Slashdot Mirror
Two Major Ad Networks Found Serving Malware
Trailrunner7 writes "Two major online ad networks — DoubleClick and MSN — were serving malware via drive-by download exploits over the last week, experts say, after a group of attackers was able to trick the networks into displaying their ads by impersonating an online advertising provider. The scheme involved a group of attackers who registered a domain that was one letter away from that of ADShuffle.com, an online advertising technology firm. The attackers then used the fake domain — ADShufffle.com — to dupe the advertising networks into serving their malicious banner ads. The ads used various exploits to install malware on victims' PCs through drive-by downloads, according to information compiled by security vendor Armorize."
What do you expect from a company called "Doubelclick"? I bet Googel tampers with their search results too.
I doubt they check the scripts before they are put up for rotation, and this is their chance to find a scapegoat. As long as they get paid, I doubt they care to check.
Steve's Computer Service, Hobbs, NM
One more example of why ad blocking has its security benefits. What's worse is that doubleclick and friends are used by pretty much every site out there including Slashdot. It's a shame that although a lot of people would be willing to support sites like Slashdot allowing a few ads to load occasionally; doubleclick just isn't trustworthy enough to allow that.
Sigs are too short to say anything truly profound so read the above post instead.
Ever since I've installed a host file (http://www.mvps.org/winhelp2002/hosts.htm) to redirect advertisers to my loopback, I haven't had any malware, spyware, or adware issues. I first started using the host file 5 years ago. With that in mind, I can't say I'm really all that surprised that advertisers would be the source of ad/spy/malware...
Oh wait... Google's doubleclick got tricked too.... okay, nevermind.
-The Anonymous Google Fanboy
I could have told you that. I narrowed down the issue to MSN/Hotmail a couple days ago and was advising users to stay away for as long as possible/use adblock/noscript.
I've been dealing with removing this horseshit from end users pc's all week.
Something interesting I noticed was the malware authors were amateurs- they forgot to setup the fake HDD defrag malware to run at boot on any other user profile besides the one that was infected.
Made disinfection pretty easy...
Queue people whining and crying that people are thieves and all that because they block ads. Sorry, but if you can't be sure you'll never serve malware. You'll never be allowed to serve ads which might infect my machine with something...nasty. Especially now that ransomware is starting to become the next trend.
Om, nomnomnom...
The trust model of online advertising is in my opinion fundamentally broken. A big part of the security model of the web is domain-based - e.g. the same origin policy - but this goes down the drain with third party ads hosted on yet another third party's server.
With online advertising it was for the first time possible to measure the effect of ad campaigns better than "how many saw it and did we sell more after it?" What did this bring us? "PUNCH THE MONKEY!", "LOOK AT THE BLINKING LIGHTS!", "BEEP BLOOP BEEEEEP!!!" and perhaps most insidiously it broke the domain-based model of trust on the web since everything had to be put on the advertising hosters' servers to deter click fraud and whatnot.
AdBlock doesn't just save you bandwidth and reduces the annoyance of browsing the web, it is also one of the best tools for avoiding drive-by malware from ads.
________
Entranced by anime since late summer 2001 and loving it ^_^
and sandboxes, and no script, and external firewall devices, and backup drive images from previous weeks
Seen a few people say they use Adblock and all, which is fine, but if you recognize that an ad-server can be compromised, then why not any other web server you visit? How many things are you going to block before it makes the web safe? So many all websites are useless? That's why I found NoScript more annoying than not. Too often I was just saying yes to so much it wasn't really that much more secure.
Much better to have secure systems inside than walls trying to block everything.
Really, what kind of idiot to you have to be to run a machine configured like that these days?
How about 90% of the people on the internet, those who are in the "mom and pop" or "poor student" class of user and don't actually know anything about computers except for turning them on and off, and double-clicking the Outlook Express and Internet Explorer icons.
There really should be a license requirement for using computers on the internet - you don't let unlicensed drivers on the road, do you?
My MS messenger has been setting off the anti-virus alarms for several months now. They come in through the ads at the bottom of the main window.
For justice, we must go to Don Corleone
For the very few oblivious people (esp on /.), here's your solution: Adblock
It's really just one more reason for me to not feel guilty about blocking ads. Sometimes I click on ads from sites which I trust and wish to support, but other than that, the hell with them.
DNA -- National Dyslexic Association
Because it's not the web server being comprimised per say. It's the Ad network either being fooled, or willfully putting up exploit code rather than any sort of hack going on. Also considering the turnover of data/files on an ad networks servers, it's much harder for them to keep this from happening
Normal people worry me!
Let em whine. I'm sorry, These ad firms put themselves into this mess.
