Canada.com news portal. Hackers are using deceptive practices and tricky Flash programming to get their ads onto legitimate sites by way of DoubleClick's DART program. Web publishers use the DoubleClick-hosted platform to manage advertising inventory." CT: Link updated to original source instead of plagerizer.

Comments

I only found these ads on....

[Anonymous Coward]

....porn sites

Re:I only found these ads on....

[El Lobo]

Actually, this is not news. Those of you who are/wee usual visitors of WaReZ sites or WareZ engines like astalavista.com will know that this kind of "ads" have out there working for years now. The difference is that now it seems like respetable sites are hosting them directly or indirectly via some ad provider.

BTW these ads are not directly dangerous unless you are running on some old browser/old Windows system, but yes, they are annoying as hell.

Re:I only found these ads on....

[morgan_greywolf]

BTW these ads are not directly dangerous unless you are running on some old browser/old Windows system, but yes, they are annoying as hell. Um, wrong. Watch the video. The guy is running Windows XP SP 2.

Re:I only found these ads on....

[foobsr]

WareZ engines like astalavista.com

It is 2007!

They now say: "Note: Astalavista.com is NOT affiliated with Astalavista.box.sk, there are NO cracks/serials/keygens/warez etc. hosted on the Astalavista.com's server, and never were! Moreover, Astalavista.com is a security site, therefore requests for anything illegal are simply directed to the wrong party, and get ignored immediately!"

CC.

Re:I only found these ads on....

[gazbo]

Yup. And it doesn't do anything "directly dangerous" as the parent said. It politely asks you to download and run a trojan. If you say no....nothing happens.

Re:I only found these ads on....

[El Lobo]

That's why this is not so bad. You get the "Do you really want to run...?' dialog, so the user knows that something is going on. On older systems the system would just directly run the exe.

Re:I only found these ads on....

[fredklein]

If you say no....nothing happens

Perhaps you missed the part(s) in the video where he specifically clicked 'CANCEL', and it still scans his PC.

It politely asks you to download and run a trojan.

And asks you...and asks you.. and asks you....

Re:I only found these ads on....

[gazbo]

Oh no, I just assumed that not everybody would be as credulous as the person who made the video. Of COURSE it's not scanning his PC, any more than you're really the 1,000,000th visitor to the webpage. It's nothing more complex than

window.confirm('Do you want to scan....');window.location.href='http://advert.com/pretend_to_scan.gif';

And yes, it asks you repeatedly. How is that "directly dangerous?" Annoying, yes (as the OP said), but not directly dangerous (as, once again, the OP said).

Re:I only found these ads on....

[uncoveror]

When any strange dialog appears, just click the red X at the upper right. Answering the dialog at all is just asking for trouble. Too bad no one who needs this advice will actually get here to read it.

Re:I only found these ads on....

[morgan_greywolf]

That's why this is not so bad. You get the "Do you really want to run...?' dialog, so the user knows that something is going on. On older systems the system would just directly run the exe. I assume, as a 'happy Windows developer and user' you are saavy enough NOT to click OK. How about the unwashed masses? How about your grandmother?

Re:I only found these ads on....

[Ron Bennett]

One should click the "X" to close out such windows - or likely better yet, especially when in doubt, do so via keyboard CTRL-F4 (think that's the combo).

Anyone who has done some VB programming, etc is well aware that the labels on dialogue boxes can say most anything and be assigned to most anything - problem here is that most Window's users don't know that "Cancel" can be assigned to the same function as "Yes", etc ... don't trust any option shown, use the "X" instead; that's not full-proof either, but much safer than clicking "No", "Cancel", etc.

Ron

Re:I only found these ads on....

[fredklein]

yes, it asks you repeatedly. How is that "directly dangerous?"

If it can run the code to 'ask you repeatedly', it can run other code.

Or if you insist that there is no possible way in Windows to do this (I'm sure someone could post a half a dozen IE security holes that allow arbitrary execution of code), then how about popping up a window with the 'OK' and 'Cancel' buttons reversed? [cancel], [cancel],[cancel],[ok] oh, shit.

Re:I only found these ads on....

[kc2keo]

Agreed. I say that the alt+f4 keystroke is the safest next to using the "X" on the window.

Re:I only found these ads on....

[dmitri3]

I thought a site such as Slashdot and Wired would know a difference between Hacker and Cracker... Also, Windows IS outdated software, especially Internet Explorer, why the fuck are you using it?!

Re:I only found these ads on....

[witekr]

No, it can't really run other malicious code unless there's an exploit in the browser/plugin used.. and that's a different issue altogether.

Popping up a window with OK and Cancel buttons reversed doesn't do anything special. The OK button is equivalent to clicking on a hyperlink. You actually have to go through your browser's Save dialog first before a file will be downloaded/executed on your computer.

Ad spammers have been using these techniques on more obscure websites for years. The only thing special about this case is that they've managed to trick an ad company into accepting a flash file that redirects a user to one of these annoying ad-traps. This was probably done by having the flash communicate with the spammers' server and check a variable to see if it should display the 'legit' advertisement or redirect to the annoying page. That way, they could get the flash file past the advertising company's filter appearing legit, and then enable the alternate actionscript code once the flash file was in the system and being displayed on major sites.

Re:I only found these ads on....

[dwiget001]

I have seen this once or twice recently. I learned, long ago, that you *never* click any button or even on the ad itself, not even the frickin button. The time or two I saw it recently, I just killed the process (web browser I was using at the time). A bit annoying, but not as annoying as just opening the door to malware.

Re:I only found these ads on....

[Metaphorically]

One should click the "X" to close out such windows - or likely better yet, especially when in doubt, do so via keyboard CTRL-F4 (think that's the combo). And why is it that the close button in the corner is special? It may be the safest because normally it isn't hooked but depending on the situation it could be. Windows sends messages to the program whose window is going to be closed. What's more, an application can draw it's own window decorations (like Winamp does, for example) where the corner bit looks like a normal close but isn't.

Even in a web page, someone can make an image that looks exactly like a default message box on your OS (which can be guessed from the User Agent string) and have every part of that image tied to malicious results.

btw, yeah, Ctrl-F4 is close for a window (like a message box) and Alt-F4 is close for an application or new browser window.

Re:I only found these ads on....

[skarphace]

I assume, as a 'happy Windows developer and user' you are saavy enough NOT to click OK. How about the unwashed masses? How about your grandmother? Leave my unwashed massive grandmother out of this.

Re:I only found these ads on....

[finiteSet]

And yes, it asks you repeatedly. How is that "directly dangerous?" Annoying, yes (as the OP said), but not directly dangerous (as, once again, the OP said).

I agree with you that it is not "directly dangerous," under a reasonable definition of that term. And of course, this is unlikely to fool any slashdot readers.

Still, this is bad news. Unsophisticated computer users, jaded from a barrage of popups regarding computer security (e.g. from Norton, McAfee, or Windows), may well be "bullied" into installing the software. To an untrained eye, it doesn't look that different from Norton suggesting a scan and update. Of course, this sort of trick is not new, but having it be spring forth from "safe" websites (I saw this several times on allmusic.com) makes it a lot more likely to catch people with their guard down.

Re:I only found these ads on....

[Anonymous Coward]

Captain Obvious Strikes Again!
Seriously, this is Slashdot here not your local BestBuy.

Re:I only found these ads on....

[hadaso]

> Even in a web page, someone can make an image that
> looks exactly like a default message box ...

Such as "Enter the password for the default security device" that Firefox password manager displays? (either that or some similar text, or perhaps my browser have been hacked a very long time ago?)

Re:I only found these ads on....

[flerndip]

No, closing the popup window only causes it to open again before you can do anything else. Killing the browser from the task manager is the only safe way I've found to put a stop to it. This exact thing just tried to nail me 10 minutes ago, while editing a myspace profile. I didn't see them in the affected domain list, but sure enough myspace is hosting these criminal ads also.

That's some sleazy shit!

[Anonymous Coward]

I hope whoever is doing this eventually gets theirs.

What goes around comes around.

oh great

[deftones_325]

So now I need to buy penis-enlargment pills AND and anti-virus.

Re:oh great

[FuzzyDaddy]

Yes, those two things often go together.

Re:oh great

[Anonymous Coward]

Where is the great goatse.cx link when it is not offtopic? Nowhere...

September forever.

What are these "ads" you're talking about ?

[galaad2]

That's why Firefox+NoScript+AdBlock Plus+Flashblock were invented

Re:What are these "ads" you're talking about ?

[Anonymous Coward]

If you have Noscript, do you still need Flashblock?

I use Opera (which BTW, has all of those built-in) now instead of Firefox, but doesn't Noscript block plug-ins?

Re:What are these "ads" you're talking about ?

[kayditty]

What version of Opera are you using with ad blocking and script blocking built-in? Yours seems to have more features than mine. dtim

Re:What are these "ads" you're talking about ?

[Jarjarthejedi]

Nope, but it can't hurt (except maybe your loading time a little, but with 60+ extensions my FF still loads almost as fast as a blank install). I run NoScript but not FlashBlock and do just fine, but other people might want additional security, even if it's useless (I also have 2 software and 1 hardware firewall, and am considering adding another software, no reason not to).

Re:What are these "ads" you're talking about ?

[FudRucker]

with NoScript the use of FlashBlock is redundant, NoScript blocks all plugins (not just flash)...

Re:What are these "ads" you're talking about ?

[jimbojw]

Or, just update your computer or firewall's hosts file

Here's a good one: http://www.mvps.org/winhelp2002/hosts.htm

Re:What are these "ads" you're talking about ?

[Anonymous Coward]

That's why AtGuard (works regardless of what the client app that's downloading HTML is) was invented.

Re:What are these "ads" you're talking about ?

[lloydchristmas759]

That's why Firefox+NoScript+AdBlock Plus+Flashblock were invented

No, that's why w3m was invented.

Re:What are these "ads" you're talking about ?

[galaad2]

i beg to differ, Flashblock does have a purpose even together with NoScript:

on some sites i want to allow scripts but block flash... and this is the best solution i've found.

Re:What are these "ads" you're talking about ?

[Anonymous Coward]

9.0 or later.

Tools -> Preferences -> Advanced tab -> Content option.

I disable Javascript, Java and Plug-ins, and use the "Manage site preferences" button to whitelist sites for those features.

Use the "Blocked Content" button for ad blocking. I admit that Opera's content blocker interface isn't as good as Adblock Plus, though.

Do a google search on "urlfilter.ini" to get you started on a good content block site list.

Re:What are these "ads" you're talking about ?

[FudRucker]

you have a point there, my eyes are opened, thanks...

Re:What are these "ads" you're talking about ?

[Anonymous Coward]

In the NoScript options, the plugins tab, check "Apply these restrictions to trusted sites too" and all other boxes you like. No need for both of them. :)

Re:What are these "ads" you're talking about ?

[Ginger Unicorn]

dont forget filterset.g updater and cookiesafe

Re:What are these "ads" you're talking about ?

[Sancho]

Does noscript allow me to selectively block Flash within the same site?

I.e. there's a Flash game I want to play, and a Flash ad that I want to block. Can I play the game without also viewing the ad?

Re:What are these "ads" you're talking about ?

[IkeTo]

Like you, I use NoScript and AdBlock Plus and won't see any of those sh*t. But I'm actually rather confused about why the hell did they do it. Are they really that stupid? Once everybody are forced to learn to do the same there is no business for ads business. Did somebody predict something in the lines that Microsoft will never make piracy checking bullet-proof because they would kill themselves that way by forcing everybody to Linux? Perhaps those Ads companies are really not that clever after all.

Re:What are these "ads" you're talking about ?

[Anonymous Coward]

Firefox was not invented to combat ads. FF was & is about standards & modularity & freedom.
btw, software is not invented; it is developed or produced.

Re:What are these "ads" you're talking about ?

[Neil Hodges]

No, but AdBlock (Plus or vanilla) will do this for you.

- Neil

Re:What are these "ads" you're talking about ?

