Malware Delivered By Yahoo, Fox, Google Ads

WrongSizeGlass writes "CNET is reporting that Avast has tracked over 2.6 million instances of malware that have been served up to unsuspecting web surfers since last December by ad services such as Yahoo's Yield Manager, Fox Audience Network's Fimserve.com and even some from Google's DoubleClick. Some high-profile sites include The New York Times, Drudge Report.com, TechCrunch and WhitePages.com. The practice has been dubbed 'malvertising.' I usually suspect the users of 'careless web activity' when I delouse a PC, but now I'm going to have to give some the benefit of the doubt."

Comments

Yup....seen it.

[Em Emalb]

At my work, we allow unrestricted access to the net, but log everything. We had a recent spate of vundo variants come through, and when we went through the logs, almost all of them were via the NYTimes or Wa Post. Frustrating, when large companies like this make work for you. For the most part, the allow everything, log it and using IDPS on the front-end(s) has helped quite a bit.

Re:Yup....seen it.

[tivoKlr]

Having been an IT admin in my former life, and also having operated in a similar fashion to you, allowing unfettered access to the internet for our employees (it was a Fire Department, and the staff was there for 48 hrs straight, so allowing them some creature comforts such as facebook and youtube was appreciated). Having solid, centrally managed AV on each client machine, along with limited local user rights seemed to be effective.

I wish more facilities would take this tact instead of letting some firewall with a blacklist subscription slowly narrow the available internet to static sites that are considered "safe." True irony that advertising from some of these safe sites are now delivering payloads. Ironically, where I work now (not in IT), plenty of popup ads from news sites make it through, so I would assume we're vulnerable through this vector.

Re:Yup....seen it.

[Nos.]

I work in the security group and we had a few machines on our help desk get infected with the Antivirus Live malware. After some research, we determined that it came through a legitimate site (help desk site that emulates various OS... can't think of the name), or more specifically the ads on the site.

We do run WebSense, but this was a legitimate site that our help desk uses quite frequently. All machines were up to date with McAfee, but it was a new variation. We ran it through VirusTotal.com within hours of the infection and I believe there were only two on the list that picked it up at that time.

So it wasn't the fault of the user and it can't be blamed on our choice of AV vendor. Obviously we need a better way of detecting malware. McAfee does have Artemis, but it failed on VirusTotal as well.

Re:Yup....seen it.

[Em Emalb]

Obviously, the biggest hurdle we're having to deal with is user education. I've got a select few folks in various departments learning to work with ad-block and no script, but for the average person, it's hard to figure out what they need to unblock and what they can block with no ill effects. It's frustrating to them, and by extension, our helpdesk guys who end up fielding calls from the same people (over and over) with the same questions. Of course, the other issue we have is vendor lock in, with their stupid sites working correctly ONLY in IE. I hate that, but in my case (financial industry) it's so rampant there's nothing we can do about it except lock stuff down as best we can.

That said...these large companies that aren't paying attention to the ads their serving are just as at fault as any un-educated (or even educated) user is.

Re:Yup....seen it.

[Em Emalb]

aren't paying attention to the ads their serving are just as at fault as any un-educated (or even educated) user is.

Aw man. They're. Not their. And I make that gaffe while writing about un-educated and educated. Fail, thy name is Em.

Re:Yup....seen it.

[commodore64_love]

I run a program called "TeaTimer" that automatically blocks changes to your computer or registry. I'm not sure how well it works in a work setting, but for my home PC it's caught numerous browser-based programs from doing damage.

Re:Yup....seen it.

[ShadowRangerRIT]

Ouch. The two news sites I browse most often. Good thing I run AdBlock and NoScript, and I wrote myself a Greasemonkey script to rewrite all the internal links to point to the print-friendly (read: ad-free) versions of the articles.

Re:Yup....seen it.

[Talderas]

As I write this message, I am running a scan to make sure I just finished cleaning this virus off one of my user's machines. This user has TeaTimer installed, yet still got infected. It's rather odd, seeing as the infect piggybacks on some registry values. So either the user is mindless hitting Allow on TeaTimer, or the virus is circumventing it.

Re:Yup....seen it.

