Slashdot Mirror
Two Major Ad Networks Found Serving Malware
Trailrunner7 writes "Two major online ad networks — DoubleClick and MSN — were serving malware via drive-by download exploits over the last week, experts say, after a group of attackers was able to trick the networks into displaying their ads by impersonating an online advertising provider. The scheme involved a group of attackers who registered a domain that was one letter away from that of ADShuffle.com, an online advertising technology firm. The attackers then used the fake domain — ADShufffle.com — to dupe the advertising networks into serving their malicious banner ads. The ads used various exploits to install malware on victims' PCs through drive-by downloads, according to information compiled by security vendor Armorize."
What do you expect from a company called "Doubelclick"? I bet Googel tampers with their search results too.
Is this really the first instance of it?
I doubt they check the scripts before they are put up for rotation, and this is their chance to find a scapegoat. As long as they get paid, I doubt they care to check.
Steve's Computer Service, Hobbs, NM
One more example of why ad blocking has its security benefits. What's worse is that doubleclick and friends are used by pretty much every site out there including Slashdot. It's a shame that although a lot of people would be willing to support sites like Slashdot allowing a few ads to load occasionally; doubleclick just isn't trustworthy enough to allow that.
Sigs are too short to say anything truly profound so read the above post instead.
Ever since I've installed a host file (http://www.mvps.org/winhelp2002/hosts.htm) to redirect advertisers to my loopback, I haven't had any malware, spyware, or adware issues. I first started using the host file 5 years ago. With that in mind, I can't say I'm really all that surprised that advertisers would be the source of ad/spy/malware...
Oh wait... Google's doubleclick got tricked too.... okay, nevermind.
-The Anonymous Google Fanboy
Both of you should install it.
And who the fuck has their machine set up for "drive by downloads" in this day and age? After the last decade of headlines about malware? Really, what kind of idiot to you have to be to run a machine configured like that these days?
In the early days, yeah, shame on the malware people. But fool me 48120912312 times? Shame on me.
I could have told you that. I narrowed down the issue to MSN/Hotmail a couple days ago and was advising users to stay away for as long as possible/use adblock/noscript.
I've been dealing with removing this horseshit from end users pc's all week.
Something interesting I noticed was the malware authors were amateurs- they forgot to setup the fake HDD defrag malware to run at boot on any other user profile besides the one that was infected.
Made disinfection pretty easy...
That is why we have Adblock.
This is why I block all ads and all your moral arguments and begging be damned. Ad blocking is sensible risk management.
Slashdot: Failed Car Analogies. Amateur Lawyering. Anecdote Battles.
No, here's some prior art... http://msmvps.com/blogs/spywaresucks/archive/2007/02/18/591493.aspx
The trust model of online advertising is in my opinion fundamentally broken. A big part of the security model of the web is domain-based - e.g. the same origin policy - but this goes down the drain with third party ads hosted on yet another third party's server.
With online advertising it was for the first time possible to measure the effect of ad campaigns better than "how many saw it and did we sell more after it?" What did this bring us? "PUNCH THE MONKEY!", "LOOK AT THE BLINKING LIGHTS!", "BEEP BLOOP BEEEEEP!!!" and perhaps most insidiously it broke the domain-based model of trust on the web since everything had to be put on the advertising hosters' servers to deter click fraud and whatnot.
AdBlock doesn't just save you bandwidth and reduces the annoyance of browsing the web, it is also one of the best tools for avoiding drive-by malware from ads.
________
Entranced by anime since late summer 2001 and loving it ^_^
and sandboxes, and no script, and external firewall devices, and backup drive images from previous weeks
Seen a few people say they use Adblock and all, which is fine, but if you recognize that an ad-server can be compromised, then why not any other web server you visit? How many things are you going to block before it makes the web safe? So many all websites are useless? That's why I found NoScript more annoying than not. Too often I was just saying yes to so much it wasn't really that much more secure.
Much better to have secure systems inside than walls trying to block everything.
My MS messenger has been setting off the anti-virus alarms for several months now. They come in through the ads at the bottom of the main window.
For justice, we must go to Don Corleone
Just another reason to block all ads possible - as if we needed one.
"It's the height of ridiculousness to say for those 9 lines you get hundreds of millions."
For the very few oblivious people (esp on /.), here's your solution: Adblock
It's really just one more reason for me to not feel guilty about blocking ads. Sometimes I click on ads from sites which I trust and wish to support, but other than that, the hell with them.
DNA -- National Dyslexic Association
Because it's not the web server being comprimised per say. It's the Ad network either being fooled, or willfully putting up exploit code rather than any sort of hack going on. Also considering the turnover of data/files on an ad networks servers, it's much harder for them to keep this from happening
Normal people worry me!
Well there a better distro's but Ubuntu is best for doorknobs that say things like "Oh adblock your the greatest I want your juice".
No wonder my centrifuges were running crazy..
For justice, we must go to Don Corleone
NoScript isn't annoying at all once you get the hang of it.
Just click on the button at the bottom of the screen and say to allow/temporarily allow a site, then it won't interfere. You don't lose your protection by doing this; you allow the site you're browsing but still forbid the 3+ unknown sites which also have scripts in your page. These outsiders are where the problems come from, so you can allow the content without allowing the malware.
ad network should serve the images/text and a link URL, nothing more
stop letting advertising providers provide custom HTML and remote-load scripts/images into ads
The problem with IE is insecure defaults. A browser that allows auto-install by default is BROKEN.
People in glass houses, and all that.
The only time any PC I run has been compromised to my knowledge was a relatively recent drive-by download via a Java applet. The machine was running Firefox, and both it and the Java VM were fully patched. The machine was also behind a properly configured firewall, and running up-to-date anti-virus software and assorted security/privacy plug-ins in the browser. Unfortunately, none of that helps if you get hit by a zero-day exploit. Also unfortunately, I hadn't yet found where they moved the "enable/disable Java" functionality in Firefox 3.6, not that knowing that would have helped me much, because some tools I need for work actually do use Java applets and therefore the related plug-ins anyway.
BTW, I had just started browsing social news sites like Slashdot, opening a handful of tabs to normally reputable sites to read the articles (yes, really, some of us actually do). I'm pretty sure I got hit via either a third party source that AdBlock missed or a compromised comment on a blog post.
In any case, please don't kid yourself that this is only a problem for dumb Windows/IE users surfing for warez/pr0n/whatever. Just because you're running Linux instead of Windows, or Firefox/Chrome/Opera/whatever instead of IE, or visiting legitimate sites that are themselves not going to attack your system, that doesn't mean you're somehow immune. It just means you're a less likely target. Pride comes before the fall.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
I find it a bit odd that an extra "f" would have duped "the system". I believe what may have been happening is that human verification part of the equation could have been "hacked".
You create an account, you specify where the banner data lives, it gets submitted for an approval.
Except in this case whoever looked at the data saw "trusted" domain and figured everything is fine. Heck, the "fake" domain could have served an innocent javascript up until owners knew that banner got approved, then swapped out the script and off the drive-by script malware goes.
And then Google/Doubleclick detects bait-and-switch ("hey, we didn't approve this virus!") and it gets flagged.
Hyperom.com
This is a strong argument for blocking DoubleClick and MSN's ad server at the corporate firewall.
I've been seeing this for the past few months. First I was wondering where the "PC Antivirus 2010" virus was coming from (this one pretends to be an antivirus product). Then one day I saw it's popup from a random message board (googling for some information led me to that particular board). Since I was on my Fedora box at the time it didn't affect anything. However I traced it back to the ad that came along with the web page. Don't remember which ad network it came from though.
well its bullshit every time an add tried to install something the package manager won't open them. Shit I've tried every distro out there and I still can't open them up. What am I doing wrong can someone please help me. I really want to see all these cool things the rest of the world is experiencing.
This is exactly why iPad type "computers" are the coming thing. Locked down in a walled garden and simple to use. Few people *really* need a 'real' computer when a small "device" will do everything they need.
If they had to pay real money proportional to the amount of damages the situation would be completely different. Estimate them number of visits to poisoned web sites, multiply that by the amount of time required to check for and fix damage, multiply that by a real per hour rate for someone to check all the machines, triple the dollar amount for punitive damages and present them with the bill. If this would happen one time I guarantee that neither Google or MSN would ever let this kind of problem happen again.
The same goes for Gawker loosing all those passwords and emails. So it puts them out of business. So what. Someone else will be glad to take their place. Good riddance to the fools who think that security is an unnecessary cost.
Put lame car analogy about exploding tires/engines/electronics here.
Why is Snark Required?
That's why I run all my websites without scripts calling ads and calling all ads as images from the server its self. Users like you would have to block all gif files, and if you do that the sites are essentially useless (no navigation, etc.). If you don't want to at least view ads on my sites, I don't need your taking up my server bandwidth. I pull in 6 figures a year and the last thing I'm worried about, having had sites online since 1996, is loosing traffic of people using noscript and/or adblock.
Seen a few people say they use Adblock and all, which is fine, but if you recognize that an ad-server can be compromised, then why not any other web server you visit?