[Kris_J]

I skip AdBlock Plus and instead use Proxomitron with the jd5000 filter set. The author of Proxomitron died back in 2004, and the website for jd5000 appears to have expired, but this page seems to be current. Proxomitron not only blocks ads, but also selectively mangles a lot of obnoxious javascript.

Re:What are these "ads" you're talking about ?

[cecil_turtle]

AdBlock Plus doesn't need filterset.g, that was just for the original Adblock. The Plus version (different extension) has built-in subscriptions / subscription updater.

Re:What are these "ads" you're talking about ?

[Ginger Unicorn]

ah thanks i didnt realise that - do you know why they say this on the download page?

This is a companion extension to Adblock or Adblock Plus and should be used in conjunction with it. This extension automatically downloads the latest version of Filterset.G every 4-7 days. Filterset.G is an excellent set of filters maintained by G...

https://addons.mozilla.org/en-US/firefox/addon/1136

Re:What are these "ads" you're talking about ?

[thc69]

Since version 7 or 8, I've had most of those functions available in a toolbar button. There's loads of pages of buttons you can just drag-and-drop. The one I use most often is a checkbox for javascript.

My urlfilter.ini is pretty complete, I can't remember the last ad I saw.
http://ronanian.googlepages.com/urlfilter.ini

Re:What are these "ads" you're talking about ?

[Mattsson]

But there might be times when you want to allow java-script but not flash-animations on a page.

Re:What are these "ads" you're talking about ?

[cecil_turtle]

I'm not sure why. Filterset.G can be used with AdBlock Plus, but the Adblock Plus maintainer recommends that you don't use it. Here is more information:

• Do I need Filterset.G updater?
• Filterset.G on Wikipedia
• Filterset.G - I call "bullshit"
• A not so short history of Adblock

I personally just use the "EasyList (USA)" filter subscription and it seems to work fine, I don't see any ads.

Re:What are these "ads" you're talking about ?

[kayditty]

Oh, ok. I just started using Opera the other day (I last used 7.54 or something), and I didn't notice the "Manage site preferences" button. It looks exactly like the Firefox content configuration tab, which doesn't allow per-site settings, so I guess I kind of dismissed it out of hand.

I think the system is very clunky and incovenient, though. This kind of thing needs to be in the context menu or status bar or something.

Re:What are these "ads" you're talking about ?

[Uzuri]

You can actually tweak NoScript to make it so you have to click on Flash to get it to play, even in the sites where you are allowing scripting. I believe you can go one step further and whitelist individual flash files as you click on them, but I'm never done that, so I don't know for sure.

Never Experienced This

[ilovegeorgebush]

I've never come across one of these ads. In fact, I rarely get ads as I use the Adblock Plus plugin for Firefox. This just gives even more reason to ban advertisements entirely. Thanks!

Re:Never Experienced This

[Otter]

Adblock doesn't block these, as they constantly change the domain names. NoScript, which is otherwise way too paranoid and obtrusive for my taste, will do it.

Unrelated thoughts:

1) YouTube video is a rather inefficient way to distribute this analysis.

2) The security guy is way too kind to the sites hosting these ads. I've written to several of them, telling them how sleazy the ads are and how bad they make the site look, and the ads are still there.

3) How did YouTube decide that "ridiculously hot LATINA girl dancing, not asian!" is a Related Video? Except in the sense that it's always relevant, I mean.

Re:Never Experienced This

[doombringerltx]

3) How did YouTube decide that "ridiculously hot LATINA girl dancing, not asian!" is a Related Video? Except in the sense that it's always relevant, I mean. Finally a reason to RTFA

Re:Never Experienced This

[orclevegam]

Actually, these are getting into some reputable sites through places like DoubleClick, which is one of the domains that AdBlock targets, so in this case it will protect you. Now, on less reputable sites that are getting these things directly instead of through DoubleClick, yeah, AdBlock won't do much there.

Re:Never Experienced This

[Thanshin]

3) How did YouTube decide that "ridiculously hot LATINA girl dancing, not asian!" is a Related Video? Except in the sense that it's always relevant, I mean.

YouTube finally implemented the mind reading related video selection. What banner add did you first think about when you read the news?

Re:Never Experienced This

[rucs_hack]

most advert serving domains still, for some reason place the images to be used in */ads/* or */banners/*, something like that anyway. A well written rule file for adblockplus (e.g most available ones) have the capacity to block many previously unknown ad servers. Then of course if they are spotted, they go on the list.

Re:Never Experienced This

[the_womble]

Noscript is a lot better at protecting you from stuff like this: no Javascript, Flash Java etc. runs unless you let it. The malware need not be in an ad, there are a lot of other ways of getting people to their sites.

I run Firefox with Noscript on Linux, and using a different browser (I used to use a different user) for sensitive websites. Is this malware likely to affect me?

Re:Never Experienced This

[truthsearch]

I actually prefer to see the advertisements. I want to know if a site I go to is more interested in annoying or intrusive ads than the visitor's experience. If a site has annoying ads I simply don't use the site any more. This way the sites that I like can still get revenue from my page views while the sites that choose to annoy me lose me forever.

These sights should drop DoubleClick immediately and switch to another ad partner. They should also consider a lawsuit. If they do nothing but point a finger at DoubleClick they don't deserve any visitors.

Re:Never Experienced This

[Constantine XVI]

AdBlock Plus, as mentioned by GP, has a built-in filter updater to combat exactly what you mentioned.

Re:Never Experienced This

[xtracto]

Yeah... maybe it is that I only surf the same 5 or 6 websites each day (gmail, slashdot, news.google, jornada, google, wikipedia mostly + scientific journals from SCOPUS datasbase or citeseer) but since installing AdBlock I have not seen an ad for quite some time while browsing.

However it is really annoying when I have to use some computer with IE 5,6 or 7 without adblock because I feel the web *very* polluted. It akin to when you live in a small city with almost no advertising and then you move to Mexico City where the spectacular ads are almost stomped in your face. It is pollution. In this case it is information pollution.

Re:Never Experienced This

[budgenator]

I may have stumbled across a couple yesterday, after following a link, opera crashed like it was pole-axed! I went back in firefox and the same thing happened. Then my computer started to become unresponsive so I opened up system-guard and the linker was running 2 instances and sucking up 95% of the CPU, memory and swap space. I killed it manually and regained my machine, no proof but the timing makes me believe that it was something on the websites that crashed my browsers that was doing it. Normally I don't block ads because I figure it's an easy way to "pay" for my content, but if the "ads" keep attacking, they're going to get bitchslapped.

Re:Never Experienced This

[Strilanc]

A large number of ads can be identified without even paying attention to the website. /ad((space)|(border)|(centric)|(cycle)|(farm)|(frame)|(image)|(logs)|(mentor)|(serv)|(vert)|(vus)|(header)|(zone)|(fetch)|(vo)|(id=)|(client)|(data)|(srv)|(view))/

is by far the best performing filter I have.

Spotted in the Field

[CheeseburgerBrown]

I ran into one of these buggers while surfing news sites. Since I had many tabs open I'm not sure which one featured the poisoned ads, but I was fairly surprised when my Firefox 2 running under Leopard started coughing up fake, Vista-style dialogue boxes and floating window ads, as if I were using a common gutter computer like a Dell.

Re:Spotted in the Field

[dave420]

"Common gutter computer"? grow up :)

Re:Spotted in the Field

[TheVelvetFlamebait]

as if I were using a common gutter computer like a Dell.

Um, why exactly did you include that? It's not exactly relevant to your point, and it earned you a Flamebait mod. You could have done without it.

Unless it was the point of your post, and the rest was throwaway pretext for trolling.

And the funny thing is...

[Noryungi]

Some people complain about Firefox AdBlock? Sheesh.

Note to self: remember to program Adblock to reject everything from DoubleClick from now on, on all home computers.

Re:And the funny thing is...

[Henry V .009]

You still program Adblock? Give Adblock Plus and its automatically updating filters a try.

Re:And the funny thing is...

[Alexpkeaton1010]

In addition to using AdBlock Plus it is also nice to use NoScript. The two of those combined speed up web surfing a tremendous amount.

Re:And the funny thing is...

[orclevegam]

Actually I don't use NoScript because a lot of the sites I frequent have AJAX components, but I do use FlashBlock and that takes care of a lot of the problems.

Re:And the funny thing is...

[Thanshin]

You still program Adblock? Give Adblock Plus and its automatically updating filters a try. Upgrade now to AdBlock Plus! First fifty calls get a brand new filter free!

Re:And the funny thing is...

[Turing Machine]

NoScript lets you approve sites on an individual basis.

Re:And the funny thing is...

[Oktober Sunset]

Plus a free jelly mould in the shape of Texas.

Re:And the funny thing is...

[glorpy]

A non-default NoScript setting that works really well is enabling Temporarily allow top-level sites by default and then choosing Base 2nd level Domains. Then you can selectively add secondary sites, like Google Analytics. Even without that, most sites work really well.

Re:And the funny thing is...

[John Hasler]

> Then you can selectively add secondary sites, like Google Analytics.

Why?

Re:And the funny thing is...

[glorpy]

In case you want to be nice to the bloggers... Also, You Tube videos won't work terribly well without enabling their web site. The point is to keep web surfing as full functioned as possible, while reducing both the security risk and inconvenience.

Re:And the funny thing is...

[vimh42]

I took it one step further a while back. I put doublclick in my host deny.

Re:And the funny thing is...

[shmlco]

Is that an ad? Kind of hypocritical, don't you think?

Re:And the funny thing is...

[John Hasler]

I meant why Google Analytics, specifically?

Re:And the funny thing is...

[Daychilde]

Q: "I meant why Google Analytics, specifically?"

A: "In case you want to be nice to the bloggers..."

Re:And the funny thing is...

[glorpy]

Sorry to take so long in getting back to you; I'm cleaning up from a burglary that pretty much wiped me out. Google Analytics was just an example. Almost nobody goes there directly, but it frequently comes up. Activating it in no way improves your browsing experience, but it's heavily used by bloggers and the data makes them happy. It's totally up to you though.

AdBlock and NoScript

[Timinithis]

I use these exclusively, are there reports that this method gets by them? I know that if the ad is blocked, it isn't downloaded, but is that all it takes, download the ad and you have the virus?

Sounds like a reason to just block all double-click items...

I don't enable flash/scripts on any page unless it is needed -- like scripts for /.

Re:AdBlock and NoScript

[BeerCur]

Another way... Flashblock http://flashblock.mozdev.org/

Also I use MVP Hosts to take care of the "bad" (like Double Click) IP's out there. http://www.mvps.org/winhelp2002/hosts.htm

These two simple things alone, make browsing faster and safer.

Re:AdBlock and NoScript

[Anonymous Coward]

People laugh at me and call me paranoid for using noscript. Poor fools, if they only had a clue. ;)

Re:AdBlock and NoScript

[secPM_MS]

I don't see a need for blocking adds. The problem is not the adds per. se., but the active content. Active content may be malicious. Unfortunately, rich media is the draw for the bulk of the viewer base and rich media tends to use active content.

The viewer / user if presented with Hobson's choice: accept active content, get the desired benefit - while taking the risk; or block active content, be safe, and not get the desired benefit.

If the user wants to view the content and be relatively safe, they can run Vista as a normal user and NOT elevate to administrator to install stuff when the malicious site downloads malware to their system.

They can run NoScript or equivalent and be very careful to authorize only those domains that they trust to run script.

I am paranoid. I run Windows Server 2008, running as a normal user. IE 7 is configured as my default browser in enhanced security mode, which is locked down and secure. IE will not allow me to download many types of items in the Internet zone, so I use Firefox with NoScript installed and kept current. I am very cautious about what sites I allow to run script, but I have blacklisted doubleclick. I do not run flash.

Re:AdBlock and NoScript

[Sleepy]

I am paranoid. I run Windows Server 2008, running as a normal user. IE 7 is configured as my default browser in enhanced security mode, which is locked down and secure.