[Victor_0x53h]

I believe using TeaTimer would teach the average user to constantly click "Yes" without thought. As mentioned before this kind of security has a huge education barrier. I haven't run with TeaTimer since it was first introduced with Spybot, but my experience was pretty awful being prompted anytime anything was run.

Also if TeaTimer prevents changes to the registry prompted by some piece of crapware, said crapware has already been executed. What else has it done; how much protection does blocking changes to the registry really provide?

Re:Yup....seen it.

[tunapez]

What I've found to work is, again, unfettered access combined with some sagely advice on where to find safe smut(redtube,youporn,mega...), and setting up a sandboxie icon that looks just like a regular Firefox button. Whether it be masking the icon for sanboxing or to give them a blue E to start FF/Opera/Safari, I find giving less insight into what I'm doing and just making things seem like nothing has changed is the best policy.

Do muni FDs allow internet access outside of email and work site nowadays? I've set-up privately contracted, shared wireless hubs(VZ USB w/ old laptop & wireless-router) @ a couple stations in the past b/c all they got was work related net. Brother on the right coast concurs, his FD does not supply even 1 station/signal to access their department mail accounts. I was told, Internet has too many expenses and liability for the org to shoulder the costs everyday surfing. Add to that it's part of a critical system with lives depending on instant/unrestricted communication, it's paid for with taxpayer money(thus every log & email is available via a public records request) and the chit really gets deep when that Fck-A-FF MySpace page makes the 6 o'clock news.

Re:Yup....seen it.

[E-Rock]

Because of this we have enabled inPrivate filtering for IE8 via group policy (not the same as inPrivate browsing). It's an effective ad blocking tool. I hate that we have to block the revenue sources of the pages we visit, but when they're being used to deliver malware, I don't see an alternative.

Re:Yup....seen it.

[Anonymous Coward]

Thank you. I saw it but let it slide. I fought my last battle trying to explain that "downfall" was not a synonym for "drawback". They're words, which have meaning.

I don't object to people not knowing words, but I have a real problem with them using words of which they do not know the definitions. Ignorance is not a sin unless your arrogance prevents learning.

Re:Yup....seen it.

[jafiwam]

It's not the sites, it's the ad networks.

Go get a HOSTS file that blocks ads and keep it updated and pushed out on your network.

I see ZERO ads most days. When some new ad network annoys me, I go add it to my HOSTS file. The same thing can be done with the network DNS server without needing to modify machines.

Believe me, most people don't bitch (very much) about not seeing ads on the internet all of a sudden. They might be curious about it, but usually that's it.

Re:Yup....seen it.

[Skratchez]

I thought we were the mods. :ohdear: But yeah, follow Taco's law, rate down if it's irrelevant or interesting, not because you are the legendary grammar Nazi or if you disagree with a valid point.

Surprise! Oh, wait...

[bhamlin]

Really, who is surprised by this? What's the cost of an ad and fake credentials compared to getting a chance to infect millions of computers?

Re:Say No To Flash

[somersault]

Say no to unsolicited content altogether! Adblockers ftw.

Re:One lesson to learn

[Anonymusing]

FTA: "Users don't need to click on anything to get infected; a computer becomes infected after the ad is loaded by the browser."

Adblockers anyone

[Galestar]

Yet another reason to use ad blockers. I'm starting to think Firefox should come with it out of the box.

Re:Adblockers anyone

[Monkeedude1212]

The problem is that a large amount of money on the internet is made through advertisements. If Firefox gains marketshare, and starts with adblocking, thats tons of revenue stream being cut off. Google makes a lot of money through advertising, and they seem to be the only ones pushing for progress right now. I don't know if I'd want to go and reduce their income.

In Alberta - it's illegal to have a billboard on a Highway. Based solely on the idea that it causes more accidents because billboards are distracting. This isn't a direct attack on the speed limit, a major factor, or Alchohol, another major factor. Because attempting to control those other 2 factors would cause a huge upset.

Same with internet advertising, you can't just stop it all and make the world a better place.

Re:One lesson to learn

[julesh]

Never ever click an ad!