It's about risk mitigation, not necessarily risk elimination. Suppose website X has content I'm interested in, and iframes to three ads I don't care about. That's 4 risk exposures. If I allow X but not the three ads, then then I have reduced my risk from 4 exposures to 1 without sacrificing the content of X. It's not perfect, but it's better. To eliminate the risk, I would have to sacrifice X itself, but I choose to accept that risk.
Note, also, that allowing ad servers is riskier than allowing content servers. Content servers can host malware in two major ways: compromise of the site, or cross-site scripting and related attacks. Ad networks are subject to hosting malware via the same methods as content servers, but they also deliberately accept code from third parties that might be untrusted. That's a different vector which historically has much higher incidence of hosted malware than content sites.
[Posting AC because I used mod points. -- morty]
MSE + Chrome Incognito + Facebook Disconnect + Ghostery + Analytics Opt-Out + AdBlock
To expand on this; the job of an ad agency is to put you in touch with many groups who normally you wouldn't be in touch with. Preferably even groups who you wouldn't want to be in touch with. There's a differece between going to a place you trust which might be compromised and a bunch of such places having the chance to pay to get in touch with you.
=~ s,(.*),<sarcasm>$1</sarcasm>,g if any_point_you_wish();
This is why I use Adblock Plus. :/
Glad a friend of mine told me about it. Not like I've been to a lot of Doubleclick or MSN webpages recently... if at all.
How is this news? 90% of the Spyware I see comes from banner ads that redirect to malware.
Pick your poison:
1. Ad redirects upon load to Malware
2. Ad appears normal, redirects after X seconds to Malware
3. Ad appears normal, then redirects to Malware upon closure
4. Ad redirects to Malware upon specific click event (mouseover, clicking something in the page, etc)
Where Malware in this instance is 99% of the time a PDF exploit. And since Flash lacks basic security measures (such as, say, an option to refuse to run scripts in SWF files, or to refuse to open URLs without you clicking through, or...) well, you're screwed.
The solution is simple: Block Adobe products and cheap knockoffs (like Silverlight) from your machine outright.
The only 'safe' way to serve ads is from your own databases, after having thoroughly checked the ads to be displayed for any malicious behavior.
As I stated yesterday, and got modded troll for; you can only be the provider yourself. You cannot trust anybody else. You must act as the filter or else you will hurt your customer base.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
It's annoying because you recognise that the pages often need scripts from sites you actually don't want to enable (e.g. more and more pages need googleapis, even pages where it's absolutely pointless).
The Tao of math: The numbers you can count are not the real numbers.
Per what? No need to thank me, it's my job.
--
In case of emergency, dial 1-911-GRAMMAR
I started blocking ads when they started blocking me or my use of webpages.
Static banner ads were okay, but as soon as they started blinking, jumping, making noise, popping up or sliding in front, they were unacceptable and had to go. It's a simple as that.
Using Adblock Plus with NoScript have made sure I've yet to experience my first ad-borne infection.
"For every complex problem, there is a solution that is simple, neat, and wrong." -- H.L. Mencken (1880-1956) --
At the time Google bought DoubleClick, Google owned the advertisement network with the best reputation (Goolge AdWords/AdSense. Relevant, not-very-annoying text ads) and DoubleClick had perhaps the worst reputation (horrible flash banners, etc.) of them all. I couldn't understand why Google would buy that. Then again, these days Google is pretty horrible towards Ad publishers (closing or freezing accounts without offering any explanation, etc... If you aren't a big name, expect to get buttfucked by Google) while DoubleClick is decent-ish (they should really send their lawyers after dishonest advertisers more... But arguably that's the publisher's responsibility). So doubleclick screws the users but is good for the publishers, Google screws the publishers but is good for the users, both are pretty fine for advertisers. I guess it works out.
(Disclaimer: I work for an agency that does - among other internet related things - SEO, internet advertising and the like. I'm obviously not in any way assosciated with either of the companies unless you count the fact that we hold a number of Google certificates...)
MS for the security holes, MSN for the exploits. One stop shopping! We have you rooted the fastest! Where do you want someone to make you go today!
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
Personally, I'd be surprised at the discovery of an ad serving network that DIDN'T serve malware on the side.
I have never understood why advert networks allow their "Partners" to cross-load javascript, and other scripted media objects. If the advert requires a "phone home" script, then it should have that script hosted, and vetted by the advert network they are partnered with, rather than playing a shell game of spot the malware.
Any advert that tries to hot-load a javascript or other scripted media object should be immediately rejected. (it should be pretty trivial to catch such hot-loading attempts with a submission filter, same with loading PDFs, etc. Likewise the use of obfuscated javascript techniques should auto reject.)
There really is no reason for this, other than that the ad networks themselves dont trust EACH OTHER. (EG, they dont want their partners to get their 'oh so important' metrics data instead of them-- or rather, they want to get that data directly themselves, and dont trust their partners to give it to them quickly enough, or accurately. [the potential for the ad-host to screw over the ad-producer over faulty serving metrics would be outstanding if the ad producer had to rely on metrics recorded exclusively by the ad-host, but fuck them.])
Internet advertising is one of the few things about the modern internet that could actually stand to have a little multinational regulation imposed on it. (And then, purely technical regulations intended to greatly frustrate malware distribution, and nothing else.)
Yes a taxi is a car but you don't need a license to use one.
In the same tone: OSX is like using a chauffeur driving limo (but a male chauffeur since, well... you are gay)
BSD is like driving a bike through rain and wind because you damn well will be independent of those oil companies, then have everything delivered through your home with gass guzzling van's.
OS2 is like running that CV2, the ugly duckling BUT the cheapest car to do Paris-Dakar!
DOS is like riding the wheel from the B.C. cartoon.
Windows? That is like riding a nice posh car, in the trunk while the MS mafia is driving you towards whereever they damn well want to take you.
There you are, the ULTIMATE car anology.
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
Funny how supposedly "smart" people here are so desperate to believe whatever spin a random marketing droid/ad executive spews out just because they're employed by Google. Ofcource it must be because Google at its core is an open source company. Afterall Google search, maps, youtube, gmail and other 'money-making' products are open source. Yeah, that must be it.
and NoScript. Problem solved.
88x31 and 468x60 animated GIF's.
I'm going to implement ad blocking at the router level at my house....
Nobodies Prefect
Tidbits for Techs Technology Blog
I would have guessed AIDShuffle.com.
No wonder I saw a spike of GPcode infections at my workplace last week.....
New Economic Perspectives
There really should be a license requirement for using computers on the internet - you don't let unlicensed drivers on the road, do you?
The doctor is licensed. The accountant. The lawyer. The mechanical engineer.
Each are held to standards of professional competence and integrity.
But not the programmer. Not the geek.
Whoosh
You forget that we tried this before, many times and each time the general purpose computer won out because...
A large number of people only use 10% of their computers but it's never the same 10%. People require different things and it's always been cheaper and easier to do it with a "jack of all trades" device then try to flood the market with 100 different devices and OS's that never meet that 10% exactly.
Trying to tell me that computers will be made safer by taking away their function is like trying to tell me that cars can be made safer by removing their ability to turn right (we drive on the left hand side of the road here). In theory this does make our roads safer by stopping people from crossing over oncoming traffic but in practice all you end up with is most people doing dodgy manoeuvres to turn right when they need to. This is why most people jailbreak their iDevice, because it can't do what they need it to.
So the Ipad is doomed, either by a more functional tablet or lack of actual need for a tablet. Neither will it be safe with a large majority willing to open up security holes just to do what they want with it.
Calling someone a "hater" only means you can not rationally rebut their argument.
They don't, traffickers rarely posses more than a basic understanding of HTML.
n/t
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
One of my honeypot VMs I use for Web browsing got hit by that when I was visiting a top named site.
In my experience, now that a lot of users are not just running executables willy-nilly, compromised ad networks serving up malicious pages to try to compromise browsers or add-ons is the #1 threat in my book.
To drive the point home, I use AdBlock on the main machine I use for Web browsing. I have yet to see a single script related to PC Antivirus. In reality, AdBlock provides more protection than most AV utilities, because once the Web browser is compromised, most AV utilities are completely useless in detecting and stopping that.
This is exactly why iPad type "computers" are the coming thing. Locked down in a walled garden and simple to use. Few people *really* need a 'real' computer when a small "device" will do everything they need.
Such "locked down in a walled garden" devices will prove to be only locked down to the end user. The hackers and other various internet evil-doers will be able to pwn these devices eventually. but the end users, even the moderately tech-savvy ones will prohibited from doing anything about it either.
I have no sympathy for the suckers who got nailed by malware served by ad networks. Shit like this is why I block all ads and refuse javascript from sites I don't trust.
I write sci-fi for metalheads
Except that the iDevice walled garden has been broken already, and some of the newer exploits are actually browser-based. In many cases they're used as an easy way to jailbreak, but could likely be used for malware as well.