The really paranoid admins would never surf from their server, period. For that matter there is also no desktop interface on a paranoid setup. These are potential attack vectos.

If you are that cautions, why not run your browser virtualized? just install a VMWare 'browser appliance' (or if you 'require' a Windows browser, install XP inside of Vmware, Virtual PC etc).

This is not to suggest what you do is a bad setup - it is far better than most installations. I trust FireFox, but I wouldn't surf on a server at ALL if it is a production box. A post-mortem of a resulting breach can only point back at you...

Re:AdBlock and NoScript

[Stradivarius]

Even passive content like a JPEG may be malicious/unsafe. Suppose someone discovers a buffer overflow exploit in how IE processes images. You can bet that you'll start seeing images crafted to trigger the exploit and thus hijack the viewing computer. They may well end up on Doubleclick's network.

When you have (inevitably) imperfect software paired with untrusted content providers, there is no guaranteed way to be safe. Which is what makes Doubleclick such a menace - you can't even trust reputable sites anymore, because they're serving ads from unknown and untrusted sources via Doubleclick.

Re:AdBlock and NoScript

[secPM_MS]

Your comment is correct. You should never surf from a production server. I am not. I am running server on my Dell D620 notebook. I am using it as a rather minimal OS. The only thing that doesn't run on it is Microsoft Media, as I have not installed the desktop experience feature.

Unfortunately, standard VMWare Workstation and Microsoft Virtual Server / Virtual PC do not constitute strong security boundaries. They are manageability tools more than they are security tools. Hypervisors "MAY" by considerably stronger. There were a number of interesting security talks at Defcon / Blackhat / CanSecWest on attacking VM's and their host OS's.

Re:AdBlock and NoScript

[secPM_MS]

I know. That is why I run as a normal user. A 0-day against my encoder can hose my user account, which is bad; but it won't hose my system, which is worse. For years I ran with all media off, including images. Unfortunately, even I found the impact on usage to be too severe. Thus, I now run with simple image rendering on. Other media is off.

If I am going to a potentially suspect site, I use Opera - all media off, all scripting off, everything off, cookies and cache cleared on exit - i.e., a supported static HTML renderer.

Thus, I use a diversity of browsers with different security policies IE7:trusted site zone > Firefox NoScript: designated trust > IE 7 hardened:internet zone > Opera: stripped static HTML rendering only.

Re:AdBlock and NoScript

[Burz]

No. Off-site sourced content is the problem.

Even if you prevent remote code from running, there is still the threat posed by ubiquitous ad servers tracking your browsing habits.

Re:AdBlock and NoScript

[Anonymous Coward]

The viewer / user if presented with Hobson's choice: accept active content, get the desired benefit - while taking the risk; or block active content, be safe, and not get the desired benefit.

You can't make something a Hobson's choice by ignoring the middle ground. I block all active content and then white list sites which I want to allow. Even your choice is two choices and not like saying, "Take any horse as long as it's in the first stall."

Vote For Me Or I'll Send YOU

[Anonymous Coward]

to Guantanamo Bay

who is to blame

[cpearson]

Great, now we can await a round of finger pointing to begin over who is liable.

Re:who is to blame

[Anonymous Coward]

Or, you can just block all ads and not care who is liable.

Re:who is to blame

[Detritus]

The simple solution is to assign final responsibility to the web site that is delivering the tainted ads. They are the ones who have ultimate control over what content gets delivered to the user. "We contracted it out" should never be accepted as an excuse.

Very stupid idea

[TheMeuge]

This just gives even more reason to ban advertisements entirely.

The "let's ban it" attitude seems awfully familiar. Are you a member of the US, UK, or EU parliament by any chance?

Like it or not, but advertising generates (directly and indirectly) the revenue that drives the Internet. When advertisement is passive, and does not attempt to hijack your computer, it is theoretically an win-for-all scenario: the advertisers get their clients, the consumers get their products, and the sites that host the advertisement get their costs and expenses covered.

Re:Very stupid idea

[IBBoard]

When advertisement is passive...

Hackers are using deceptive practices and tricky Flash programming...

Not quite passive if they're using Flash, though. I'm selective with my AdBlocking because I know some webmasters rely on the revenue. Anything that's overly flashy (be it flash or animated GIF) or anything too large/overlapping/intrusive gets the page or folder containing the add blocked. If it happens too many times then the entire domain goes.

As for the drive-by infection, hasn't that been going on for a while? I guess it is new (and slightly ironic in a "malware" kind of way) to put AV spam and redirects up instead, though.

Re:Very stupid idea

[orclevegam]

On reputable sites I usually disable AdBlock plus, but I always use FlashBlock, as nothing annoys me more than flash ads.

Re:Very stupid idea

[GIL_Dude]

I had understood that advertisers didn't pay for "impressions" (ad views) anymore and only paid for click throughs. If that is true (and I may be wrong about it - I certainly admit that), then if you are not going to click on an ad you might as well block them since the site admin isn't getting paid anyway. (And, even worse - for the few who self host the ads, you would be costing them bandwidth).

Re:Very stupid idea

[ilovegeorgebush]

I meant ban it personally in my browser. Not on the whole of the web, you clod!

Re:Very stupid idea

[Anonymous Coward]

The "let's ban it" attitude seems awfully familiar. Are you a member of the US, UK, or EU parliament by any chance?

Like it or not, but advertising generates (directly and indirectly) the revenue that drives the Internet. When advertisement is passive, and does not attempt to hijack your computer, it is theoretically an win-for-all scenario: the advertisers get their clients, the consumers get their products, and the sites that host the advertisement get their costs and expenses covered.

You are very much mistaken. Advertising seeks good mediums to exploit, and always shows up AFTER the medium has established itself. Advertising funds garbage content.

Advertising does NOT generate the revenue that drives the internet, and without it, the internet would not only continue to thrive, but would improve. You're probably too young to remember it, but the internet existed long before anyone thought of using it for advertising. HTML existed long before anyone thought of using it for advertising. If every single ad-supported site vanished from the webernets overnight, things would be better. People with something worthwhile to publish would continue to publish, and those who spout useless drivel and subsist on advertising would have to crawl back to the holes from whence they came.

Re:Very stupid idea

[John Hasler]

> Not quite passive if they're using Flash, though. I'm selective with my AdBlocking
> because I know some webmasters rely on the revenue.

If I did that the "harm" would just be transferred to the advertisers as I will never buy what they are selling. I see no reason to worry about it, though.

Re:Very stupid idea

[garett_spencley]

Click-through is far more common than per-impression these days (in fact per-impression is almost unheard of anymore unless you're the one doing the advertising and are paying for the ad to be seen so many times) but even pay-per-click isn't as common as commission based advertising these days.

In other words, many webmasters only make money if the ads they show produce a sale. They'll either get a percentage of the sale price or a flat fee.

Although there still are a lot of popular per-click programs like AdSense and a lot of affiliate programs for dating sites still do per-click.

Re:Very stupid idea

[shmlco]

"People with something worthwhile to publish would continue to publish..."

Assuming, of course, that they could afford to do so. Servers aren't free. Bandwidth isn't free. And time isn't free. The end result of what you propose is either subscription-based sites or services (you're probably too young to remember them) or "free" sites sponsored only by those with pockets deep enough to do so. (And probably serving up an agenda to boot.)

But I'm wasting my time. Your word choice (exploit, garbage) tells me that you're firmly in the camp that assumes that advertising serves no useful purpose whatsoever. And yet I'm sure you demand and consume (and download) ad-free professionally-produced content.

Re:Very stupid idea

[rainmayun]

If every single ad-supported site vanished from the webernets overnight, things would be better.

You do realize that this includes Google, right? Along with many other useful sites. Yes, the internet existed before advertising, and I am no fan of being blitzed by ads at every opportunity, but along with the drivel it has brought a much greater depth of information content, plus some tools (e.g. Google) to help us navigate it.

Re:Very stupid idea

[atraintocry]

Well, by blocking the ad I'm not using that bandwidth. So it's still win-win, except I'm winning even more. People (and I include myself here) shouldn't serve things over HTTP if they want really granular control over how it's accessed. Yeah, it'd be nice if naive advertisers paid for everyone's hosting, but that doesn't extend to a moral obligation for the visitor.

Re:Very stupid idea

[IBBoard]

But there's always the possibility that someone will have a targeted ad that I might actually want to click on, at which point why should they get penalised when their other adverts aren't annoying and intrusive?

As for webmasters hosting their own, that should be a consideration they make when they host it themselves. I know that if I ever ran adverts on my websites (all six of them, all currently without ads) then it'd be something I considered was the number of times it would get downloaded without making me profit.

Ah, let the blame game begin

[SuperBanana]

The malware-spiked ads have been spotted on various legitimate websites, ranging from the British magazine The Economist to baseball's MLB.com to the Canada.com news portal.

...and since those sites outsource to Doubleclick, they'll point a finger at them. Doubleclick will no doubt point the finger at some previously-unheard-of company that "solicits advertisements for the Doubleclick network", and they'll point the finger at their "client."

Meanwhile, The Economist, MLB, Canada.com, etc won't take responsibility for the content they present on their website (after all, they chose to use Doubleclick, they chose to put advertisements on the website, they chose not to require approval of ads before they were shown on their website, etc.) Funny how everyone is trigger-happy when it comes to copyright, but when it comes to content they present causing harm, it ain't theirs, eh? :-)

Doubleclick, of course, won't accept responsibility for vetting advertising distributed via their channel (which seems like a standard business procedure for, oh, an advertising network?) The only comfort is the mechanism of the free market: if website users get pissed enough, said websites might put pressure on Doubleclick or leave them altogether. That's bad for Doubleclick business, so maybe Doubleclick will consider vetting ads better, or run checks to see that flash code doesn't do certain things, etc. Then again, if the malicious banner ad suppliers are paying good enough money, Doubleclick may be perfectly happy to issue a press release "apologizing" and keep right on doing business as usual.

Re:Ah, let the blame game begin

[Frosty Piss]

Meanwhile, The Economist, MLB, Canada.com, etc won't take responsibility for the content they present on their website (after all, they chose to use Doubleclick, they chose to put advertisements on the website, they chose not to require approval of ads before they were shown on their website, etc.) Funny how everyone is trigger-happy when it comes to copyright, but when it comes to content they present causing harm, it ain't theirs, eh?

And speaking of "trigger-happy", you seem to point the finger right back at the Web sites for not inspecting the ads and the underlaying code. Well, that's what they hire DoubleClick for, thats one of the points for using outside ad servers. DoubleClick (and its Mother Ship Google) where not doing their jobs. It was THEIR responsibility to know that the ads THEY served where ligit or not. That's why THEY make the "big bucks". Google is good, Google is God...

Re:Ah, let the blame game begin

[Anonymous Coward]

"Funny how everyone is trigger-happy when it comes to copyright, but when it comes to content they present causing harm, it ain't theirs, eh?"

The obvious solution then, is to download the ads, post them on YouTube, and upload them to BitTorrent. Takedown notices will immediately circulate, and the ads will be taken away.

Re:Ah, let the blame game begin

[Anonymous Coward]

They are both responsible, but double-click has no responsibility towards the end-user. If I go to the supermarket to complain about an own-brand product I don't expect to be (and won't be) referred to the supermarket's anonymous supplier. The supermarket will sort it out. Similarly, I don't care who the websites were paying for what. My relationship is with them; if their site fucks my computer they should be held liable in court. If they can subsequently sue doubleclick, good for them. That's not my problem.

Re:Ah, let the blame game begin

[Ed Avis]

...and nobody blames the real culprits: whichever idiots designed the Flash player, browser and OS so that an advertisement on any random, untrusted website can download things to your machine without your permission. It's 2007. If we have to have things like the Flash player, why on earth doesn't it run in a sandbox with no access to your files? Why doesn't every single window popped up by Flash have a mandatory button 'go away and don't ever show me popups from this Flash file again'?