Clicking not necessary. I was infected with malware earlier this month without any interaction after visiting the Pirate Bay. An advert used javascript to redirect me to an obscure URL ( http://uqwaaa.in/cgi-bin/gjj ), which proceded to use a Firefox flaw of some kind to infect me. 3.6 doesn't seem to be susceptible, but 3.5.7 which I was running at the time *was*. The exploit installed a Firefox extension that randomly redirects links from google, yahoo and bing to advertising pages.

Adblocker

[wisnoskij]

I would like to support sites by viewing their ads but if it leaves you more open to viruses even on high-profile sites then it is not worth the risk.

Re:Adblocker

[jedidiah]

Yes. This goes way beyond being "merely annoyed". If it becomes a security issue then ads need to go in general.

This is another example of how "outsourcing" leads to loss of quality and control. If you are going to spam someone then you need to be in control of the relevant content. You need to take responsibility for it. That seems to be the real problem here. You end up needing to whitelist 10 or 20 scripting hosts for the average "legitimate" website.

Re:Much more profitable than click-throughs...

[julesh]

1) Flash-based Banner Ad
2) JRE Exploit (CVE-2008-5353)
3) Adobe Reader Exploit
4) Profit?

From what I saw when this happened to me:

1) Javascript-based banner ad
2) MFSA2010-01 (or something similar that was present in Firefox 3.5.7)
3) Mozilla extension to redirect links from google, yahoo and bing to a site of your choice
4) Site that serves large numbers of per-impression banners for dubious porn sites
5) Profit.

Re:Good thing

[bunratty]

In addition, you can also use the Plugin Check to make sure you have the most recent versions of plugins to decrease the risk of attack. And don't forget to turn on DEP for all programs and services on Windows.

The real defense line

[geegel]

The way I see it, no browser should be designed to require admin rights. All that it needs is a sandboxed environment for temporary files. When this mantra gets in the developers' heads, such exploits will no longer be possible. Of course, by that time, other type of exploits will be invented, but we'll cross that bridge when we reach it.

Re:The real defense line

[Neil Watson]

In UNIX one might try running the browser as another user via 'su'. That user could be isolated with no useful data or access. Probably some X permissions will have change to allow the browser to display on an X server owned by another user.

Could this be accomplished with Windows?

Re:The real defense line

[ShadowRangerRIT]

Well, the browser can lower its own privileges just fine. IE8 (and IE7 IIRC) run with lower privileges than a normal user for that reason. Even if you tell it to execute as admin, it programmatically lowers its privileges at runtime.

Re:The real defense line

[TheRaven64]

The problem with this approach is that the browser itself contains useful data - things like access to your Internet banking site, for example. Ideally the browser would create a new process when you navigate to a new site and chroot() that instance so that it can't get any access to the filesystem beyond that. That way, a compromised browser would only ever gain access to caches and passwords for the site that performed the attack. The wrapper would reparent each of these processes' windows into something that would give the appearance of a single application.

Re:The real defense line

[FlashBIOS]

Until that happens, check out Sandboxie. Sandboxie is a fantastic piece of software that I've been using for years on my browser (and more importantly at home, my wife's and son's). It is largely transparent, and regularly updated. And, it works with any software, not just the browser.

http://sandboxie.com/

Ars Technica

[Anonymous Coward]

And Ars Technica says I shouldn't block ads.

I repeatedly told their staff that I don't block Ars Technica, but I do block ad servers. If they want to send me ads let them server them from their own domain.

Sites resposible for ad-vectored infections should be hit with hundreds of small claims court lawsuits to recoup the costs to clean up the infections.

Maybe then they'll learn.

'careless web activity'

[John Hasler]

> I usually suspect the users of 'careless web activity' when I delouse a PC...

They are guilty of 'careless web activity': not blocking ads.

Re:'careless web activity'

[FlyingBishop]

Don't block ads. Use NoScript. Blacklists are easily compromised. Whitelists are much more difficult.

ORLY?