"Walled gardens" are not immune to exploits. They may have extra layers of protections, but an initial exploit followed with a privilege-escalation bump and they're done for. They may also be harder to "clean" in that regard as well.
On top of that, there's also the issue of data-protection and malicious apps. It's not like Apple-et-al actually goes line-by-line through the code of every app, and there have already been malicious apps in the iPhone Store, Android store, etc. IMHO blackberry seems to do the best at dealing with this as it asks *when an app tries to do something* whether to permit it (no, just now, or forever).
The scary thing about smart-devices and the "walled garden" is the path to obsolescence. iPhones are a bit better in the "keeps on trucking" aspect of things, but there are *plenty* of Android-based devices that will never see a current-gen OS and may be harbouring unpatched vulnerabilities.
All ad servers should be blocked from getting into a business unless there is a need to see them. Waste of bandwidth.
Strictly from a security standpoint, before I get into any moral arguments, Ad blocking is wrong, Script and Flash blocking is the way to do it. Blocking ads instead of scripts & Flash is like having your airport security block brown people instead of terrorists. It's ineffective and - now I'm getting into moral stuff - harmful.
Say you allow ads on Slashdot.org, and their ad provider is carrying an ad with a malicious script which you run across on your Windows work machine (of course Linux viruses are theoretically possible and there have been a few in the past, but I'm being realistic here). Say it exploits a Flash (or possibly even Firefox) zero-day vulnerability, whoops you're pwned!
At the same time, the sites you browse regularly and would probably like to support are no longer getting those fractions of a penny from you viewing ads.
Now say you block scripts and flash. No Flash object loads without your permission, so you get no Flash-powered ads (they're too resource-hungry anyways). But most sites don't use those and you're still seeing their ads, although the scripts in them won't run, but sites usually still get paid for this. You can browse Slashdot while allowing ads that don't require JS/Java or Flash. They're harmless JPEGs, GIFs or text ads.
By doing this you're also voting with your eyeballs by blocking annoying, intrusive or resource-hungry ads, while allowing benign ads. This is good.
"When information is power, privacy is freedom" - Jah-Wren Ryel
"Oh no, between you and the AC, you've mentioned HOSTS files twice. If you mention them a third time, the apk troll shows up, like a techno Candyman with Tourette's." - by gmhowell (26755) on Monday December 13, @01:47AM (#34532348) Homepage
You can ad hominem attack me gmhowell, but it never stands up very well vs. this list of points below in favor of HOSTS files, and certainly in the case of blocking ad banners (which I block them, good or bad, because of this list of ad banners that were shown in the past as doing what's happening in this current thread of malware being inside the code for ad banners):
HACKERS USE ADBANNERS ON MAJOR SITES TO HIJACK YOUR SYSTEM -> http://www.wired.com/techbiz/media/news/2007/11/doubleclick
THE NEXT AD YOU CLICK MAY BE A VIRUS -> http://it.slashdot.org/story/09/06/15/2056219/The-Next-Ad-You-Click-May-Be-a-Virus
NY TIMES INFECTED WITH MALWARE ADBANNER -> http://news.slashdot.org/article.pl?sid=09/09/13/2346229
MICROSOFT HIT BY MALWARES IN ADBANNERS -> http://apcmag.com/microsoft_apologises_for_serving_malware.htm
ADBANNERS SLOW DOWN THE WEB -> http://tech.slashdot.org/article.pl?sid=09/11/30/166218
For just SOME examples of how HOSTS can stop that (by blocking out KNOWN BAD SITES/SERVERS/HOSTS-DOMAIN NAMES, and yes, even blocking adbanners as shown below in my list of points in favor of HOSTS files).
So - You're once again MORE THAN WELCOME to disprove the list of points in favor of HOSTS files below, point-by-point where you see fit and especially vs. them all if you can, especially over AdBlock alone, or (since hosts does things adblock just cannot do that improve your online experience in both speed &/or security), over DNS servers alone (because HOSTS overcome weaknesses in DNS, as noted below, on many points):
---
18++ ADVANTAGES OF HOSTS FILES OVER DNS SERVERS &/or ADBLOCK ALONE for added layered security:
1.) Adblock blocks ads in only 1 browser family (Disclaimer: Opera now has an AdBlock addon (now that Opera has addons above widgets), but I am not certain the same people make it as they do for FF or Chrome etc.).
2.) HOSTS files are useable for all these purposes because they are present on all Operating Systems that have a BSD based IP stack (even ANDROID) and do adblocking for ANY webbrowser, email program, etc. (any webbound program).
3.) Adblock doesn't protect email programs external to FF, Hosts files do. THIS IS GOOD VS. SPAM MAIL or MAILS THAT BEAR MALICIOUS SCRIPT, or, THAT POINT TO MALICIOUS SCRIPT VIA URLS etc.
4.) Adblock won't get you to your favorite sites if a DNS server goes down or is DNS-poisoned, hosts will (this leads to points 4-7 next below).
5.) Adblock doesn't allow you to hardcode in your favorite websites into it so you don't make DNS server calls and so you can avoid tracking by DNS request logs, hosts do (DNS servers are also being abused by the Chinese lately and by the Kaminsky flaw -> http://www.networkworld.com/news/2008/082908-kaminsky-flaw-prompts-dns-server.html for years now). Hosts protect against those problems via hardcodes of your fav sites (you should verify against the TLD that does nothing but cache IPAddress-to-domainname/hostname resolutions via NSLOOKUP, PINGS, &/or WHOIS though, regularly, so you have the correct IP & it's current)).
6.) HOSTS files protect you vs. DNS-poisoning &/or the Kaminsky flaw in DNS servers, a
But this is not new or news, unless you've been surfing along in that state of bliss^H^H^H^H^Hoblivion most do.
I visit a few somewhat unsavory sites, mostly celebrity news sites (no, not the celeb pr0n sites, but my protests fall on deaf ears I know) and the occasional programming-on-the-edge blogs, and these will take ads from most anyone. For at least two years I've been sending the admins specific reports of malware-laden ad postings, and until the past 9 months or so all I got was silence or the rare "didn't happen" or "not MY Site, a-h@le" response. Yup, some of them figure I have the time to write up false URLs and make fake screenshots... Sure, and I'm poor cause I'm smart, too.
Since then, all of these sites have gone from ignoring or denying my reports to terse "thanks" or "shouldn't see that any more".
My least terse comments, from a celeb photo site, seem to show that the owner and admin has finally figured out that some of the ad networks they are doing business with are not vetting their customers. In particular, I reported a nasty piece from Doubleclick, and after a week, got confirmation that my report was accurate. Most disappointing was that one ad I reported seemed to be for a Fortune 50 company, but now we know that some of these malware-ads are totally fake, taking the ad copy and source for a legitimate ad and sprinkling it with nasty dust. Both I and the site owners are hoping that these legitimate companies will take note and go after the bad boys.
Neither the site owners nor I actually expect the ad networks to stop this. The money is too good, actually checking the ad code is too laborious, and apparently their virus checkers are worse than mine.
At home, I'm still running all my anti-stuff on all my machines. My wife sometimes asks me what an alarm means, and I point out the warning message. She usually responds "but honey, it's Facebook..." and I assure her the warning is real. Somtimes she says 'But I got this from blablabla site, they aren't dangerous", and I get to tell her it was probably an ad, not the actual site. She gets a little miffed, but hey, it's cute and now it's entertaining for me. Until they get through, then it's re-imaging time.
I'm looking forward to fully virtualized systems and near-instant recovery. Until then, it' an arms race.
But I'm still innocently believing that the major ad networks are unwitting victims here, and that they don't have a few sales types taking money to turn a blind eye and knowingly sell to miscreants. And yes, there is little difference between selling ads for 'V1@5^' and selling ads for botware, but there is a difference. Can we puth them both out of business? Doubt it.
deleting the extra space after periods so i can stay relevant, yeah.
http://tech.slashdot.org/comments.pl?sid=1907528&cid=34534170
So, you can answer there, Kalriath (as regards point on HOSTS files you do not like from my list of them there) - I didn't post that list that time here in this thread here http://tech.slashdot.org/comments.pl?sid=1907528&cid=34532574 , however, someone did copy one of my older posts on HOSTS from this site, and pasted it in as an AC reply... and the updated model is above - besides: You can tell it's not me, because it lacks the BOLDING for emphasis I typically use in my posts...)
However - There above in the 1st URL I posted which is the updated model of my 18++ points in favor of HOSTS files?
I cover your point on proxies (which NOT everyone uses, and anonymous proxies online for instance? Generally tend to SLOW YOU DOWN, badly, & I cover that much in that URL above as well - as far as internal LAN/WAN proxies too? They also slow you up, just not as badly as external ones such as what I note above, but I cover this in the URL above as well...))!
APK
P.S.=> So, Good luck, you'll need it in disproving the points in my list in favor of HOSTS files... Especially as you've tried that before & failed BADLY, here, on that very same note in the past as you've attempted to "troll me" on HOSTS files usage -> http://it.slashdot.org/comments.pl?sid=1687452&cid=32632240 and here too on your part, again -> http://it.slashdot.org/comments.pl?sid=1687452&cid=32589278 ... apk
And this is why I use Noscript in Whitelist only mode plus a very nice hosts file that gets updated regularly from the many online versions.