Re:Ah, let the blame game begin

[CodeBuster]

Doubleclick may be perfectly happy to issue a press release "apologizing" and keep right on doing business as usual.

Which is why many of us have elected to employ the nuclear option (FireFox + AdBlock Plus + NoScript) instead of dealing with crap like this. I really don't give a damn about doubleclick or any of their double talk (pun intended). How many more people will choose the nuclear option after reading articles like this? We shall see.

Re:Ah, let the blame game begin

[Anonymous Coward]

To be fair Google has not purchased Doubleclick yet (especially since EU has extended its review). Until the acquisition Google must legally take no part in Doubleclick's operations and so should not be blamed for this.

Google is also known for having a much stronger privacy policy than doubleclick.

Re:Ah, let the blame game begin

[ConceptJunkie]

FlashBlock works fine for that. So does NoScript and AdBlockPlus. Anyone surfing without these extensions is risking their security to a company (MS) with a hideously bad track record. Even when I'm running Windows, I just don't fear this kind of nonsense... because I know not to trust Microsoft, but supplement its security with other measures. And when I'm using Linux (same browser, same extensions) I can only say "HAW HAW!" and yet be thoroughly disgusted at all the damage MS causes (or allows to happen) and yet there is no culpability.

Re:Ah, let the blame game begin

[Dachannien]

You've really struck upon the fundamental problem that allowed malware ads to creep onto otherwise reputable sites: There's still a lot of money to be made in web advertising, and in fact, there's so much that you can actually make money by being a middleman. Who knows how many layers of ad resale the malware ads have to go through before they bubble up to a reputable website?

However, I see "ad safety" quickly becoming a selling point for banner ads. No reputable company is going to want their users to get pwned while visiting their website, and many of them lack the technical expertise to vet things from their end. Somebody is going to start touting safety as the reason to use their services, and advertising services will start listing "we don't outsource our ads" on their trade literature.

My money is on Google for that one - they may not be the first to make that a selling point, but they'll probably be the most successful at leveraging it, especially since they won't really have to change their business model at all.

Re:Ah, let the blame game begin

[budgenator]

I'd think all of those sites would be big-time enough to handle their own adserver and sales; in fact I'm amazed that MLB allows anyone else a cut of the action when they don't have to.

Re:Ah, let the blame game begin

[illumin8]

And speaking of "trigger-happy", you seem to point the finger right back at the Web sites for not inspecting the ads and the underlaying code. Well, that's what they hire DoubleClick for, thats one of the points for using outside ad servers. DoubleClick (and its Mother Ship Google) where not doing their jobs. It was THEIR responsibility to know that the ads THEY served where ligit or not. That's why THEY make the "big bucks". Google is good, Google is God...

If it was my big dollar website, I would want full editorial control over ALL content that appears on the page, whether it's an article, or the ads that are present in that article.

Print publications have full editorial control of all material, and they exercise it often to remove innapropriate advertising. Why do the online versions of these same print publications not exercise full editorial control?

It's only a matter of time before they get exposed to liability (they probably are already) and a customer sues them for the drive-by installation of malware.

Re:Ah, let the blame game begin

[Anonymous Coward]

Actually it's not at all that clear cut. There are a variety of ways that DoubleClick gets involved in adserving:

1. the website outsources the adserving to DoubleClick, either partially or entirely. In this case, the site is part of the DoubleClick network and serves ads generally without vetting by the publisher. If this is how the malware ads appeared, then yes, DoubleClick is at fault for not testing the ads.

2. the website uses DoubleClick's publisher product. The website traffics, manages, and delivers the ads themselves but use the DoubleClick adserver engine to do so. DoubleClick has no real involvment other than being an ASP. In this case, the publisher is responsible for testing the ads.

3. the website uses whatever adserver engine to serve the ads but the ads themselves are delivered via the advertiser's ad tags. So let's say the website uses Atlas as their adserver, and the advertiser sends them DoubleClick ad tags. So the Atlas adserver serves up the advertiser's DoubleClick tags which then serves up the actual ad. This is the norm since advertisers usually have integrated reporting requirements that require a centralized adserving platform - merging reports from 20 different websites and their various adservers is a huge pain. But the problem here is that the advertiser can change the ads on their end at any time and the website has no idea. Kind of an accountability gap here.

Anyway, it seems to me that in only one of these scenarios should DoubleClick be explicitly liable, and the article doesn't give enough detail to know.

Re:Ah, let the blame game begin

[shmlco]

"... they chose not to require approval of ads before they were shown on their website..."

And just how would you approve them? Watch them to see if they do anything suspicous? Examine thousands of lines of Flash code for each and every version of every ad? Hope that an imported JPEG doesn't contain a new 0-day exploit of which no one has heard?

Approval isn't the answer. Nor is inspection.

TFA = Site scraping?

[Anonymous Coward]

The flibby link is identical to this Wired blog post by Betsy Schiffman, dated four days earlier.

Re:TFA = Site scraping?

[ob1y2k]

man and what did you do ? you broken that link to.. I give you no thanks..

Yeah...

[Anonymous Coward]

but does it work on Linux.

The evils of Javascript

[Anonymous Coward]

This isn't news... except perhaps to those who ridicule us folks who disable javascript for security reasons.

Re:The evils of Javascript

[Allicorn]

Javascript's alignment notwithstanding, it is not implicated by TFA in this particular situation. This is about the evils of Flash.

Re:The evils of Javascript

[Anonymous Coward]

It's the same problem and the problem is simply allowing untrusted and unverified code to execute on a client. Neither are ad networks the only delivery mechanism, response splitting and standard XSS will do nicely.

FWIW, here's the registers coverage which specifically mentions JS.

Re:The evils of Javascript

[Minwee]

I forget. Is the Evil Flash Barry Allen, or is it Wally West?

Re:The evils of Javascript

[JasterBobaMereel]

So flash can affect my computer... why is it still used? Block it!

What we need is a replacement for HTML+JavaScript+Other(Flash,Java etc...) that is properly sandboxed and utterly unaware what it is running on, has no concept of your filesystem or processes. What we have now are browsers that are heavily integrated into the OS and run at elevated security level (IE) or plugins that appear to be able to interact with the OS when they should only be able to talk to the browser ....

Re:The evils of Javascript

[beakerMeep]

And TFA is wrong for not implicating it. Flash's only role in this was to redirect on a timer to another site that used javascript to close windows and pop up all those "You're infected! Download Now?" messages. Flash and actionscript piggy back on the browser and do not, by themselves, have any way to close windows or prompt security alerts. Rather Flash does have a way to prevent these kinds of unauthorized auto-redirects but MLB.com and others seem to have ignored that feature. I know it's easy to demonize a technology that is often abused with big flashing "Click Here!!!" banners, but the reality is that Flash's security features are for the most part beyond that of javascript's. Admittedly, it did have some role in this but it could have just as easily been hidden in javascript with "setTimeout" and "window.location" methods hidden in some obfuscated javascript.

I wonder...

[Anonymous Coward]

When I'm faced with unexpected modal dialog boxes on web pages I don't click any of the buttons -- instead I close the dialog box by clicking the corner "X." I don't even trust a "cancel" button. In the video demonstration, the user always clicked a button, even when "okay" was the only choice.

Not that it lessens the threat by much, but I wonder if the attack could've been thwarted simply by clicking that little "X" in the corner instead of a button.

Re:I wonder...

[Anonymous Coward]

I've seen these pop-ups a couple of times, and the X generally doesn't prevent it. The script is probably written to always take the next action when the previous window is destroyed. Your best bet might be to leave it be, and do a force quit of the entire browser application.

Re:I wonder...

[general scruff]

Be careful! Make sure that when you hover over the "X" button, a hand doesn't come up (meaning it's a link)! I've seen those before. I'll just use task manager at that point. Evil Evil!

ISP's should block DoubleClick

[RichMan]

This is a good enough reason for ISP's concerned about security to block DoubleClick. You spam the net with bad referrals you get binned. Also think of the traffic that would get binned, way better than blocking p2p.

Do it for a month and DoubleClick and their ilk will be extra sure about not hosting bad stuff.

Re:ISP's should block DoubleClick

[Dunbal]

This is a good enough reason for ISP's concerned about security to block DoubleClick.

      Wishful thinking. ISP's are far too busy doing IMPORTANT things like going after P2P and torrent users than doing TRIVIAL things like block spam and malicious code.

Re:ISP's should block DoubleClick

[morgan_greywolf]

Big ISPs, or their ad agencies, are some of DoubleClick's biggest customers. Don't tell me you've never seen banner ads for Comcast or EarthLink or AOL originating from DoubleClick?

No biggy

[Anonymous Coward]

I'm sure Google will fix it all when they take over Doubleclick. After all, they've never had unexpected results with AdWords!

Your company/family/school

[KiloByte]

Right, we all use Adblock and the like. Yet, you can't force everyone in the vicinity to do so, there are lesser minds who opt for Opera, and there's even a tiny portion of giants on Links -- and let's not even mention how low SOME folks can fall.

I would say that adzapper (if you use squid) or a DNS-based blacklist is quite mandatory wherever you do have a say. Glancing at the logs of ISPs I have root at, roughly 1/4 of all freaking http requests go to lowlifes -- and even that based on my grossly incomplete list of ad/spyware/tracking scum.

Yeah, 25%. That's horrible.
And there are some customers dumb enough to complain if you do protect them from ads, so you can't do this in an ISP scenario. But in a company, school or family? Hell yeah, there's no reason for doubleclick.com to get through, ever.

Re:Your company/family/school

[deftones_325]

Is opera that bad? Oh wait.. integrated email in your browser.. oops.

Re:Your company/family/school

[Tangent128]

Opera has "block content". Not that I've used it. Maybe I'm crazy, but I'm not offended by ads.

Re:Your company/family/school

[SirTalon42]

Opera has had a built in AdBlock for quite a while now (which is easier to use IMO, right mouse click on the page, block content, then click on all the ads you see then done). So does Konqueror and a lot of other free (and Free) browsers. Firefox is probably one of the few that doesn't...

Re:Your company/family/school

[Constantine XVI]

I've noticed that not only does Konq have a built-in adblocker, it comes with (at least in the Kubuntu build) a pre-set filter list, which cannot be said of Opera.

Re:Your company/family/school

[John Hasler]

I use Privoxy. It does an excellent job of blocking all ads while working with any browser.

Re:Your company/family/school

[Nicolay77]

Opera is faster and more secure. Opera 9.5 is even faster, making Safari bite the dust. It also uses less memory.

It also can block ads (although not with a blacklist as FF, but you can block whole domains).

To me the lesser minds are the ones that can't respect other people choices.

Re:Your company/family/school

[felisconcolori]

Actually, there is a site out there (my mind forgets the name, although the technique is easily researched using your favorite search engine) that maintains a hosts file which includes the DNS names of a great many of the advertising delivery servers (like ad1.doubliclick.com, and similar places) and then uses the HOSTS file to redirect all requests to 127.0.0.1. Unless you run Apache or IIS on your local machine, this works wonders. In fact, the site that I first discovered this HOSTS file even includes directions on how to use it in a Windows environment. VERY underutilized, the windows HOSTS files. (Which remarkably look very similar, down to the "etc" in the file path, to the *nix system...) Glancing at the logs of ISPs I have root at And of course, these are all ISPs which you work for or are currently contracting with, of course. Hacking is illegal, mm'kay? ;)

Re:Your company/family/school

[Anonymous Coward]

I use Opera because I am in fact more informed than you and those fanboys like you litle minded pretending me to use their broken memory hog called firefox infected with bugs pending fixing (Do you ever mind to browse their bugzilla?). Yeahh you are likely to not get cracked by a stupid flash but you will be cracked with a simple page. How about that? Opera is by many factors better than any version of mozilla because they don't sit on top of a zillion opensource fanboys and have to provide a by far better product. Even better than internet explorer because that one sits on top of preinstalled boxes. Opera sits on top of being better. Otherwise it would RIP. Ahh and by the way is simply stupid to pretend that I can't block adds with something else that is not firefox + adblock. Really? Don't make me laugh. There are a zillion proxies out there that can do that. But don't worry I am a good citizen and understand that websites owners need to mantain their websites with advertising sometimes in order to provide a "free" service. No I won't be the parasite you are. Stop pretending that I will become the one *you are*.