[SpicyBrownMustard]

Let's see here... an anti-malvertising/malware firm reporting lots and lots of malicious "bad things" being served up by those terrible pesky Internet ads... no agenda here. The report failed to follow-through and dig into the real problem with malicious payloads associated with online ads, the ad network daisy-chain. If network-A has no impression for you, you're handed off to network-B, which may have no impression and then gives you to network-C... and so on. As your impression traverses the daisy chain, the likelihood of hitting a low-tier ad network that allows any wanker with a (stolen) credit card to order millions of impressions increases... where the malware begins. We scan our ad tags daily, using two methods -- a dozens-of-times-an-hour service, and our own script on a minimally-protected PC. We've never seen malware from a advertising assets delivered by a top-tier ad network... when we see malware, it's ALWAYS from a provider down the daisy-chain.

Re:ORLY?

[John Hasler]

Why don't you think that the top tier services should be held responsible for the results of their daisy-chaining? They got paid for handing you off.

Re:One lesson to learn

[oldspewey]

Indeed, and for people browsing Fox News, you don't even need a computer to be infected.

OK, if the ad networks won't police this

[WCMI92]

Then we should start blocking the ad networks from our networks.

If lots of people started doing that, I wonder how quick Google, Yahoo, et all would start screening advertisers for malware?

Make the Ads Safe

[The Angry Mick]

I would like to support sites by viewing their ads but if it leaves you more open to viruses even on high-profile sites then it is not worth the risk.

Very good point, especially in light of Ars Technica's recent plea to users to stop blocking ads.

I, too, would be than more willing to disable the protective measures I've got in place, but as long as these sites rely on third party advertisers that are more concerned with eyeball collection than system security, we have a stalemate. If sites want me to see their ads, they have the burden of making sure the ads are safe (less annoying, would also be good). If I lower my guard out of "friendship" for a site, only to get a drive by download as a reward, I'm going to take it as a major breech of trust.

Makes it hard to meet them halfway

[MikeRT]

They complain about advertising revenues while they are serving up ads that contain malware. To someone who hates ads to begin with, that's like saying "we know you don't enjoy crawling over broken glass, so how about crawling over glass mixed with AIDS-infected blood and barbed wire?"

malvertising?

[Anonymous Coward]

how about badvertising?

Say NO to active content.

[Anonymous Coward]

That's why I am so pissed at site designers who go "lalala I can't hear you" whenever I request they make their site accessible without "active content" (i.e. Javascript, Flash, Java or even worse things).

It's nifty and all, but nowadays it's the main malware distribution mechanism. And you can't tell users "just switch off Javascript", because suddenly, half of the Web won't work (I do switch of Javascript: no, not NoScript. Just The Real Thing -- and for most, I'm even glad *this* half of the Web doesn't work -- but I can't tell a regular user to do the same). Heck, those $@#%! web designers even do regular links with javascript snippets for reasons inscrutable to me. Disgusting.

Advertisers? Do you hear me? I'll look at pngs, jpegs and gifs, even animated. I'll read text. but I won't even see your Javascript/Flash/whatever stuff.

There. Had to be said.

Privoxy

[John Hasler]

> Doesn't really help in a business environment - few adblockers allow you to
> deploy and manage them centrally. Frankly, it would make more sense to block
> ads at the firewall.

Privoxy does exactly that.

Re:One lesson to learn

[commodore64_love]

Yes becasue it is an established fact that Fox has no bias

STRAWMAN ARGUMENT. I never said that. What I said was that CNN, MSNBC, ABC, CBS, et cetera have a pro-government and anti-individual-liberty bias.

Point - They are ALL biased, therefore if you're going to attack FOX for bias, then you should be attacking all the TV media outlets for the same reason.

You can't tell the enemy from your friends...

[rickb928]

I have a running dialogue with a webmaster of a celebrity paps site (ok, sue me) about the various bits of malware that are being served up by her various advertisers. This began a few months ago, and it took a while before I figured out they could not be expected to know this was happening. She has tracked down the source of these adverts to an agency that offered her triple the usual rate. Now she knows, among other things, that if it's too good to be true, there is a reason why.

But, she and I have synched clocks so she can know to the few seconds what I got. She has to report back precise details to get her advertisers to figure out what happened, cause most of her direct advertisers are contracting out ads to other agencies, and they sell other ads, and the chain gets long and obscure in no time at all.