The funny thing is, I started blocking Doubleclick and other advertisers over 10 years ago while still on dial-up since they caused lots of pages to load very slowly. Put em in the hosts files and suddenly many pages loaded very quickly as they weren't waiting on doubleclick/other advertiser and never changed things.
Mod me up/Mod me down: I wont frown as I've no crown
Clicksor is notorious for these malicious ads. I ran a fairly old site that received tons of traffic. I wanted to use a network other than Adsense, so I picked Clicksor. The advertisers were running all sorts of browser hijacking tricks, from java vulnerabilities to annoying javascript windows to auto-load random pages.
Malware will always attack the EASIEST target.
THIS is why class action lawsuits against the offending malware serving companies needs to be instituted, starting at the biggest baddest adware serving companies. If DoubleClick serves Malware, it is their responsibility and they need to be sued into oblivion.
Take the profit out of serving ANYTHING to everyone, and start making it cost money, and you'll see the changes you want.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.
This happens quite often. Usually, the bad guys are quite sneaky as well. They start a campaign running on the ad network that is served the bad guy's ad server. During the normal week, Monday to Friday, the ads behave and do nothing malicious. Come the weekend, when the ad network has limited staff (or for some networks, only on call support), the bad guys change the ad to serve malicious code. If they make it through the weekend without getting caught, they change the ad back to the normal one before Monday morning.
Sometimes the bad guys will impersonate a reputable company, and they can be quite convincing about it.
The only real way to stop this is to make it so that advertisers cannot change active ads without them being reviewed by the advertising firm. That means ads only being served from the ad network's servers (which will not go over well with all advertisers), more staff to ensure ads are reviewed in a timely fashion, and a number of other changes that everyone needs to adapt to.
A software solution to spot and halt bad ads would be ideal. However, it is difficult for most antivirus/antimalware software to scan the ads for malware, because new stuff pops up all the time.
Andrew Borntreger
Champion of cinematic disasters
"Let me add one disadvantage of host files vs. AdBlock/NoScript & Co.:
The host file approach is completely unusable on machines where you have no root/admin access. And even on networks where you have root/admin access, but don't own the network and are not the one responsible for networking, you may get into troubles if you try to change host files." - by maxwell demon (590494) on Monday December 13, @03:51AM (#34532614) Journal
Hmmm, that's nothing that logon scripting cannot "cure" for instance, say via a HOSTS file copy + overwrite on the user's local workstation...
Plus, it's a GOOD IDEA to utilize "layered security harden" your "end points" too!
(Such 'endpoints' as user workstations & even departmental servers, not just using the "crunchy on the outside, soft & chewy on the inside" security measures paradigms).
---
"OTOH, Firefox plugins can be installed at the user level, without a need for root/admin access, and since user-installed plugins only affect the single user (i.e. you), they are much more likely to be accepted.." - by maxwell demon (590494) on Monday December 13, @03:51AM (#34532614) Journal
Firefox plugins problems, are just that - it's one of the 1st things my many points list in favor of HOSTS files covers in fact:
FF plugins are FOR FIREFOX ONLY!
Hosts cover ANY WEBBOUND APP, including external email programs like Outlook Express/FULL OUTLOOK from MS Office too... browser addons, like adblock, don't.
What's used in corporate environs HUGELY, for email (& AD access)? FULL Outlook!
Nice part is, they ALL work together, quite nicely (especially for layered security - I never note NOT to use Adblock for example, just don't use it alone).
See, ADBLOCK CAN BE DETECTED FOR:
See here on that note:
HOSTS files are NOT BLOCKABLE by websites, as was tried on users by ARSTECHNICA (and it worked, proving HOSTS files are a better solution for this because they cannot be blocked & detected for, in that manner), to that websites' users' dismay:
----
http://arstechnica.com/business/news...s-you-love.ars
An experiment gone wrong - By Ken Fisher | Last updated March 6, 2010 11:11 AM
"Starting late Friday afternoon we conducted a 12 hour experiment to see if it would be possible to simply make content disappear for visitors who were using a very popular ad blocking tool. Technologically, it was a success in that it worked. Ad blockers, and only ad blockers, couldn't see our content."
and
"Our experiment is over, and we're glad we did it because it led to us learning that we needed to communicate our point of view every once in a while. Sure, some people told us we deserved to die in a fire. But that's the Internet!"
Thus, as you can see? Well - THAT all "went over like a lead balloon" with their users in other words, because Arstechnica was forced to change it back to the old way where ADBLOCK still could work to do its job (REDDIT however, has not, for example). However/Again - this is proof that HOSTS files can still do the job, blocking potentially malscripted ads (or ads in general because they slow you down) vs. adblockers like ADBLOCK!
----
I also list a plethora of other things FF addons like AdBlock cannot do in my initial post here, that HOSTS files can, and what points about HOSTS files "Seal security problems" & other DNS problems, in DNS as well (acting as a great supplement to DNS in fact, especially external DNS servers (not ones in your local LAN/WAN for AD for example)).
You seem to be avoiding those, which only says that the points in my HOSTS file list in favor of HOSTS files is pretty solid!
APK
DoubleClick and MSN?
Let's just call it like it is, please.
Google and Microsoft.
Whoever posted my older list of points in favor of HOSTS files above here -> http://tech.slashdot.org/comments.pl?sid=1907528&cid=34532574 originally in this thread wasn't myself (note the lack of BOLDING in it? I use bolds, so you KNOW that's not myself, but someone using my older points in favor of HOSTS files).
NOW?
Well - You, like other "naysayer trolls here" are now welcome to disprove and debunk (good luck, many have tried here) MY 20++ points in the current model of my points in favor of HOSTS files, below (which I did predict would occur here in others trolling me on this, as it always does)
I suspect that's the case, on being trolled on this here, because HOSTS files put a MAJOR DENT into malware makers' heinous machinations vs. end users, as well as webmasters & advertisers' profits (so they HATE hosts files) - that makes my naysayer trolls here probably 1 of those types in fact I suspect.
APK
P.S.=> 20++ ADVANTAGES OF HOSTS FILES OVER DNS SERVERS &/or ADBLOCK ALONE for added layered security:
1.) Adblock blocks ads in only 1 browser family (Disclaimer: Opera now has an AdBlock addon (now that Opera has addons above widgets), but I am not certain the same people make it as they do for FF or Chrome etc.).
2.) HOSTS files are useable for all these purposes because they are present on all Operating Systems that have a BSD based IP stack (even ANDROID) and do adblocking for ANY webbrowser, email program, etc. (any webbound program).
3.) Adblock doesn't protect email programs external to FF, Hosts files do. THIS IS GOOD VS. SPAM MAIL or MAILS THAT BEAR MALICIOUS SCRIPT, or, THAT POINT TO MALICIOUS SCRIPT VIA URLS etc.
4.) Adblock won't get you to your favorite sites if a DNS server goes down or is DNS-poisoned, hosts will (this leads to points 4-7 next below).
5.) Adblock doesn't allow you to hardcode in your favorite websites into it so you don't make DNS server calls and so you can avoid tracking by DNS request logs, hosts do (DNS servers are also being abused by the Chinese lately and by the Kaminsky flaw -> http://www.networkworld.com/news/2008/082908-kaminsky-flaw-prompts-dns-server.html for years now). Hosts protect against those problems via hardcodes of your fav sites (you should verify against the TLD that does nothing but cache IPAddress-to-domainname/hostname resolutions via NSLOOKUP, PINGS, &/or WHOIS though, regularly, so you have the correct IP & it's current)).
6.) HOSTS files protect you vs. DNS-poisoning &/or the Kaminsky flaw in DNS servers, and allow you to get to sites reliably vs. things like the Chinese are doing to DNS -> http://yro.slashdot.org/story/10/11/29/1755230/Chinese-DNS-Tampering-a-Real-Threat-To-Outsiders
7.) AdBlock doesn't let you block out known bad sites or servers that are known to be maliciously scripted, hosts can and many reputable lists for this exist:
GOOD INFORMATION ON MALWARE BEHAVIOR LISTING BOTNET C&C SERVERS + MORE (AS WELL AS REMOVAL LISTS FOR HOSTS):
http://ddanchev.blogspot.com/
http://www.malware.com.br/lists.shtml
http://www.stopbadware.org
http://blog.fireeye.com/
http://mtc.sri.com/
http://news.netcraft.com
http://www.shadowserver.org/
REGULARLY UPDATED HOSTS FILES SITES (reputable/reliable sources):
http://www.mvps.org/winhelp2002/hosts.htm
http://someonewhocares.org/hosts/
http://hostsfile.org/hosts.html
http://hostsfile.mine.nu/downloads/
http://hosts-file.net/?s=Download
https://zeustracker.abuse.ch/monitor.php?filter=online
Spybot "Search & Destroy" IMMUNIZE feature (fortifies HOSTS files with KNOWN bad servers blocked)
And yes: Even SLASHDOT &/or The Register help!