Re:Your company/family/school

[rocca]

Only on Slashdot is "at the logs of ISPs I have root" _slightly_ more believable than "all the girls I have dated".

I've seen this

[Anonymous Coward]

I had an ad pop up on a website I was viewing on a work computer. The site was legitimate and appeared that somebody had used a DoubleClick banner to attempt to exploit my machine. I clicked the x button to close the window but it took me to the malware site anyway. It really freaked me out. I had to close Firefox completely with a series of Alt+F4 hits. Thank goodness I was using portable Firefox instead of the outdated IE the company tries to force us to use or I would definitely be screwed. I just hope it didn't do any damage to my machine.

Does anybody have any information on what this malware does to your machine?

Re:I've seen this

[Notquitecajun]

Nothing much if you catch it in NO CARRIER....

Adblock, flashblock

[Gothmolly]

Nothing to see here, please move along.

Technological Darwinism in action.

Re:Adblock, flashblock

[MyLongNickName]

What exactly does this have to do with Darwinism? Does the virus cause the computer to kill the user so he/she cannot reproduce? And is computer illiteracy genetic? If not, then my next suggestion is that parent poster just likes to feel smug about his computer knowledge...

Re:Adblock, flashblock

[darthflo]

It's the other way round. Computer-illiterate Fred's computers get infected, work slower or stop working alltogether, Jack, who knows a bit about computers is called up (friends, family or geek squad), fixes it, receives money. After a few of said encounters, Jack possesses lots of money while Fred's really poor. Jack then gets to have loads of unprotected sex with lots and lots of supermodels, producing a filthy rich uber-generation of semi-computer-savvy children while Fred's happy to be able to afford a microwave dinner every few days. He can't afford two microwave dinners per day though, so he'll stay single and won't reproduce. done.

Re:Adblock, flashblock

[Gothmolly]

The slow and weak get culled by predators. The clever and adaptable thrive in the face of adversity. What part of Darwinism don't you understand?

Re:Adblock, flashblock

[MyLongNickName]

Clearly, you do not. The whole point of Darwinism revolves around passing of genes. The weak get culled as you say. But those who do not install adblock are NOT at a lower chance of passing on their genes.

So THAT's what it was...

[Anonymous Coward]

OK, so it's not just me! I have an XP (sp2) box that I've kept trim and clean for ~5 years now, until I got hit with one of these a week ago.

It happened just as described in the article, and I've had a HELL of a time trying to clean it off. I managed to get rid of the primary symptoms (ie. - notices that my hard drive had "junk" on it, linking to sales sites for SystemErrorFixer and PCPrivacyTool), but was left with a residual effect (virus?) that the resolution of network names on my internal network were directed first to an external IP address of extremely dubious pedigree.

None of the common tools (ie. - AVG, SBS&D, unHackMe, Smitfraud killers, CA anti-virus, MS OneCare, etc.) were able to even SEE this, let alone remove it, so I've settled on a format/reinstall.

Interesting that the article mentions Canada.com, as I live in Toronto, and use their TV listings daily.

Re:So THAT's what it was...

[montyzooooma]

Anyone know if using Opendns DNS servers helps at all to prevent infection? Longshot I know.

Re:So THAT's what it was...

[bigblackcar]

I've had the same problem with my home XP machine - I think I managed to block any installation, but I cannot be sure. I haven't noticed anything strange in the behaviour of that machine, but can you tell me how I make sure it isn't infected? What do I look for? Thanks...

Not exactly new

[Anonymous Coward]

This has been going on since flash 8 was released with a vulnerability. I got hit by this about a year ago, maybe a little more.

  Suddenly windows security center, that I routinely turn off because I can't stand the nagging, started up and told me that my computer was insecure and that I should go to a certain website and buy their virus defender software.

Not very subtle to a savvy person like myself, but I imagine some people would fall for it.

The box also started throwing up connection error message boxes, presumably because my external firewall were blocking outgoing connection attempts. Again not subtle, but it's an uncommon setup for a home user.

Third, it must have rooted the box somehow because certain files became invisible. "test.exe" among them. Renaming a textfile to text.exe would make it disappear, and the folder would be unremovable. Cygwin came to the rescue there. Also I noticed only because I happened to have lots of little crap programs laying around.

The virus scanners did not pick up on this.

This is the only time I have actually contracted a virus. Needless to say I hosed the box (PING is not disk image). What I learned from the experience is that knowing your system is way more effective than a virus scanner, and B) don't trust flash which is how I got the damn thing. I thought I was safe with firefox.

Re:Not exactly new

[orclevegam]

FlashBlock is your friend.

Re:Not exactly new

[Kingrames]

Flashblock is one of the most annoying plugins ever. I don't mind when it spares me the problems on a news site, but on sites like ytmnd, where I have to click the flashblock 3 times per site in sequence just to see something, it gets real annoying real fast.

I just wish they could change it to where it would allow whitelisting of certain domains like noscript does.

Re:Not exactly new

[Anonymous Coward]

I just wish they could change it to where it would allow whitelisting of certain domains like noscript does.

It already does... right-click on flash and click "Allow Flash from this site"

Re:Not exactly new

[j235]

From the settings
"You can specify a whitelist of websites which can load Flash content."
I, myself, find that YTMND is annoying whether the flash loads or not.

Re:Not exactly new

[Anonymous Coward]

Renaming a textfile to text.exe would make it disappear, and the folder would be unremovable. 1. explicitly deny read permissions for all files & the folder.
2. reboot.
3. delete files.

PS: pls, don't reply with "4. ??? 5. Profit!!!"

Re:Not exactly new

[Kingrames]

I must have had a different version on my laptop. thanks for the info.

Terrible relationships with their advertisers

[sseaman]

Content providers need to be responsible for the content of the ads posted on their sites - that's a given. TFA indicates that these content providers (the people behind NHL.com, for example) simply received payment for these ads via credit card or wire transfer and then posted the content. If these sites used a network television model, they would have intimate relationships with the advertisers and would work together to provide less offensive and more effective ads. I don't think they need to go that far (network television ads are far from perfect, although they are quite effective), but clearly MLB.com and NHL.com need to be held responsible for the content on their sites, and hopefully this will encourage better cooperation between site hosts and advertisers.

Re:Terrible relationships with their advertisers

[EtoilePB]

If these sites used a network television model, they would have intimate relationships with the advertisers and would work together to provide less offensive and more effective ads.

If they followed a network television model, they would also be held more responsible for the content of the advertising on their sites. I don't work in network television, but my partner does -- coming home from work all the time with *facepalm* stories. They have to be very cognizant of what they put, where, and most especially when. If they've got inappropriate advertising -- bad juxtaposition, or vastly inappropriate content -- they may face trouble from the FCC. And more importantly: they lose money.

You know, I can't believe this sentence is actually coming out of my (virtual, pixellated) mouth, but in this instance I almost wish the 'net worked more like network TV. (Almost.)

FireFox+Adblock

[Anonymous Coward]

Use Adblock... the "stealing money from webmasters tool" :P awwwwww por little webmasters

Say.. doesn't Slashdot use Doubleclick?

[Animaether]

I'm pretty sure it does because I had to wait 30 seconds for any page of Slashdot's to render fully yesterday because Firefox was busy waiting for ad2.doubleclick.com or somesuch subdomain of theirs. The current page source certainly has doubleclicky ads.

Now, granted, the malware distributors typically tag ads for subjects not often seen on Slashdot (but I get them on, e.g., the Sinfest comic - huh, imagine that).

I'd say it's about time Doubleclick (that's you, Google, if you finally get to say you did indeed acquire it and everybody OK'd the deal.) gets held a little more responsible for this sort of thing being done through their network for which they collect money.

Re:Say.. doesn't Slashdot use Doubleclick?

[orclevegam]

I just got a new workstation at my office and hadn't got around to installing FlashBlock/AdBlock+ like I normally do, but the dice.com add on slashdot finally convinced me to do it. For some reason whenever the dice.com ad loaded it would bring firefox to a crawl until I killed the window it was in or reloaded that page and got a different ad cycled in.

Re:Say.. doesn't Slashdot use Doubleclick?

[bogie]

You know what would be a great addon for Firefox? An Extension that somehow would intelligently work around Firefox hanging on a non-responsive external to the site servers. Instead of using Adblock et al, let the site have their ads but route around the ones that cause pages not to load. Nothing worse than going to your favorite site an wondering what is taking so long only to see ad2.doubleclick.com sitting in the status bar.

Re:Say.. doesn't Slashdot use Doubleclick?

[Anonymous Coward]

How about an addon that just restricts every HTTP request the browser makes to the original domain that you clicked on a link for?

Re:Say.. doesn't Slashdot use Doubleclick?

[Animaether]

To be fair, I'd say this is a Firefox rendering issue. It already has the HTML page.. short of any javascripted source-code injection stuff, it should be all set to render the page .. minus the missing 'loading' element. But yes, all the same, it bugs me when the status bar shows that, of all things, it's an -ad- that's the instigating cause.

Re:Say.. doesn't Slashdot use Doubleclick?

[Hatta]

What would be great is if Firefox would move to a multi-threaded UI.

Re:Say.. doesn't Slashdot use Doubleclick?

[cyclocommuter]

Yes, Slashdot uses Doubleclick, I can see doubleclick as one of the domains/sites blocked by NoScript when I click on its (NoScript) icon when I am on Slashdot.

Re:Say.. doesn't Slashdot use Doubleclick?

[Bill, Shooter of Bul]

I think this might be on purpose. In the olden days of netscape 2 &3, a page would load instantly with these funny boxes where pictures would then load. I think at some point someone decided that those were too ugly, and net speeds were increasing so it wouldn't hurt to wait for all of the content before rendering it. I agree, its stupid.

Re:Say.. doesn't Slashdot use Doubleclick?

[houghi]

Just block them on your machine. As the first line of defence I use http://www.mvps.org/winhelp2002/hosts.txt, which is a hostlist that, among others, points doubleclick and googleads to 127.0.0.1. At this momen more then 30.000 domains.

It speeds up those slow websites a LOT and already reduces the amount of adds. Also it will work for all your broswers.

I asume there will be many more lists like that, yet this one is the best that I know.

Re:Say.. doesn't Slashdot use Doubleclick?

[jonwil]

One issue is that, without knowing the size of the external image, you cant render a space for it.

Re:Say.. doesn't Slashdot use Doubleclick?

[VGPowerlord]

Too bad I don't have mod points, because I think this deserves a +1 Insightful.

Re:Say.. doesn't Slashdot use Doubleclick?

[nobuddy]

The looooong delays waiting for ads is why i went to adblock in the first place. Watching the metrics of sites I visited, I found that the bulk of the delays were for ads, usually offsite/ad provider services. These folks SEROULSY overload their servers, and don't care. Any web server that needs 45 seconds to send me 3k needs a major overhaul. Pages i visit went from 30-60 second load times to 3-5 seconds instantly with adblock. the Web is not slowing down, the ad services are bottlenecking it. The added benefit of no infecting ads is just icing on that cake. Anyone remember Weatherbug's bouth with malicious code in ads? (javascript hijacks and popup cascades, back then)

Re:Say.. doesn't Slashdot use Doubleclick?

[Animaether]

Sites using that fancy WEB 2.0 stuff don't seem to have any problems with locations for images resizing.. many only image galleries work that way, after all.

I can understand that with that, in the middle of other content, you will have jumping content which would have to be dealt with.. somehow... however, most sites would be done with this within seconds; the only problem comes with exactly the case I mentioned - content loading slowly (or, eventually, not even loading at all).