So far, she is helpful, but last week I sent her a screenshot of a nasty one installing that 2010 antivirus onto one of my virtual machines, and it turned out to be her oldest and most loyal sponsor, and an entirely legitimate ad that had gotten hijacked on the way to her server. Yup, her server is compromised, and some ads are being re-written on the fly from other sources. Makes sense to me, just another vector. This is not good - even honest webmasters are vulnerable, though she called in a team/favor to fix up her server, which is supposed to be monitored for this stuff. Oh well.

Is there any defense? I'm using VPC2007 to run browsers just to be able to look at the nasty stuff being inflicted on me (not the celebs, thank you) and I can't imagine the fun of doing this from my desktop. Ewww.

When the NYT is being used, we are past blaming the source.

Not to mention the waiting time I see for ad servers. I want the damned content I asked for, thank you, perhaps webmasters need to find a way to ditch slow ads and let us see what we wanted to in the first place, ok? Thanks!

Why I don't run ads

[KingSkippus]

Yup, I've seen it, too. I run a gaming web site that gets around 2 million page loads a month. A long time ago, I made a deliberate decision not to run ads. My rationale at the time was that I didn't mind paying the hosting cost because it's my hobby. Some people pay a lot on woodworking, some people pay a fortune on golf. My hobbyist indulgence is paying the monthly fee for a VPS to host the site.

A while back, when I needed more power for the site and the hosting costs went up, I made a deal to move the site (which was a MediaWiki-based wiki) to Wikia. They promised me that there would only be one ad on the site, that it would never be injected in the content, that it wouldn't be obtrusive, and other such things. After the site was moved, they proceeded to go back on these promises, and several more.

After less than a year, the other administrators and I decided to re-host the site ourselves, and ask for donations. Again, we don't run ads, and thanks to donations, I'm almost breaking even on the hosting costs.

Recently, someone pointed me back to Wikia's site. It is a tragedy. Aside from being woefully out of date, there were six or eight ads, including javascript and Flash ads that obscure parts of the screen and injected into the articles. Worst of all, some of the "malvertising" discussed in this article.

Here's what's kind of bad. Because Wikia uses SEO crappy games, their site still comes up on top of the search results in Google. (You should see the page titles, they're 10 or 15 words long.) I recently posted a message on the game's official forums warning people of the malevolent advertising, because I wanted to make sure people used the right URL for our wiki, and it was a good chance to reiterate how important it is to us to keep the site ad-free.

A week or so ago, one of the guys at Ars Technica ranted in an article about how people who use ad blocking are stealing content. It's the same argument I've seen higher profile people (Rubert Murdoch, I'm looking at you...) make the same claim. I said then, and I still maintain, that using ad blocking and Flash blocking is not just a matter of convenience, but a matter of maintaining the security of my system.

Fortunately, I like sites like Ars Technica, because they provide an alternate means of reading their content without "stealing" it, and I have a paid subscription to the site. However, as long as a site's only business model is advertising, I don't feel one iota of guilt in protecting my system. If they block content if ad blockers are being used, more power to them, I'll find another site to read.

But stories like this, stories I've actually felt first-hand, are why I support sites without advertising, I do what I can to opt out of advertising, and I don't force advertising on visitors to sites I run myself.

Re:Why I don't run ads

[Seedy2]

I saw the word "malvertising" and thought it was redundant. I have always considered ALL advertising to be malware. Including print and TV advertising. They are all an attempt to force me to view their message, which I neither want nor asked for, and block or delay me viewing what I want to see.

Re:Why I don't run ads

[kalirion]

Sure, just like highway billboards and road-side bombs are really similar, when you think about it.

I'm a professional Malware removal guy. Literally.

[_KiTA_]

I work at a pinch hitter Tier 2 Pay to Play tech support company that is outsourced to by several major ISPs.

I see these damned things all the time. Usually they come with names like XP Antivirus 2010 or "Vista Security Center" or somesuch crap. They almost exclusively look the same, and there are new names that appear every so often -- XP Antivirus 2010 was "Internet Security 2010" not too long ago, for example. I suspect there is a kit that these companies are using to make their products.

They are almost exclusively coming in from banner ads. Specifically they use a Flash ad that, after a few minutes, or upon webpage close, or mouseover, opens an infected PDF file on a random infected server. Google Chrome occasionally catches these domain names, usually they are IP addresses or something similar.