(Via articles on security (when the source articles they use are "detailed" that is, & list the servers/sites involved in attempting to bushwhacker others online that is... not ALL do!)).
2 examples thereof in the past I have used, & not
Ad hominem attacks aren't valid in logical debate, & in attacking myself, rather than the points in my P.S. below?? You're guilty of violating that logical tenet!
"Picking on people on the internet is fun and all, but in cases where mental handicaps are clearly involved you should be more understanding. It's pretty clear that APK is likely quite autistic..." - by Anonymous Coward on Monday December 13, @04:45AM (#34532710)
Well, on THAT note?
You're also welcome to prove to us all that you have a PHD in Psychiatry to your name/credit, as well as a license to practice it professionally on YOUR part, and your years to decades of professional hands-on experience in that field (as well as a professional environs administered examination of myself by you, since you make your "sidewalk surgeon quack" snap prognosis' as you have here, lmao!)
Fact is, this: When I have you reduced to attempting ad hominem attacks &/or nametossing or ssaying I have "mental issues" as you have? That's when I KNOW I have done a great job @ putting you "trolling naysayers" into your place (in the garbage).
APK
P.S.=> Instead of that useless/effete method of trolling using Ad Hominem attacks directed MY way here by yourself?
Try disprove & debunk all of the points in favor of HOSTS files here instead (good luck, many trolls have tried, & failed (a few are even posting here in this very exchange, like Kalriath ( & I showed his failures in the past on that here too in replies to he, lol, no less - to "refresh his memory" on that account)):
20++ ADVANTAGES OF HOSTS FILES OVER DNS SERVERS &/or ADBLOCK ALONE for added layered security:
1.) Adblock blocks ads in only 1 browser family (Disclaimer: Opera now has an AdBlock addon (now that Opera has addons above widgets), but I am not certain the same people make it as they do for FF or Chrome etc.).
2.) HOSTS files are useable for all these purposes because they are present on all Operating Systems that have a BSD based IP stack (even ANDROID) and do adblocking for ANY webbrowser, email program, etc. (any webbound program).
3.) Adblock doesn't protect email programs external to FF, Hosts files do. THIS IS GOOD VS. SPAM MAIL or MAILS THAT BEAR MALICIOUS SCRIPT, or, THAT POINT TO MALICIOUS SCRIPT VIA URLS etc.
4.) Adblock won't get you to your favorite sites if a DNS server goes down or is DNS-poisoned, hosts will (this leads to points 4-7 next below).
5.) Adblock doesn't allow you to hardcode in your favorite websites into it so you don't make DNS server calls and so you can avoid tracking by DNS request logs, hosts do (DNS servers are also being abused by the Chinese lately and by the Kaminsky flaw -> http://www.networkworld.com/news/2008/082908-kaminsky-flaw-prompts-dns-server.html for years now). Hosts protect against those problems via hardcodes of your fav sites (you should verify against the TLD that does nothing but cache IPAddress-to-domainname/hostname resolutions via NSLOOKUP, PINGS, &/or WHOIS though, regularly, so you have the correct IP & it's current)).
6.) HOSTS files protect you vs. DNS-poisoning &/or the Kaminsky flaw in DNS servers, and allow you to get to sites reliably vs. things like the Chinese are doing to DNS -> http://yro.slashdot.org/story/10/11/29/1755230/Chinese-DNS-Tampering-a-Real-Threat-To-Outsiders
7.) AdBlock doesn't let you block out known bad sites or servers that are known to be maliciously scripted, hosts can and many reputable lists for this exist:
GOOD INFORMATION ON MALWARE BEHAVIOR LISTING BOTNET C&C SERVERS + MORE (AS WELL AS REMOVAL LISTS FOR HOSTS):
http://ddanchev.blogspot.com/
http://www.malware.com.br/lists.shtml
http://www.stopbadware.org
http://blog.fireeye.com/
http://mtc.sri.com/
http://news.netcraft.com
http://www.shadowserver.org/
REGULARLY UPDATED HOSTS FILES SITES (reputable/reliable sources):
why ads are bad.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
But all it takes is one unscrupulous person on the inside, and bam, you're out of luck if there's some mondo compromise exploit to your system.
Adblock is a door, it's not security inside.
Besides, the ad companies and the servers you visit have an incentive to get you to see the ads. If you don't see them, they lose money. So they're going to find ways to deal with the problem should it become prevalent. Right now it's not enough of a problem for them to deal with but at some point the balance may tip.
Seen a few people say they use Adblock and all, which is fine, but if you recognize that an ad-server can be compromised, then why not any other web server you visit?
They can, of course.
But a compromised website is just one site. A compromised ad network means thousands, possibly millions of compromised sites.
It's all about risk management. And the risk associated with a compromised ad network is far greater than the risk associated with a single compromised site.
No PayPal is evil because they stole aid for victims of hurricane Katrina contributed by Something Awful members.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
"Did your hosts file have adshufffle.com listed in it before you read this story? No?" - by Anonymous Coward on Monday December 13, @12:53PM (#34536048)
Actually, YES, it does... so much for that.
---
"What is needed is to completely disable DNS and use hosts for everything after establishing the correct address for each site you actually visit.?" - by Anonymous Coward on Monday December 13, @12:53PM (#34536048)
Nothing: Your systems' IP stack, by default (in Windows @ least, & I am pretty sure the same holds true for *NIX variants also) LOOKS TO THE HOSTS FILE, FIRST (after local DNS client cache OR diskcache caching of HOSTS),then it refers to other sources like DNS servers, etc....
See here:
http://support.microsoft.com/kb/172218
---
"Rather than try to block the millions of sites out there, permit only the hundreds or so you actually use." - by Anonymous Coward on Monday December 13, @12:53PM (#34536048)
Uhm, I do BOTH!
Fact is, my initial replies here notes it in the list of points I wrote down (up to 20 now in fact in the latest posts)...
I.E.-> That I use BOTH blacklisting of known bad sites/servers (for obvious reasons - I can't get 'burned' by what I cannot touch), & whitelisting of my favorite websites (for more speed, anonymity to a degree vs. DNS request logs & more).
(It appears you "skimmed over" that fact that I list using BOTH 'whitelisting' for more speed (vs. roundtrip inquiry time saved to DNS servers & their problems) & security/anonymity also (vs. DNS request logs)).
APK
P.S.=> The reason I block adbanners (both KNOWN BAD ONES, & even "good ones" (no such thing imo, as they slow you down at the VERY LEAST)):
This article today we're replying to, and these from the past:
HACKERS USE ADBANNERS ON MAJOR SITES TO HIJACK YOUR SYSTEM: -> http://www.wired.com/techbiz/media/news/2007/11/doubleclick [wired.com]
THE NEXT AD YOU CLICK MAY BE A VIRUS: -> http://it.slashdot.org/story/09/06/15/2056219/The-Next-Ad-You-Click-May-Be-a-Virus [slashdot.org]
NY TIMES INFECTED WITH MALWARE ADBANNER: -> http://news.slashdot.org/article.pl?sid=09/09/13/2346229 [slashdot.org]
MICROSOFT HIT BY MALWARES IN ADBANNERS: -> http://apcmag.com/microsoft_apologises_for_serving_malware.htm [apcmag.com]
ADBANNERS SLOW DOWN THE WEB: -> http://tech.slashdot.org/article.pl?sid=09/11/30/166218
apk
http://hosts-file.net/default.asp?s=adshufffle.com
It's (adshufffle.com) marked as bogus & in the HpHosts blocklist there @ HPHOSTS (see for yourself)...
Yes - it's a KNOWN bad one @ this point & that's 1 of a few sources I use for "verifies" of what does go into my HOSTS file!
So, yes - I have it listed in my custom HOSTS file as a blacklisted domain/host.
APK
P.S.=> I also store adshuFFle.com (2 f's, not 3 like the above one you noted) in my HOSTS file as well, as I noted in my other reply to you, as it serves adbanners, & per this article & this list?
This article today we're replying to, and these from the past:
HACKERS USE ADBANNERS ON MAJOR SITES TO HIJACK YOUR SYSTEM: -> http://www.wired.com/techbiz/media/news/2007/11/doubleclick
THE NEXT AD YOU CLICK MAY BE A VIRUS: -> http://it.slashdot.org/story/09/06/15/2056219/The-Next-Ad-You-Click-May-Be-a-Virus
NY TIMES INFECTED WITH MALWARE ADBANNER: -> http://news.slashdot.org/article.pl?sid=09/09/13/2346229
MICROSOFT HIT BY MALWARES IN ADBANNERS: -> http://apcmag.com/microsoft_apologises_for_serving_malware.htm
ADBANNERS SLOW DOWN THE WEB: -> http://tech.slashdot.org/article.pl?sid=09/11/30/166218
I don't trust them, any of them, & they slow me down + track me too? NO thanks! apk
Reading comprehension: failed.