Not an easy problem, I admit - but just about anything is better than waiting for the page to show up just because a minor element of it is taking its sweet time :)

!news

[blackdew]

This is going on prety much since the beginning of the (http-based) web as we know it, first by browser exploits then by flash and activex and whatever else

definetly not news

Doubleclick sent out a notice Friday

[night_flyer]

here's a list of the sites that contained the malware:
100it.info, 10smi.info, 2greatfind.com, 2quickfind.com, 3akoh.net, Ad2cash.net, Ad2profit.com, Adcomatoz.com, Adgurman.com, Adhokuspokus.com, Adnetserver.com, Adredired.com, Adsolutio.com, Adtraff.com, Adverdaemon.com, Adverlounge.com, Adzyclon.com, Alg-search.com, Alhoster.com, Aligarx.biz, All-search-it.com, Alphatown.us, Anmira.info, Anonymbrowser.com, Antivirussecuritypro.com, Aptprog.com, Art-earn.biz, Astalaprofit.com, Autodealer-search.com, B2adz.com, Bazaard.com, Belkran.com, Belshar.com, Bestadmedia.com, Best-biznes.info, Best-cools.info, Bestdatafinder.com, Besteversearch.com, Bestpharmacydeals.com, Best-screensavers.biz, Bestsearchnet.com, Bestshopz.com, Bestwm.info, Bestwnvmovies.com, Bezzz.info, Bi-bi-search.com, Bizadverts.com, Bizmarketads.com, Blessedads.com, Bm-redy.com, Bovavi.com, Brandmarketads.com, Bucksinsoft.com, Burnads.com, Cancerno.com, Candid-search.com, Carpropane.com, Cashloanprofit.com, Casinoaceking.com, Casinoby.com, Casinodealsgalore.com, Cha-cha-search.com, Cheap-auto-deals.com, Checkstocklist.com, Chushok.com, Clever-at-search.com, Clubheat.info, Come-from-stars.com, Co-search.com, Creamme.net, Cryptdrive.com, Cyndyk.info, Deuscleanerpay.com, Didosearch.com, Diphelp.biz, Dmitry-v.info, Doma2000.com, Durtsev.com, Easybestdeals.com, Energostroj.com, Enothost.com, Eroticabsolute.com, Errordigger.com, Errorinspector.com, Evrogame.info, Fandasearch.com, Fantazybill.com, Fastwm.info, Fastzetup.info, Fati-gati-search.com, Favourable-search.com, Favouriteshop.com, Feel-search.com, F-host.net, Fifaallchamp.com, Fight-arts.com, Fileprotector.com, Findbyall.com, Firstbestsearch.com, Firstlastsearch.com, First-ts.com, Foamplastic.net, Fokus-search.com, Force-search.com, Forceup.com, Forex-instruments.info, Forvatormail.com, Freepcsecure.com, Freerepair.org, Freetvnow.net, Friedads.com, Fulsearch.com, Getfreecar.com, Gibdd.us, Glass-search.com, Glorymarkets.com, Gosthost.net, Great4mac.com, Greyhathosting.com, Gt-search.com, Hackerpro.us, Hardlinecenter.com, Hebooks-service.com, Hintway-international.com, Homeofsite.com, Hromeos.com, Hyip2all.org, Icq-lot.org, Iddqdmarketing.com, Ideal-search.com, Idea-rem.com, I-forexbank.biz, I-games.biz, Imamis.net, Individ-search.com, Information-advertising.info, Infyte.com, Initial-search.com, Insochi2014.com, Installprovider.com, Internetadaultfriend.com, Internetanonymizer.com, Internetsupernanny.com, Intervarioclick.com, Investmentsgroup.org, Invulnerableads.com, It-translation.biz, Izol-tech.com, Kamerton-tests.com, Kazilkasearch.com, Keytooday.com, Keywordcpv.com, Kiridi.net, Kpoba.net, Kurgan45.info, Ladadc.com, Lanastyle.com, Ldizain.info, Libresystm.com, Liders.biz, Linii.net, Liveclix.net, Loffersearch.com, Londasearch.com, Lovecraft-forum.net, Loveopen.info, Lseom.biz, Luckyadcoin.com, Luckyadsols.com, Mad-search.com, Magicsearcher.com, Mailcap.info, Manage-search.com, Marketingdungeon.com, Mass-send.com, Max-expo.net, Maxyanoff.com, Mediatornado.com, Mega-project.biz, Megashopcity.com, Mightyfaq.com, Misc-search.com, Mobilesoftmarketing.com, Mobiletops.com, Mobilorg.org, Moneycometrue.com, Moneypalacecash.com, Mounthost.net, Myfavouritesearch.com, Myhealth-life.org, Myonlinefinance.com, Mysurvey4u.com, Mythmarketing.com, Mytravelgeek.com, Myusefulsearch.com, Napol.net, Navygante.com, Netmediagroup.net, Netturbopro.com, Newbieadguide.com, Nryb.com, Of-by.info, Olgalml.com, Ol-search.com, Onedaysoft.com, Onestopshopz.com, Onwey.com, Opensols.com, Original-search.com, Osetua.com, Osminog.org, Parischat.org, Passwordinspector.com, Pcsoftw.com, Pcsupercharger.com, Performanceoptimizer.com, Piramidki.com, Podelkin.info, Popadprovider.com, Popsmedia.com, Popupnukerpro.com, Postcity.info, Prenetsearch.com, Prevedmarketing.com, Prizesforyou.com, Pro-dom.info, Propotolok.info, Pro-svet.info, R2d2adverising.com, Radiosfera.net, Rocktheads.com, Roller-search.com, Rombic-search.com, Rus-invest.net, Rusnets.info, Russia-post.com, Sajruen.info, Samson-pro.com, Sauni.net, Se7ensearch.com, Search-and-win.com,

Re:Doubleclick sent out a notice Friday

[Frosty Piss]

None of the sites listed in the "story" are on this list. Where did this list come from? Or is this some SEO trick for a bunch of spam sites?

Re:Doubleclick sent out a notice Friday

[roman_mir]

All of the below names sound like they were (almost certainly) created by a Russian speaking person:

3akoh.net, Adgurman.com, Adhokuspokus.com, Adzyclon.com, Aligarx.biz, Chushok.com, Dmitry-v.info, Doma2000.com, Durtsev.com, Energostroj.com, Enothost.com, Eroticabsolute.com, Fati-gati-search.com, Fokus-search.com, Gibdd.us, Insochi2014.com, Kazilkasearch.com, Keytooday.com, Kiridi.net, Kpoba.net, Kurgan45.info, Ladadc.com, Liders.biz, Linii.net, Maxyanoff.com, Olgalml.com, Osetua.com, Osminog.org, Piramidki.com, Podelkin.info, Prevedmarketing.com, Propotolok.info, Pro-svet.info, Radiosfera.net, Rombic-search.com, Rus-invest.net, Rusnets.info, Russia-post.com, Sauni.net, Serebro1.info, Sergp.info, Sevna.org, Sotaman.info, Spbcoffee.info, Stolovaya.info, Svadba-buket.info, Svadba-center.info, Svadba-dress.info, Svadba-rings.info, Svadba-scenarii.info, Svadba-toast.info, Svadba-vikyp.info, Vkpb.net, Wape3a.net, Wmbserg.org, Wmolotok.org, Wmrabota.info, X-lave.info, Zappinads.com, Zapsibir.com, Zvukko.net

Re:Doubleclick sent out a notice Friday

[night_flyer]

from what I gathered, these are the sites linked to the ads that showed up on the sites listed in the article

Re:Doubleclick sent out a notice Friday

[night_flyer]

heres the rest of the email notice...

Over the last several months, website publishers using a variety of platforms have inadvertently served ads that contain malware executables. As we noted in the communication we sent in early October, the ads appear to have originated from small "agencies". These agencies go by a variety of names, and generally claim to be based in Europe or Canada.

Our security monitoring system (active on DART for Publishers, DART for Advertisers and DoubleClick Advertising Exchange) has detected malware executables from ads with a series of domains in the past month. As a service to customers, we are providing a list of those domains below.

Old news.. and a very old problem.

[Dynamoo]

Seriously, I wrote about exactly the same thing here a month ago, although I could identify Doubleclick as the network running the ads. It's quite amusing to see that the fake anti-spyware app claims that you have Windows malware on your Linux box.

Still, griping aside it's good to see this hijack getting a higher profile. However, I had a note from someone who had come across a hijacked banner on Yahoo! just today, so it's clear that the banners are still out there.

Banner hijacks for this type of rich media ad are not a new problem. It's not a problem you generally see with good old fashioned GIF and JPG banners, or plain text ads.

Re:Old news.. and a very old problem.

[GIL_Dude]

So far, these have all been Flash based attacks from what I am reading. I know few folks use it yet (ever?), but what about SilverLight? Does it enable these same vectors? I know some sites (like MLB.COM) do some of their stuff in SilverLight these days (probably got special help setting it up or got paid to do it or something). Anyway, it makes me wonder if it is really ALL rich media or if it is really specific to a design issue with Flash?

Re:Old news.. and a very old problem.

[coppro]

I've seen these adds pop up, and they start by informing me that they're scanning C:\system32 for data... that would mean more if such a file existed. A quick call to ps shows that wine is not running, so there is no file on my system possibly identifiable as 'C:'. While it's fictionally scanning,

Just to be sure, I grepped my entire hard drive for some keywords I noticed in these ads and it came up nothing. So I'm pretty sure that I haven't been infected.

But had I been on Windows...

Also, this blog entry shows that Silverlight has a better security model... don't know whether the implementation is airtight, but at least they want it to be.

Re:Old news.. and a very old problem.

[Emetophobe]

I clicked on your "not a new problem" link. Avast (free edition) popped up a Trojan warning. What exactly is on that page?

hosts file

[phrostie]

all the more reason to set up a host file

http://www.mvps.org/winhelp2002/hosts.htm

Re:hosts file

[gmack]

Some of the less reputable ad networks have already moved to random subdomains to get around this. To fix them I created a that can be matched against multiple domains.

I use a flash blocker so I use this zone file on sites where the ads annoy me in spite of me not seeing flash.

And then I can just add each domain I want to block like this.

Re:hosts file

[phrostie]

i knew they would come up with something eventually.

thanks for the tip.

allmusic.com as well

[withears]

This explains a lot. A couple of times recently on Allmusic.com, I've had some spyware-malware.com (or some such thing) make a pop-up box on me. I was very confused as to why a legit site like allmusic would have that happen. Sites need to start being concerned about this kind of thing or they're going to start losing traffic.

F the Flash garbage

[Anonymous Coward]

Flash has always been an insecure resource hog.

Unfortunately, I think a lot of folks get talked into using flash on their sites by web designers who just want to maximize billable hours. Often their sites fail at the basic function of conveying information because they don't include HTML versions of the information people are looking for. A great example are bands with tour information in Flash only. Most of the artists don't even know about the problem. Unfortunately the people who answer webmaster@site are often those reaping the cash rewards of flash-only implementations.

I don't allow flash in my primary browser and also disable javascript. I won't visit websites that require Flash. Just say no.

Re:F the Flash garbage

[Maestro485]

OK, I'm going to just suck it up and be a n00b: What vulnerabilities exist to warrant blocking javascript? I only ask because I'm no web developer, but I have used javascript to make site building a little easier. I used one script to handle the common layout (essentially the so called "title" and "sidebar"), which left an html file consisting of a tag or two and the rest being solely content that is unique to a particular page.

The only alternative in this particular, albeit amateur, situation is to manually copy the static content to each file and then manually update each file when changes are made as opposed to editing a single .js file.

Could someone explain why this is a stupid way to do things?

Re:F the Flash garbage

[dbIII]

Flash is often less information than a BLINK tag and more annoying. On my 64 bit machine I run the 64 bit mozilla happily with no flash at all (people who really want to be flashed run the 32 bit version on their 64 bit systmes) - I just get the occasional annoying "download flash plugin" and skip the annoying content. Then again - I still occasionally use wget and lynx.

Google and DoubleClick

[Anonymous Coward]

...sites by way of DoubleClick's DART program...