Flashblock is NOT foolproof (although it does help), as occasionally they just have the ad banner on an infected server that auto-redirects you to a PDF file immediately.

They are occasionally Java files instead, but almost exclusively they are PDF files.

They're actually getting very creative in their infections. XP AV 2010, for example, sets itself up as the handler for EXE files -- in order to remove it, you have to install Malwarebytes and rename the mbam.exe file as 1.com or something similar. You can also dive into the registry to fix the EXE thing, except if the program is running it will just break it again immediately. Either windows does not have support for hijacking the .COM support in Windows XP/Vista/7, or these viruses just aren't thinking to try yet. Once they do, then our options drop to "OS Reinstall", as you can literally not run anything.

Some of these programs install themselves in such a way that if you attempt to load Safe Mode, your OS will intentionally BSOD. Or, in at least one infection, the screen filled with ASCII smiley faces and didn't continue.

Combofix will also remove most of these, and usually with "Security Center" or "XP AV 2010" we give up and run Combofix immediately.

The solution to prevent future infections isn't to move to Firefox or Chrome -- these infect those just as easily, although Chrome seems to just crash it's Flash plugin instead. In order to fix these, you have to update Adobe Flash, Adobe PDF, and Sun Java to the latest versions. PDF is the most important, but not the only one. Better browsers won't work. Antimalware programs won't work. The only way to fix it is to patch the holes.

Ad CDNs have been a nightmare

[Coopjust]

Two weeks ago, someone asked me to reinstall Windows XP for them. Their disk was XP SP3.

I reinstall, and open IE to visit Windows Update

Instantly, I get a Vundo variant from a malicious ad attacking the out-of-date Flash Player that came with XP that installs without any user intervention whatsoever.

This only served to reinforce that I was right and not a webmaster/free content hating jerk when I block ads online.

Re:One lesson to learn

[somersault]

Does anyone know of an equivalent to having a hosts file that you can use in conjuction with a Windows or Linux DNS server so that you can just block sites at the actual DNS server rather than having to keep updating the hosts file blacklist on all clients?

Re:CUSTOM HOSTS FILES ARE THE SUPERIOR ANSWER

[geekboy642]

1 is flat-out false.
2 is technically correct.
3 is true.
4, while true, is pointless. A far better (and simpler, easier) job of this can be done with a local caching DNS server.
5 is the same as 4.
6 is stupid and wrong. Text editors that can easily handle 30MB of text are rare under Windows, and nobody should ever do that anyways.
7 is completely stupid. There might be bugs in Window's HOSTS implementation. If there are, they will never be corrected. An AdBlock bug, or a DNS server bug, will be corrected within hours at the longest.
8 is vacuously true.
9 is completely false. Any malware that doesn't have admin access can get it trivially, under any Windows platform. It is impossible to lockdown the HOSTS file to the point that an admin-level malware cannot interfere with it.
10 is entirely wrong. See 6), and inspect any modern ad blocker. They've had 3-click-to-block for years now.
11 is flat-out wrong. See 9).

It takes you over an hour to process one million db entries? That's shameful. What are you doing that takes 4ms per entry? And why wouldn't "cat HOSTS | sed -e 's/[\t ]+/ /g' -e 's/[ ]+$//g' | sort -dfu" be faster and easier than processing text in assembler?

Re:I'm a professional Malware removal guy. Literal

[mr.bri]

Yep. You don't have to click on anything to get infected. We've had a couple of our systems infected over the past couple of months. What scares me is:

1. We were running the latest version of Firefox
2. Acrobat Reader was fully patched (version 8, not 9. But, we have to leave the JS enabled)
3. Adobe Flash was up-to-date
4. Windows was fully patched
5. We have web filters
6. They got past 2 layers of IDS/IPS and 3 layers of antivirus scanners (different engines)
7. Users are NOT admins!!!

Since then, we have switched to a few new products and attempted to tighten things up even more, but these things have gotten incredibly complex. In one case, it was a triple attack. The Flash ad (0-day exploit) loaded an exploited PDF (0-day exploit) that took advantage of a 0-day IE exploit (keep in mind we use Firefox), which compromised the system. We have a nuke-from-orbit policy on any system we suspect has been infected, but what a waste of time!