Or, to use your style: Reading comprehension: FAILED!
I wrote: "You seem to assume ..." not "You wrote ..."
Which means that if you are no network admin (which was the scenario I was talking about), you cannot change it. Case closed.
No Windows here :-) Anyway, I'm just a normal user here, so I can't change the hosts file anyway. Which is just what I originally said: If you are no admin, you cannot change the hosts file, period. So you have to decide:
Either, you continue to claim that I'm wrong. In that case, you should find a place where I'm wrong.
Or you admit that I wasn't wrong. Which is probably the simplest. :-)
Or you continue to argue about straw men which I was never talking about.
That's my guess, too (I had hoped for some information about it on the page). However the methods I could think of don't depend on why the content wasn't loaded, but only on that it wasn't loaded. Therefore it wouldn't matter if the content wasn't there because of a hosts file, because of an ad-filtering proxy, or because of Adblock.
Indeed.
No need to shout. I never denied that. I just pointed out that it's not always possible, and that it also has limitations (actually originally I even only pointed out the first; for reasons I don't actually understand that caused you to reply with lots of bold and SHOUTING, and a "solution" which doesn't work exactly in the case I was talking about: no admin rights).
The Tao of math: The numbers you can count are not the real numbers.
Seen a few people say they use Adblock and all, which is fine, but if you recognize that an ad-server can be compromised, then why not any other web server you visit? How many things are you going to block before it makes the web safe? So many all websites are useless? That's why I found NoScript more annoying than not. Too often I was just saying yes to so much it wasn't really that much more secure.
It's called limiting your exposure.
Scenario A: Default install, runs every scrap of Flash / JavaScript / Java / Shockwave that it runs across as you browse the web. This might number in the hundreds of sites, or thousands over the course of a month. Only *one* of those sites has to serve up malicious script in order for your PC to be infected.
Scenario B: NoScript/FlashBlock or AdBlock with a whitelist of only 100 sites. You're still pulling in content from hundreds or thousands of sites each moonth, but unless the attacker infects one of the sites in your whitelist, nothing bad happens. So it's still possible to be infected, but you've cut your risk factor by 1-3 orders of magnitude.
Which is generally limited enough that you're not going to see many (if any) infections. Whitelisting works.
Wolde you bothe eate your cake, and have your cake?
This weekend I got one of those false alerts from a fake anti-virus program. I'm guessing I got it from one of these ads. I've never run an adblocker before, but I will now if ads going to start infecting me with stuff.
Coder's Stone: The programming language quick ref for iPad
Noticed that security-software scans became rather less necessary once I discovered the wonders of AdBlockPlus.
I think I started using it for reduction of garden-variety annoyance, but talk about a side benefit!
I listen to both RIAA and non-RIAA stuff if I like the music, tangential business/politics nonwithstanding.
I monitor the university network where I work and preach FF/AdBlockPlus to anyone who'll listen and even those who won't. The summary implies that the advertising is done through sleight of domain name to confuse the ad network, but that is certainly not always the case. Over the last 12 months we've had an escalating number of systems compromised due to "malicious ads" and it just keeps getting worse.
Antivirus tries to enumerate badness and is doomed to failure. The bad guys pack and modify their products constantly to avoid detection (there is enough money in it to be worth the effort). Heuristics have been promised by AV vendors for the last 20 years (from discussions back on the virus-l mailing list) with no noticeable improvement.
In order of decreasing importance:
- web browser with adblocker that prevents the advertisements from being fetched
- keep system and third party software (java, adobe, flash) patched
- don't login to windows as a user with admin privileges
- run antivirus
and, if you can manage it, run FF with NoScript in addition to AdBlockPlus. It takes discipline to avoid just temporarily allowing domains which is generally not worth it for users, but for those that NoScript is a good solution then AdBlockPlus is a good backup for when you *do* allow a domain that got their content spiked.
As far as I understand the relevant US banking rule (is it a new regulation?), you don't get overdraft protection unless you specifically opt into it. The couple accounts I've opened recently (Chase and Citizens), the bankers seemed to explain this clearly, and I was also under the clear impression that, not enabling overdraft protection, the card would be denied.
Shit hasn't *actually* hit the fan [yet? :(], but eh...
Furthermore, some accounts/cards could offer more protection than the legal minimum.
I listen to both RIAA and non-RIAA stuff if I like the music, tangential business/politics nonwithstanding.
Don't you have anything better to do than follow me around posting bollocks? I wasn't even replying to you (and because of the lack of bold, I already knew that wasn't you ;))
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
I wonder if it costs the merchants much more (if any?) to take PayPal instead of the card directly. (I generally fund PayPal payments with one of my cards - in large part for my small handful of cashback)
If the retailer offers the choice of PayPal or using the card directly, I generally just use the card directly.
I listen to both RIAA and non-RIAA stuff if I like the music, tangential business/politics nonwithstanding.
"The host file approach is completely unusable on machines where you have no root/admin access" - by maxwell demon (590494) on Monday December 13, @03:51AM (#34532614) Journal
Network admins can implement this easily via logon scripts, I covered this with you in your other posts here already (stay in 1 spot) -> http://tech.slashdot.org/comments.pl?sid=1907528&cid=34537992
That's where you also literally ADMIT you were wrong on 2 points right off the bat in addition to this very one!
As regards UAC, you can do HOSTS files copy/overwrites if you want, but clicking "OK" if you need admin rights to do so on workstations, manually!
(With Linux? Pretty much same! You do a sudo dolphin @ any Linux tty term (I use KDE as my example here) & put in your passwords with the correct rights, & you can do it easily... I do it everyday on KUbuntu 10.10 w/ KDE 4.5x))
APK
P.S.=> That is also where you admitted defeat on 2 points because of skimming on your part, as well as lack of rights (which I cover again here):
You were also wrong saying I never said to use NoScript with HOSTS (In fact, I state the reverse), so quit reading in "BiZzArO WoRld EnGLiSh" already, & where you admitted to not knowing about logon script usages... apk
"Don't you have anything better to do than follow me around posting bollocks?" - by Kalriath (849904) on Monday December 13, @03:47PM (#34538740)
What bollocks? You ADMIT it I am correct in my merely saying to yourself, OR anyone else reading, that I didn't post the +1 Interesting post on HOSTS files wasn't me
(Even though my "impersonator" here was modded up for MY WORDS no less, in favor of HOSTS files - "bonus", yea! lol...).
---
"I wasn't even replying to you (and because of the lack of bold, I already knew that wasn't you?" - by Kalriath (849904) on Monday December 13, @03:47PM (#34538740)
Well, as you can see? Doesn't matter, even IF someone else impersonated me (which they did & you know it, as do I)...
My impersonator using my words? Hey - They still were MODDED UP as +1 INTERESTING...
APK
P.S.=> Albeit, using MY words to get that +1 INTERESTING RATING, & in favor of HOSTS files no less, & a way older model of my "Lord of HOSTS" list than the current one (which now boasts 20++ points in favor of HOSTS files vs. adblock &/or DNS servers alone)... apk
Kalriath didn't like the beating he took @ my hands regarding HOSTS files before on /. here, as he regularly as you can see, trolls my posts on HOSTS files!
Well, from the past? Here's where I got Kalriath to run away from disproving the numerous points I listed in favor of HOSTS files, and where I got Kalriath to ADMIT THE SAME AS MICROSOFT'S OWN MGT. HAD TO VS. MYSELF ON THE SAME POINTS of MINE on HOSTS FILES!
(Microsoft's own senior mgt. of their "Windows Client Performance Division" in FOREDECKER to admit the same -> That using a smaller file (by using smaller blocking addresses in HOSTS files) will result in BETTER HOSTS FILE PERFORMANCE):
Here http://it.slashdot.org/comments.pl?sid=1687452&cid=32694426 [slashdot.org]
and
Here http://it.slashdot.org/comments.pl?sid=1687452&cid=32632240
APK
P.S.=> That's what this reaction is REALLY about, since he's now caught in the fact Kalriath likes to "troll" my posts on HOSTS files & he had to admit, along with Microsoft's OWN PEOPLE, that I was correct as well vs. his trolling before this post on HOSTS even... apk
The ideal solution is probably a network appliance using transparent proxying and multiple levels of blacklisting with multiple levels of ad-blocking:
The first level is a whitelist, as a number of websites use third party ad spewers to handle CAPTCHAs. .swf files, Java executables, HTML, CSS, or whatever.
The second would be an IP level blacklist with an immediate drop of packets, so a connection doesn't hang, but returns unreachable.
The third level would be a database of URLs to remove.
The fourth would be updatable heuristics -- zapping potentially malicious/malformed files in transit, be it
The fifth would be heuristics related to the Web site visited. If a user is browsing a mainstream site, it should not be asking for connections to dodgy sites in Elbonia unless the user was clicking on an explicit link.
Of course, none of this is bulletproof, but stopping the ads before they hit the machine will go much farther than the current technique of AV which is intercepting IO calls and scans (neither do nothing against this generation of malware.)