Remember, Google is Good not Evil.

Tales of the Obvious

[flerndip]

I've seen shit as brazen as this for decades. Most notably the sort of poorly-constructed pop-ups that leave me thinking, "That would fool my mom. I need to warn her." When confronted by this sort of criminal code, I open the task manager and dump the browser entirely. Sure, I lose every tab I have open, and everything I was doing up until that point, but oh well. NEVER click OK if it's NOT OK.

yet another reason...

[fotbr]

to block doubleclick

Adblock, hosts file, iptables, surfing the net with lynx, etc. Pick a method you like and enjoy life without doubleclick.

Why aren't we blaming the browser?

[bhmit1]

Everyone is cheering for AdBlock when they read this, but why is it ok that a browser can install spyware, viruses, etc when you are browsing a web page? Shouldn't this be something that can only happen on sites that you explicitly permit or upon agreeing to a dialog asking if it's ok to run a given program? If you can experience this problem with double-click, then you can experience the same problem with any web site out there, so I'd much rather see us fixing the security holes in various browsers.

Re:Why aren't we blaming the browser?

[moderatorrater]

Flash is a plugin, it's what needs to enforce a security model. Also, sites need to step up and stop allowing exploitative ads. If an ad is clearly posing as a windows dialog box, then that ad shouldn't be allowed onto your site.

Re:Why aren't we blaming the browser?

[bhmit1]

Fair enough, we need to fix flash, not ban one of the unlimited number of sites that use flash. Of course, if individual users want to disable flash on their machine, I have no problem with that, but that shouldn't be the security solution for everyone.

And for ads posing as dialog boxes, I'd want to see a window manager that ensures the distinction is always clear. If a web page is able to alter the screen to the point that all you see is a "this workstation has been locked, please enter your password" screen without any window borders, then there's a security vulnerability of the browser and window manager.

The point being, fix the underlying issue. Security by censorship or security by blacklists doesn't work when you have a tool designed to connect to any computer on the internet.

Re:Why aren't we blaming the browser?

[bzipitidoo]

So much security is not practical. Why stop at the browser? Blame the OS too. And blame people for not making regular backups. Maybe all users should run SE Linux so a suborned browser can't screw up the system. Maybe the browser, and every other app, should be run as a different user, or in a chroot jail, or in a virtual machine. But of course few run SE Linux or any of those other measures because, sort of like Vista, it's a huge pain to have to constantly work through and around the security measures, not to mention set up and administer them. Doesn't make much sense to use proactive security measures that cost more time and money than the occasional reactive clean up job.

Re:Why aren't we blaming the browser?

[Sloppy]

I agree with you. If loading a page is dangerous, then the browser is already compromised. Complaining about the websites, seems silly to me.

But keep in mind this is Flash. The browser is already compromised, by the user installing someone else's binary. But yeah, browsers should probably defend against their own plugins.

Re:Why aren't we blaming the browser?

[cbhacking]

You're perfectly correct: the browser (and its plugins) shouldn't be allowed to do this. Running with non-admin permissions helps but your user data can still get badly fscked, user-mode programs can be installed and run silently, etc. You need tighter restrictions, like not allowing the browser to access most of the hard drive under normal conditions.

Sounds like a good reason to use Protected Mode on Vista or to set up an AppArmor profile on Linux: Specifically restrict the browser's permissions. Protected Mode makes this pretty easy, but isn't configurable and isn't available for other browsers.

As a side note, IE7Pro (works on IE6 too, sort of) has ad filtering and flash blocking features, for those who would like AdBlock/FlashBlock functionality (a lot else too, but that's mostly all I use it for) but don't always use Firefox.

Re:Why aren't we blaming the browser?

[bhmit1]

So much security is not practical. Why stop at the browser?

Because the browser (or in this case flash) is processing untrusted input, plain and simple. If you're going to work with untrusted input, you need to do it securely, be it via filtering the input or using a sandbox. If the browser is so insecure that you need to run it on a hardened OS or inside of a VM, then maybe it's time for another browser.

Allright, I give up... Adblock time

[philmack]

So after so many years I just now installed ad block plus. I never went through with it before because I would occasionally click on an ad... maybe every other month? I never felt bad about it because those ads were usually on the developer sites that I use constantly... if clicking their ad can give them a few cents and give me some information I need, I've more than paid for my individual usage of their site.
But if the biggest names in advertising cant keep their act together, then I just don't see how anyone can justify allowing ads any longer.
~Phil

Are you surprised? Risks of client-side scripting

[Anonymous Coward]

The risks of client-side scripting that use unsafe languages (including Flash and its ActionScript) make the extra functionality not worth it to me. If you want to be safe, disable scripting and live without it, or use NoScript. I hope some day scripting will become safe, but it clearly isn't now.

Doubleclick could fix this in 2 seconds

[oni]

From TFA: The malware looks like a ordinary Flash file, with its redirect function encrypted, so that when publishers upload it, the malware is not detectable.

All Doubleclick has to do is require the actionscript source code for all ads. There is *no good reason* for an advertiser to hide anything from doubleclick. Send doubleclick your sourcecode. They will compile it into a .swf file. If you don't like that policy, then you can find another distributer for your ads. If your actionscript is so convoluted or obfuscated that doubleclicks programmer can't figure it out, then you can wait in line until the programmer can figure it out, or you can simplify it.

Problem solved.

Re:Doubleclick could fix this in 2 seconds

[Osurak]

Good plan, except for the part where Doubleclick would never do that as it would cut into their bottom line.

Re:Doubleclick could fix this in 2 seconds

[Anonymous Coward]

Isn't decompiling an swf file into actionscript, and other elements, as simple as clicking a button, if you have a Flash decompiler? If they have the SWF they already have the source is my understanding, though I could be wrong.

Re:Doubleclick could fix this in 2 seconds

[marcosdumay]

Well, alternatively, they can only display images...

Re:Doubleclick could fix this in 2 seconds

[elchuppa]

Having the source code doesn't automatically mean you can detect funny business. There can be heavy layers of obfuscation that makes source code just as unreadable.

Re:Doubleclick could fix this in 2 seconds

[QuietObserver]

I can't speak for Flash, because I have no personal experience with Flash programming, but I have disassembled computer software in the past (taking raw machine language and translating it into assembly, which is similar, though certainly not identical, to what a decompiler does). Generally the problem with such tactics is you have no comments to rely on to determine what any part of the code does, so you have to analyze the code line by line to determine what it's doing, often forcing you to make guesses. Requiring the source code gives a company a means to analyze the code they're looking at without worrying as much about guesswork, unless the comments are bad (or worse, nonexistent), at which point the ad provider could reject the ad for insufficient documentation.

Yeah sure

[gerf]

When you find a company that allows people to use their copyrighted material however they want, and also takes responsibility (monetarily and apologetically both), for their own mistakes, let me know. And they have to still be in business, that is..

the common denominator

[FudRucker]

the common denominator in all this is MS-Windows, get rid of windows (if possible) and you will be much better off with an immunity from this sort of infection, use some variation of *nix (BSD of Linux) and as others in this article commented using AddBlock & NoScript extensions on Firefox is your best bet at stopping this sort of thing...

Re:the common denominator

[marcosdumay]

Linux have that same problem. It comes from Flash, not from the browser.

It is just not attacked (as far as I know) by those specific ads. But it is still vunerable.

Get a Mac

[Anonymous Coward]

Sigh

Kent Brockman

[FriendOfBagu]

I think Kent Brockman already reported on this:

Even as I speak the scourge of advertising could be heading to your town. Lock your doors, bar your windows, because the next advertisement you see could destroy your house and eat your family!

Popup? Click the red X square.

[pentalive]

Since I can't trust any of the buttons in a pop up, I usually close them using the red X square, We call it the "Go Away Box" around here, so I've forgotten its given name. Will this work for this kind of ad? I am thinking it's safe because my OS is putting that button on a frame around the ad's window.

First site on my block list

[HangingChad]

Note to self: remember to program Adblock to reject everything from DoubleClick from now on, on all home computers.

I use Adblock and NoScript on Firefox. Doubleclick is the first site on the block list in both apps. That's why I couldn't figure out why Google wanted to buy them.

problem is actually javascript not flash

[schneidafunk]

FYI - Flash can call javascript within actionscript code. The only reason to use flash for this hack is to hide the javascript code from reviewers, since it's illegal to decompile an swf.

Re:problem is actually javascript not flash

[John Hasler]

> ...it's illegal to decompile an swf.

Please cite the relevant law (and no, it isn't the DMCA).

What in the world...

[DoktorSeven]

(First, Slashdot: why does the Reply button for a new comment have to be a button? I want to reply in a new tab, and I can't open a new tab from a button.)

Now the main issue: What's up with the article link? hhttp:wwwwiredcomtechbizmedianews200711doubleclick doesn't look like any URL I've ever seen.

broken link

[Anonymous Coward]

Someone broke the link

Concrete proof that nobody RTFA on Slashdot

[Anonymous Coward]

Because the link is invalid (missing all punctuation marks in the URL) and nobody even notices.

CORRECT Wired address

[JavaBear]

The one in the article is broken

http://www.wired.com/techbiz/media/news/2007/11/doubleclick

Google hole that allows a similar attack

[Animats]

There's a related hole in Google Maps, an "open redirector", that allows this exploit. Here's an example:

Caution - hostile URL Close the page displayed; don't click on anything on it. .

Note that it fools Slashdot, and most link scanners in spam filters, into accepting the URL as leading to "google.com". But, in fact, it redirects to the "malware-scan.com" hostile site, which will try to install an Active-X control.

We've been finding attacks like this up with SiteTruth, by using PhishTank information to down-rate sites that have open redirectors. We've found open redirectors on Google and AOL. They're actively being exploited.

So we're currently down-rating Google, and AOL.. It may seem drastic to downrate an entire major site because they have a few "minor" exploits. PhishTank itself only blacklists specific hostile URLs. But that's no longer enough. Most modern phishing attacks use a unique URL, and often a unique subdomain, for each user attacked. SiteTruth thus takes a harder line. If a domain hosts something one of the data sources says is an attack, it downrates the whole domain automatically.

It's within the power of the site operator to close such security holes. We encourage them to do so.

Re:Google hole that allows a similar attack

[mqduck]

Google has already acknowledged this problem.

At least back to 2004

[Kelson]

Yeah, I immediately thought of a set of malicious ads that triggered an IFRAME exploit back in 2004. The Register found them on their own site, pulled the ads and apologized to their readers. The Internet Storm Center did a pretty good write-up of the incident.

The Problem is Ubiquitous

[yintercept]

The problem isn't unique to Doubleclick. It exists anytime you have multiple parties producing dynamic content for a site. The producers of Malware seek out every opportunity to inject their slime onto the net. If you have a forum, guestbook or allow comments on blogs, you will get hit by bots trying to find ways to inject malware into a post. The people playing this game buy expired domains and fill them with malware garbage.

If you look at the logs for any web site, you will probably find hits from malware distributors trying to find ways to hack in and inject their poison.

I suspect that thousands of links on posts from slashdot go to sites that try to do wrong. Undoubtedly the purveyors of malware have probably tried to inject their slime into Wikipedia.

I don't think the game of declaring any site that allows third party creatives an enemy of the people will solve the problem. A better approach to blocking sites like Doubleclick is to try and engage the people allowing third party creatives to develop better ways to monitor and reduce the malware problem.

We also have to accept that there will never be a perfect way to stop malware and the creators of malware are very good at adapting.

Banner attacks started as early as 2004

[1sockchuck]

In reality, these kind of attacks have been happening for years. Netcraft first reported on banner network hijacking more than three years ago, in August 2004, and cited similar attacks that may go back as far as 2001. High-profile sites that have been affected almost from the start. In November 2004, the web sites of The Register, NBC/Universal, The Golf Channel, The A&E Network and Sony Pictures Digital were used to distribute malware.

Who broke the link?