It was hosted from a site in India. The user was on Yahoo's website (we've had 4 infections through Yahoo's ads). They did NOT click on anything!

Be very afraid!

Doubleclick too...

[Tteddo]

I fix PC's for a living and I have been seeing this too. Some people all the do is Facebook and they are getting "XP Antivirus" or it's variants, and I know there is no way they are doing anything. They all use Firefox, etc. The last 2 weeks I have been putting on Ad Block Plus and explaining to them what it does because I was having people get infected again in a manner of weeks after I clean it up the first time. I know that kinda sucks for website revenue, but what else is there to do. One guy got infected from Photobucket, and it was repeatable.

ad servers really shot themselves in the foot here

[Vorpix]

the biggest change this has for me is that it has moved installing adblocking software from just 'something i do for my personal computers' to 'something i do on any computer i touch, even professionally'.

it was the ad server's responsibility to regulate what they distribute. instead, they have just become an avenue for zero-day attacks that can spread across the web in no time at all. since they did NOT act responsibly in preventing this type of attack (really, is there NO review process at all on what they serve out to millions of people?), it falls on us, the users, to protect ourselves. when companies complain about lost revenue due to adblocking software, this is your justification.

Re:I'm a professional Malware removal guy. Literal

[E-Sabbath]

Same experience except: my sneaky trick is to install mbam on the infected computer, then run the same version of it off a flash drive. Surprisingly, it works.

Also, do you think using Foxit instead of Adobe might help? For that matter, setting PDFs to not auto-open?

Remind me

[sjames]

Why is it somehow un-ethical to block ads again?

Perhaps it's a good idea for big sites with a reputation to maintain to borrow just a bit from the old model where they sell ad space with an approval process directly to advertisers and serve the images from their own servers.

Re:One lesson to learn

[bipbop]

Guaranteed invalid? No. ~$ telnet 0.0.0.0 22
Trying 0.0.0.0...
Connected to 0.0.0.0.
Escape character is '^]'.
SSH-1.99-OpenSSH_5.0 NetBSD_Secure_Shell-20080403-hpn13v1
^]cl

telnet> cl
Connection closed.

Sue DoubleClick

[Animats]

A big class action against DoubleClick, etc. would be appropriate. They "exceeded authorized access", as defined in the Computer Crime and Abuse Act. That they got the attack from someone else isn't an absolute defense. The ad network obtained "something of value" for the attack. If they sent out one attack after they'd been informed, they were doing so "knowingly".

The ad network has the right to find and sue the source of the ad, but that's their problem, not the end user's problem. This is well-established law. In general, you can sue the party you dealt with, and they can sue the next party up the chain.

Re:I'm a professional Malware removal guy. Literal

[_KiTA_]

No, just run Combofix. Then MBAM. It'll fix it. It's a rootkit, which is blocking MBAM and Webroot from seeing it.

That's the most terrifying thing about these things -- they literally install as rootkits, without admin privileges, even on a fully up to date WinVista or Win7 box. UAC, Security Policies, etc do nothing.

It's no wonder Google got hacked by China.

Re:Time to blow you AWAY "geek wannabe"

[geekboy642]

1) Tell me: Does performing a lookup into a one-million-entry list require more or less CPU than performing a lookup into an empty list? The page will be parsed no matter what you do.
4) Dan Kaminsky's work is important. But the flaw he found is non-trivial to exploit, has never been discovered in the wild, and on a private DNS server is trivial to protect against. (Like, oh, say, using Source Port Randomization)
6) Okay, my mistake. Let's try that, open notepad, open some 30MB file. Oh, look at that. It's locked up. Two minutes later, it's loaded the file. That's certainly easier than the three clicks required to block an entire adserver with AdBlock.
7) What profanity? Is WebSense blocking me? Untwist your panties, grandpa. And again, Dan Kaminsky. One flaw renders the entirety of DNS unusable? I suppose you throw your car away when it runs out of gas, too.

As for your PS, I don't care what you call it. A file containing a series of organized entires in a regular structure is a database. The fact that it's not SQL matters not in the slightest. The fact that it takes you an hour to process this "not a database" with only a million entries is shameful, and the shell script I provided you would likely perform the same task in under a minute. Why so defensive?