...for reasons I don't actually understand that caused you to reply with lots of bold and SHOUTING, and a "solution" which doesn't work exactly in the case I was talking about: no admin rights).
Yeah, there's that Tourette's thing I was talking about...
Jesus was all right but his disciples were thick and ordinary. -John Lennon
"Did your hosts file have adshufffle.com listed in it before you read this story? No? Hmm" - by Anonymous Coward on Monday December 13, @12:53PM (#34536048)
Again, yes, that one was already in my HOSTS file, & per my subject-line above? Even more were, but some were not, & I often use /. OR The Register as sources for even MORE, & I keep more current that way in my HOSTS file... ontop of my reputable & reliable sources I already use, listed in my posts on HOSTS here.
You'll want to add these to yours also vs. this threat in maliciously scripted adbanners that even MICROSOFT has been hit by (2nd time I know of for MS, 1st was here -> http://apcmag.com/microsoft_apologises_for_serving_malware.htm ):
SOURCE: http://blog.armorize.com/2010/12/hdd-plus-malware-spread-through.html
0.0.0.0 acerdse.com
0.0.0.0 blindry.com
0.0.0.0 careepi.com
0.0.0.0 colemuns.com
0.0.0.0 ssmmbb.com
0.0.0.0 feudari.com
Those weren't in my HOSTS file yet, prior to you asking...
---
acerdse.com
blindry.com
searchjewel.org
thjlnqbtgdw.com
pbcplifpgdw.com
rads.msn.com
adshufffle.com (adshuffle.com too, per my other post to you here)
Those were in my HOSTS file already prior to you asking...
APK
P.S.=> There you are... between this post, & my other 2 in reply to you here http://tech.slashdot.org/comments.pl?sid=1907528&cid=34536654 and here also http://tech.slashdot.org/comments.pl?sid=1907528&cid=34536868 ?
Your questions SHOULD be answered, thoroughly... with reputable sources & tools you can use also! apk
See my subject line above, & even Kalriath KNOWS that the 1st post wasn't me, see here:
http://tech.slashdot.org/comments.pl?sid=1907528&cid=34539426
He knows my posting style, & he OUGHT TO:
I got Kalriath to admit (in my replies to he, in the 2 urls I posted above in fact) what FOREDECKER, Microsoft senior mgt. for MS' "Windows Client Performance Division" had to, here -> http://slashdot.org/comments.pl?sid=1467692&cid=30384918
(First sentence there says it all for me, he admis to my MAIN point to he in fact, right there, verbatim!)
That was on my points that Windows could be doing the HOSTS file better & more efficiently!
(They USED TO, circa Windows 2000 SP#2 onwards up to VISTA in MS "Patch Tuesday" 12/08/2009 - as that is when they removed the ability to use 0 as a blocking IP address (vs. the larger & slower 127.0.0.1, worst one, & even 0.0.0.0), but Windows 2000 SP #2, XP, Server 2003 still can: ODD!)
Not - it's a design mistake on MS' part, & one they used to do better!
(& I warned them on another from rootkit.com (about kernel hooking being easier to do on the new IP Stack VISTA/Windows Server 2008/Windows 7 have)
APK
P.S.=> That was in addition to pointing that out to them also ontop of HOSTS files issues I found & was correct on, and having them admit I was right as rain!
That point?
Either read the URL with Foredecker
http://slashdot.org/comments.pl?sid=1467692&cid=30384918
(or those 2 url's about Kalriath in posts I made to he)
Both men HAD to admit my points noted above!
Realize that "Less is more" with good engineering many times - Smaller IS better, & it is, with HOSTS files blocking addresses, period, on any hosts file of any size... apk
"Yeah, there's that Tourette's thing I was talking about..." - by gmhowell (26755) on Monday December 13, @06:47PM (#34541036) Homepage Journal
Well, I could say you're both bunglers (as are any of my "naysayers" trolling me here), as you cannot solidly disprove ANY of the 20++ points I put out in favor of HOSTS files...
APK
P.S.=> See? Anyone can toss a name, but thing is?? Can you back up your b.s.??? Apparently not, not a single one of you here has vs. the points I put up in favor of HOSTS files (over AdBlock or DNS servers alone) here in its most current form ->
http://tech.slashdot.org/comments.pl?sid=1907528&cid=34535412
As per usual? These are the results as usual:
You trolls LOSE vs. facts, while facts make me come out on top of you trolls, easily, everytime!... Just too, Too, TOO EASY (too ez)... apk
"I'm not ad hominem attacking you. I'm not trying to refute your points. I don't in any way, shape, or form have any desire to attempt rational discourse with you." - by gmhowell (26755) on Monday December 13, @06:56PM (#34541134) Homepage Journal
You don't possess the intelligence or skill in the computer sciences to do so, and you KNOW it, as do we all here reading "based on your FINE off topic trolling responses" all thru this thread.
---
"I saw an opportunity to troll you and get you out of the woodwork.." - by gmhowell (26755) on Monday December 13, @06:56PM (#34541134) Homepage Journal
Oh, so did I in yourself NOW THAT YOU ADMIT TROLLING ME. I knew "you & yours" couldn't effectively disprove the points in my current HOSTS files benefits list here:
http://tech.slashdot.org/comments.pl?sid=1907528&cid=34535412
---
"I saw a way to waste some of your time in a manner that I find amusing." - by gmhowell (26755) on Monday December 13, @06:56PM (#34541134) Homepage Journal
Aha, "the truth comes out" yet again: For the 2nd time now, gmhowell admits to trying to "troll me" here.
Buddy, you couldn't "waste my time" on your BEST day... in fact? As I write this, my HOSTS file processing program is adding another 800 or so known bad sites to my HOSTS file!
---
"Score: gmhowell 1; apk 0." - by gmhowell (26755) on Monday December 13, @06:56PM (#34541134) Homepage Journal
Ahem: The score is More like 20 to ZERO (you being zero), because my 20 points in favor of HOSTS files are still SOLID AS A ROCK as to the gains in speed, security, & yes, even anonymity over adblock &/or DNS servers, and how HOSTS files can make up for BOTH of their bugs &/or deficiencies too!
Again - I didn't see you disprove any of those points here:
http://tech.slashdot.org/comments.pl?sid=1907528&cid=34535412
APK
P.S.=>
"BTW, loved you in Family Ties. How is that Parkinson's going for you?.." - by gmhowell (26755) on Monday December 13, @06:56PM (#34541134) Homepage Journal
Wrong "APK", but he's great... apk
apk, the bollocks is this whole tirade on how you were supposedly right... 6 months ago. And I'm still uncertain how it is that you think my agreement that large files read slower than small files is some sort of amazing admission of defeat.
Really. I'd agree with twitter if he posted that, and god knows I almost never agree with him.
Let it go already.
Oh, and by the way... just stuck an entry in my hosts file on Windows 7, and Server 2008 (not R2 - so it's the same IP stack as Vista):
0 www.google.com
Wanna take a guess what happens?
For a site about things like basic rights, Slashdot users sure do like to censor "dissent".
"apk, the bollocks is this whole tirade on how you were supposedly right... 6 months ago. And I'm still uncertain how it is that you think my agreement that large files read slower than small files is some sort of amazing admission of defeat" - by Kalriath (849904) on Monday December 13, @08:04PM (#34541814)
6 months ago, or 6 yrs. ago, would it matter? You've had to admit I was right... 2x time, this being that 2nd time!
LMAO - So, admitting you had to admit my points on HOSTS files that even senior mgt. from MICROSOFT had to admit I was right on, is "victory" in your eyes?
Get your eyes examined then...
You & Foredecker (MS' senior mgr. for "Windows Client Performance Division" @ MS) said just what you did, first sentence here:
http://slashdot.org/comments.pl?sid=1467692&cid=30384918
That first sentence of admission on his part? That truly WAS my MAIN point (& he conceded I am correct on it, as you did before, & you do now, yet AGAIN!)
(LMAO - Some "victory" on your part (not, far from it!)).
APK
P.S.=>
"Oh, and by the way... just stuck an entry in my hosts file on Windows 7, and Server 2008 (not R2 - so it's the same IP stack as Vista): 0 www.google.com Wanna take a guess what happens?" - by Kalriath (849904) on Monday December 13, @08:04PM (#34541814)
It probably will not work to block it validly, because last time I checked on Windows 7? 0 as a blocking IP address would NOT work...
Afaik? MS has not fixed this yet, afaik @ least - UNLESS YOU SHOW US DIFFERENT NOW that is!
(I'd appreciate knowing it works, because it's smaller & faster + more efficient than what I use now in 0.0.0.0 (yes, that's better than 127.0.0.1, but still not as good as 0 was (& still is, on Windows 2000 SP#2 & beyond, XP, or Windows Server 2003))... apk
This post reminded me to add doubleclick.net to my untrusted list in NoScript. How convenient that slashdot.org uses them.