[LWATCDR]

"hhttp:wwwwiredcomtechbizmedianews200711doubleclick"
Is so not a valid url.

Re:Drill-Down Explanation of Terms

[wordsnyc]

I have three low-end Dells running Linux.

They say they'll be waiting for you in the parking lot.

chain of responsibility

[SuperBanana]

And speaking of "trigger-happy", you seem to point the finger right back at the Web sites for not inspecting the ads and the underlaying code. Well, that's what they hire DoubleClick for,

And who decided to hire DoubleClick, instead of (as you mention) Google AdSense or a hundred other advertising networks, all of varying reputation, levels of annoying-ness, etc? Who negotiated the terms of the contract, which could have required vetting of ads by Doubleclick? Who had the power to chose between text, GIF, and Flash based ads? Who benefits financially from the presentation of those ads?

So, again tell me who is responsible for ME getting an infected PC visiting that website? If GM makes a car and the wheel falls off because Bob's Bolts sold them defective bolts, I can still sue GM for selling me a car on the reasonable assumption that GM would test bolts before putting them in a hundred thousand vehicles...and GM made the decision to buy from that particular supplier.

The way the world works is: I sue GM. GM then sues Bob's Bolts for damages (ie to reputation, the money they had to give me and spend on legal defense, cost of recall, etc.) Bob's Bolts then may sue Smith's Steel for selling them crappy steel.

Or, in this case: I sue The Economist for infecting my machine. The Economist turns around and sues Doubleclick for providing malicous ads. Doubleclick may then turn around and sue the company that made the malicious ads, for violating the terms of contract with Doubleclick specifying no malicious content...

Re:chain of responsibility

[Anonymous Coward]

And who decided to hire DoubleClick, instead of (as you mention) Google AdSense

DoubleClick is OWNED by Google. NEXT....

Re:chain of responsibility

[cstdenis]

Most ad agencies carry each other's ads. I have used many ad agencies over the years, almost all of them show at least some ads from doubleclick.

Re:chain of responsibility

[nosferatu1001]

Is being investigated by the EU competitions commision, which may block the sale.

NEXT

Re:chain of responsibility

[hadaso]

> I sue The Economist for infecting my machine.
> The Economist turns around and sues Doubleclick ....
> Doubleclick may then turn around and sue the company that made the malicious ads ...

What's happenning here is a CRIME. So you file complaint at your local police department which (hopefully) ionvestigates it (or the FBI or whatever investigates) so they question The Economist that blaims Doubleclick that blames the company that made the malicious ads that turns out ro be an intermediary that point a finger elsewhere and eventually everyone is guilty of a little bit of negligence but not enough to be punishable by a court of law, and somewhere along the line the chain breaks or leads to some jurisdiction that is not entirely unreachable but is not practically reachable do to such limitations as budgets of law enforcement agencies.

So the criminals won because they invented distributed crime: no one is punishable because everyone's part is too small to be punishable. Criminal law is quite helpless dealing with crime that is broken into such small parts that no single reachable entity can be blamed for playing a significant role.

In Soviet Russia

[Scroatzilla]

...the monkey punches you.

Re:Drill-Down Explanation of Terms

[Anonymous Coward]

I'm not sure if the adware/spyware is so discriminating that it can tell your custom-built, water-cooled, polished wood super-duper high-end PC from an ordinary Dell machine. At the end of the day, your machine has pretty much the same CPU chip (from Intel or AMD) and mostly the same motherboard chips.

However, it's worth noting among large corporations that look for a three-year life out of their computers, Dell is the leading provider of hardware. Among which tech community are "Dells are renowned in the tech community as often technically poor machines stripped down to bargain components in order to keep the sticker price low".

Adding insult to disgust to injury...

[JRHelgeson]

PayPal has a "Virtual Debit Card" that you can use to access your PayPal account. Prior to downloading the software, you're asked to verify your system requirements. If everything checks out, you can then download and install the software.

Here's the rub - when you click on the "Download Now" button, it actually sends you to DoubleClick.net site. Then the DoubleClick.net site redirects you back to the PayPal site and starts downloading the application. If you have DoubleClick.net blocked in your hosts file, like I do, then you can't download the software.

Why?

It is so that DoubleClick.net can plant a first-party cookie, spy on your activities, direct advertisements to you... PayPal has just submitted ALL your information AND the fact that you use PayPal, AND the fact that you purchase stuff online, AND, AND, AND... Then DoubleClick.net can target you for highly targeted advertisements.

This is just unconscionable. PayPal deserves all the flame they're gonna get over this one.

Re:Adding insult to disgust to injury...

[Anonymous Coward]

Configure Firefox to delete all cookies on exit. You're now a new user every time you start your browser. Add a few exceptions for sites where necessary (like your personal website and/or corporate website) and you're set. Problem solved.

Re:Adding insult to disgust to injury...

[JRHelgeson]

True, problem solved. Delete the cookie, no problem.
My point is that any trust PayPal had was destroyed the moment they redirected my browser... What else are they doing with my financial information?

I block some before they reach my router!

[TavisJohn]

Thanks to OpenDNS I can filter the worst of the worst advertising systems BEFORE the even reach my home! So it does not matter WHAT OS or browser you use. That way I can protect EVERYONE in my home from that DoubleClick crap!

Personally I feel that Flash adverts are too invasive. There is no need to use Flash! Animated GIF and other eye-catching techniques are far more effective.
And the WORST are the Flash adverts that make NOISE!!!! I find that just plain offensive!

BRAVO! Re:hosts file

[j-stroy]

I have been afraid of the ad servers, not only for the parasite risks, but also the stall.... ie adhosts actually have the site they are hosted on by the balls.. that is, if the ad don't load, the page don't load. Restrict the ad serving and you shut down most websites.. That is unless users engage in ad blocking.. and this nice hosts file looks good to me. Anyone warn against trying this?

"Binned"?

[Scareduck]

What does this word mean? Do you mean, "banned"?

Re:"Binned"?

[soliptic]

Binned = thrown in the bin = (Americanised -- er, sorry, Americanized) tossed in the trash

So, a metaphorical way of saying "discarded". Not "banned".

MLB.com is a legitimate website?

[Sloppy]

That's not what I heard.

Re:MLB.com is a legitimate website?

[Anonymous Coward]

A couple days later MLB.com actually sent everyone an email explaining the possibility that old files might not work and offering new (free) downloads to anyone affected. But that's not interesting so it doesn't get reported.

Good news

[Anonymous Coward]

Finally a chance to get spammers out of business:
1) consumer class action suit against the large hosting web site(s)
2) in defense large hosting site has to sue DoubleClick
3) in defense DoubleClick has to sue the life out of the spammers.

just another reason to go to Linux

[rgiskard01]

Just another reason I am on the Microsoft colonic program!

Linux Mint
Firefox
Adblock Plus
No Script
Customize Google
Safe Cache
Safe History

Couldn't be happier with Mint, Open Office, Compiz, Thunderbird, etc.!

s/like a Dell/running windows/

[SpaceLifeForm]

The hardware is not the problem.

Ads track user names across different sites

[Anonymous Coward]

I think its bad enough that ads install spyware on your computer for the purpose of recording your usernames across different sites... I wouldn't mind so much if it was just marketing statistics they were generating... but when they call me on the phone about my anonymous posts...

So which agency determines which company has the right to install spyware on our computers?

This whole thing is phoney to begin with.

[jskline]

The whole issue of banner ads, spam in your inbox, etc., is DON'T CLICK THE LINKS! DON'T PATRONIZE THEM! You donkoft!

I think the video said it rather succinctly by demonstrating the idiot went and clicked on a banner ad. Sorry I didn't see anything unusual that I don't normally see and I click the RED X to get rid of it.... or better yet; stop using Internet Exploder!!!

Firefox rulz!!

or using DNS

[sakdoctor]

If you have a couple of computers on your home network, then a centralised way of achieving the same thing would be to run your own DNS server.

http://www.deer-run.com/~hal/sysadmin/dns-advert.html

Also beware system slow downs when using the windows DNS client combined with a large hosts file.

Re:or using DNS

[kiehlster]

Yes! I'm not the only one smart enough to set up my own lan dns server! I set myself up with a dnscache and tinydns server on my router box, then I just point all ad services and sites I hate to my basement web server where I translate the requests into "ad blocked" images. Unfortunately, I wish facebook and apple would stop using Akamai's EdgeSuite (edgesuite.net) to host their stylesheets. I'm forced to endure spamvertising because of that fact. Why do big companies have to outsource static hosting anyway? Are they really that pressed for bandwidth?

That's just to remember...

[marcosdumay]

That Java also have to be fixed. It is sligtly better, but signed sites can do anything they want to your computer (it's a feature, not a bug!).

Browsers should block plugins by default.

I saw this on Economist

[Anonymous Coward]

I was reading economist.com a few days ago and had two of these things pop-up... kind of scary actually... I guess I have to dial one click back on usability, and one click up on security... sigh...

once in awhile....

[zogger]

..there's a decent use for the law system, this might be one of those times. They would vett the ads better once they lost a big class action lawsuit, along with all the bad publicity.

Re:Drill-Down Explanation of Terms

[Anonymous Coward]

Oh hay cheeseburger. Nice troll, not that it's hard on slashdot. You should come back to k5 where there's more of a challenge, it's totally not dying or anything.

Re:allmusic.com as well - mod parent up

[Anonymous Coward]

My thoughts exactly. As soon as I saw this thread I searched for allmusic and found your post... I knew I couldn't be the only one.

" there are lesser minds who opt for Opera?"

[Anonymous Coward]

LOL! Ok, sure... lesser minds like to surf faster, & more securely, than they do with other browsers (AND, have all the features other browsers needs addons (which MAY or MAY NOT BE SECURELY CODED mind you)) to do!

Evidences?

====
SECUNIA DATA ON BROWSER SECURITY (dated 10/20/2007):
====

Opera 9.24 security advisories @ SECUNIA (0% unpatched):

http://secunia.com/product/10615/?task=advisories

* NETSCAPE 9.0.0.3 also qualifies here, as does Opera, with 0% unpatched known bugs/issues!

----

FireFox 2.0.0.9 security advisories @ SECUNIA (25% unpatched):

http://secunia.com/product/12434/

----

IE 7 (latest cumulative update from MS) security advisories @ SECUNIA (40% unpatched):

http://secunia.com/product/12366/

----

Those %'s are the latest for FireFox 2.0.0.9, Netscape 9.0.0.3 (decent one but not as natively fully feature packed without addons as Opera is, nor is it as fast overall), & IE7 after last "patch Tuesday" from MS with the "CUMULATIVE IE UPDATES" they have (see the security downloads URL I post in the 12 steps above to secure yourself), & Opera 9.24...

All latest/greatest models.

So, as you can see?

Well, NOT ONLY IS OPERA MORE SECURE/BEARING LESS SECURITY VULNERABILITIES?

It's faster too, on just about ANYTHING a browser does, & is probably the MOST standards compliant browser under the sun (not counting HTML dev tools). This is borne out in these tests:

http://www.howtocreate.co.uk/browserSpeed.html

AND, yes others (most recently in Javascript parsing speeds, oddly enough, lol... given the topic of my post here that is), right here:

http://nontroppo.org/timer/kestrel_tests/

Opera's just more std.'s compliant, faster, & more secure than the others... so, "where do you want to go today?"...

APK

P.S.=> We "lesser minds" of the net can only present the evidences noted above, vs. your great name-tossing wisdom... lol! apk

Symantec reports yet another Google hole

[Animats]

Here's yet another redirection exploit on Google, reported in a Symantec security bulletin. This one exploits redirection in the "I'm Feeling Lucky" feature.

Yahoo, too...

[Keith_Beef]

Tonight I visited Yahoo mail.

My browser window shrank and moved, and a pop-up window wanted me to visit http://scanner2.malware-scan.com/3_swp/?aid=threw6ar_ma3&lid=&ax=1&ed=2&mt_info=4961_3078_11003 in order to rid my computer of viruses and malwares...

Beef.