No. I admitted skimming over your mention of using NoScript in addition to host files. And since I assume you know what you wrote (and even if you have such severe Alzheimer disease that you don't, you could have looked up where the sentence I quoted was in your post), I can only assume that your "misunderstanding" is malicious. Therefore EOD.
The Tao of math: The numbers you can count are not the real numbers.
"Looks like genuine apk, if a bit terse." - by gmhowell (26755) on Tuesday December 14, @01:52AM (#34543602) Homepage
Trolling & off topic as per usual, we have gmhowell - don't you have anything better to do?
APK
P.S.=> The racial slur post you're replying to? Give me a break, ok?? It's bad enough you trolls don't know enough about the topic @ hand here, but, seeing you all stoop low enough to try to call me names is 1 thing, I expect that from the likes of trolls (ad hominem attacks), but racial slurs??? Sorry, that's where you trolls really make yourselves look poorly... apk
"Fun Fact: I'm a NIGGER
apk" - by Anonymous Coward on Monday December 13, @08:43PM (#34542114)
See my subject-line above.
APK
P.S.=> Off-topic trolls, they're ALL the same: Once you get them doing their "std. last gasp" of ad hominem attacks, you know you've done a good job (patting myself on the back)... apk
We trolls win every single time we get you to post." - by gmhowell (26755) on Tuesday December 14, @01:53AM (#34543608) Homepage Journal
Doesn't look that way to me: You have to go off-topic, toss names & use other forms of ad hominem attack, rather than disproving any points or facts I brought in my posts for you to do so against.
APK
P.S.=> People like you though? You're a waste of life... apk
I never denied trolling you. And the only person I troll under the AC banner is tomhudson." - by gmhowell (26755) on Tuesday December 14, @01:55AM (#34543612) Homepage Journal
Grow up.
APK
Adblock Plus. Should be a built-in Firefox add-on by default IMO.
"No. I admitted skimming over your mention of using NoScript in addition to host files." - by maxwell demon (590494) on Tuesday December 14, @04:11AM (#34544086) Journal
You blew it, too bad for you. I also still see that you cannot dispute or disprove any of the points in my list of points in favor of HOSTS files -> http://tech.slashdot.org/comments.pl?sid=1907528&cid=34535412
(That's all ANYONE here needs to see, period...)
---
"And since I assume you know what you wrote (and even if you have such severe Alzheimer disease that you don't, you could have looked up where the sentence I quoted was in your post), I can only assume that your "misunderstanding" is malicious. Therefore EOD." - by maxwell demon (590494) on Tuesday December 14, @04:11AM (#34544086) Journal
Is that "ad hominem attack" the best you've got? Apparently so...
Too bad my list of points on HOSTS files in the URL above still "stands strong" vs. trollers like yourself, gmhowell (who admitted trolling me here no less, literally) and Kalriath (who also admitted to trolling me here also).
APK
P.S.=> If the best you have are ad hominem attacks & such?
Well, that only tells myself (& others reading here as well) that I did a GREAT JOB, especially when it came to putting you all in your places as trolls... apk
APK
See subject-line: The way YOU act? It sounds like you're a woman... that's the line of thinking women have!
APK
P.S.=>
"I could probably be doing something else, but pulling your strings and getting a reply amuses me." - by gmhowell (26755) on Tuesday December 14, @06:41PM (#34554476) Homepage Journal
Yes, you could (IF you had the knowledge on computing that's necessary, & it's plain that you don't): You could be saying "what's wrong" w/ my list of 20++ points in favor of HOSTS files here:
http://tech.slashdot.org/comments.pl?sid=1907528&cid=34535412
However: It's been SO WELL THOUGHT OUT, that entire flocks of "trolls" like yourself have been reduced to what YOU are doing now: Off-topic stupidity instead... which only means I did a HELL OF A JOB on that list, because the "likes of you" & those BETTER @ COMPUTING THAN YOU, "can't touch this"... apk
"Kiss, kiss." - by gmhowell (26755) on Tuesday December 14, @06:55PM (#34554644) Homepage Journal
Look - if you are a homosexual? New NEWS: I'm not, so "f-off"... & you act like a woman (I said that to you in reply to your off-topic trolling here -> http://tech.slashdot.org/comments.pl?sid=1907528&cid=34557024 )
APK
P.S.=> IF you had the knowledge on computing that's necessary, (& it's plain that you don't)?
You could be saying "what's wrong" w/ my list of 20++ points in favor of HOSTS files here:
http://tech.slashdot.org/comments.pl?sid=1907528&cid=34535412
However: It's been SO WELL THOUGHT OUT, that entire flocks of "trolls" like yourself have been reduced to what YOU are doing now: Off-topic stupidity instead...
(Which only means I did a HELL OF A JOB on that list, because the "likes of you" & those BETTER @ COMPUTING THAN YOU, "can't touch this")... apk
See subject-line: You on your BEST DAY "can't touch this" list of 20++ points in favor of HOSTS files ->
http://tech.slashdot.org/comments.pl?sid=1907528&cid=34535412 and we ALL know it.
It's been SO WELL THOUGHT OUT, that entire flocks of "trolls" like yourself have failed in trying to, and that's good enough for me: It means I did one HELL OF A GOOD JOB on that list in favor of HOSTS files (vs. Adblock or DNS servers alone)...
APK
P.S.=> Additionally/lastly: Grow up, you off-topic pitiful little troll... you act like a woman! apk
"Why would I want to disprove anything?" - by gmhowell (26755) on Tuesday December 14, @06:42PM (#34554490) Homepage Journal
Correction: On your end? LOL, it's TRULY more like "I am too dull brained to do so" on YOUR part... lmao!
After all: You could be saying "what's wrong" w/ my list of 20++ points in favor of HOSTS files here:
http://tech.slashdot.org/comments.pl?sid=1907528&cid=34535412
HOWEVER - "StRaNgELy EnOuGh" though? You "steer clear" of even TRYING to do that... why is that??
(Not! We all KNOW why - you're not technically competent enough in the computer sciences to do so, period! Your "off-topic trolling" & acting like a woman instead of a man on your part shows us all that much, clearly!)
APK
P.S.=> However: My list of 20++ points in favor of HOSTS files usage above has been SO WELL THOUGHT OUT, that entire flocks of "trolls" like yourself have been reduced to what YOU are doing now: Off-topic stupidity instead...
(Which only means I did a HELL OF A JOB on that list, because the "likes of you" & those BETTER @ COMPUTING THAN YOU, "can't touch this")... apk
the problem I see with iPads is that all users are locked in the garden. That includes the people who only know enough to turn device on and click on the browser, but also locks out the few people who really need access to all capabilities to make crative use of the device.
i pretty much prefer Palm approach to webos (and probably other manufacturers and platform combinations) : out of the box, it's a "pop and mom" compatible walled garden. But an advanced user can type in a command (a command is still required to avoid clueless users doing it by accident but it's well documented), and switch the device into developper mode and do whatever pleases them, like for example installing an alternative application repository.
that's also the model used by linnux distributions which either let you use the default doctored repository or let you instal a 3rd party one. (but they don't child-proof it like webos)
"Sufficiently advanced satire is indistinguishable from reality." - [Tips: 1DrYakQDKCQ6y52z6QbnkxHXAocMZJE61o ]
"YMMV: Spybot hostsfiles and this mvps.org list twice affected my protégées' Windows stability until restored to empty files." - by vlueboy (1799360) on Monday December 13, @05:17PM (#34540036)
Did you turn off the local DNS client caching service as is noted at mvps.org here:
http://www.mvps.org/winhelp2002/hosts.htm
PERTINENT QUOTE/EXCERPT:
---
"Editors Note: in most cases a large HOSTS file (over 135 kb) tends to slow down the machine.
To resolve this issue (manually) open the "Services Editor"
Start | Run (type) "services.msc" (no quotes)
Scroll down to "DNS Client", Right-click and select: Properties - click Stop
Click the drop-down arrow for "Startup type"
Select: Manual (recommended) or Disabled click
Apply/Ok and restart.
When set to Manual you can see that the above "Service" is not needed (after a little browsing - when set to Manual) by opening the Services Editor again, scroll down to DNS Client and check the "Status" column. It should be blank, if it was needed it would show "Started" in that column. There are several Utilities that can reset the DNS Client for you ..."
---
?
With relatively "largish" HOSTS files, you will have to do that.
Smallish HOSTS files (and mvps.org has one, the "optimized model", which imo, is LESS EFFECTIVE, but doesn't need you to turn off the DNS client cache service, shitty though it is) don't need that being done!
(The problem is that the DNS cache client local service in Windows is a "Fixed Size" structure/buffer is why it happens - Linux has NO SUCH PROBLEMS this way, mind you - it's 1 thing I will give LINUX over Windows in fact (some "FYI"))
APK
The tool who keeps going on and on about HOSTS files is turning himself into a bad Slashdot-centric meme.
A) HOSTS files are vulnerable to being overwritten.
B) HOSTS files are vulnerable to being overwritten.
C) Only complete idiots rely on just a HOSTS file.
@Mindless Drivel: 100% of Twitter posts ever Tweeted.