The day ad firms decided to allow advertisers to use Flash and JavaScript in their advertisements is the day I started blocking them. Seriously, What was wrong with simple images and text? Was the monkey way too easy to punch or something?
In Soviet Russia, Trojan exploits YOU!
Don't forget the folks who believe it's morally wrong to block ads. I had a long conversation with a college professor of programming who believes that quite strongly.
There really should be a license requirement for using computers on the internet
No way! Next you'll be demanding sobriety checks. So let's just nip that dumb idea in the bud, shall we?
For justice, we must go to Don Corleone
ad network should serve the images/text and a link URL, nothing more
stop letting advertising providers provide custom HTML and remote-load scripts/images into ads
The problem with IE is insecure defaults. A browser that allows auto-install by default is BROKEN.
People in glass houses, and all that.
The only time any PC I run has been compromised to my knowledge was a relatively recent drive-by download via a Java applet. The machine was running Firefox, and both it and the Java VM were fully patched. The machine was also behind a properly configured firewall, and running up-to-date anti-virus software and assorted security/privacy plug-ins in the browser. Unfortunately, none of that helps if you get hit by a zero-day exploit. Also unfortunately, I hadn't yet found where they moved the "enable/disable Java" functionality in Firefox 3.6, not that knowing that would have helped me much, because some tools I need for work actually do use Java applets and therefore the related plug-ins anyway.
BTW, I had just started browsing social news sites like Slashdot, opening a handful of tabs to normally reputable sites to read the articles (yes, really, some of us actually do). I'm pretty sure I got hit via either a third party source that AdBlock missed or a compromised comment on a blog post.
In any case, please don't kid yourself that this is only a problem for dumb Windows/IE users surfing for warez/pr0n/whatever. Just because you're running Linux instead of Windows, or Firefox/Chrome/Opera/whatever instead of IE, or visiting legitimate sites that are themselves not going to attack your system, that doesn't mean you're somehow immune. It just means you're a less likely target. Pride comes before the fall.
If you disagree, post your argument. (-1, Overrated) isn't your personal censorship tool for views you don't like.
I find it a bit odd that an extra "f" would have duped "the system". I believe what may have been happening is that human verification part of the equation could have been "hacked".
You create an account, you specify where the banner data lives, it gets submitted for an approval.
Except in this case whoever looked at the data saw "trusted" domain and figured everything is fine. Heck, the "fake" domain could have served an innocent javascript up until owners knew that banner got approved, then swapped out the script and off the drive-by script malware goes.
And then Google/Doubleclick detects bait-and-switch ("hey, we didn't approve this virus!") and it gets flagged.
Hyperom.com
Exhibit A: Beer Goggles for Gmail :)
well its bullshit every time an add tried to install something the package manager won't open them. Shit I've tried every distro out there and I still can't open them up. What am I doing wrong can someone please help me. I really want to see all these cool things the rest of the world is experiencing.
This is exactly why iPad type "computers" are the coming thing. Locked down in a walled garden and simple to use. Few people *really* need a 'real' computer when a small "device" will do everything they need.
To expand on this; the job of an ad agency is to put you in touch with many groups who normally you wouldn't be in touch with. Preferably even groups who you wouldn't want to be in touch with. There's a differece between going to a place you trust which might be compromised and a bunch of such places having the chance to pay to get in touch with you.
=~ s,(.*),<sarcasm>$1</sarcasm>,g if any_point_you_wish();
Cue.
At the time Google bought DoubleClick, Google owned the advertisement network with the best reputation (Goolge AdWords/AdSense. Relevant, not-very-annoying text ads) and DoubleClick had perhaps the worst reputation (horrible flash banners, etc.) of them all. I couldn't understand why Google would buy that. Then again, these days Google is pretty horrible towards Ad publishers (closing or freezing accounts without offering any explanation, etc... If you aren't a big name, expect to get buttfucked by Google) while DoubleClick is decent-ish (they should really send their lawyers after dishonest advertisers more... But arguably that's the publisher's responsibility). So doubleclick screws the users but is good for the publishers, Google screws the publishers but is good for the users, both are pretty fine for advertisers. I guess it works out.
(Disclaimer: I work for an agency that does - among other internet related things - SEO, internet advertising and the like. I'm obviously not in any way assosciated with either of the companies unless you count the fact that we hold a number of Google certificates...)
add animated GIFs to that list.
I started blocking ads when two things happened, pretty much simultaneously:
One, ad content took over a considerable part of the screen real estate and
two, ads started to distract from the actual content through animation, blinking, sound, etc.
I know advertisement is all about getting your attention, but it tries to do that in contexts where I don't want my attention diverted to something else. I don't mind advertisement on the WC or on the bus that much, it's not as if I had anything better to do there. But when I'm driving or browsing, I hate every single ad I encounter. Luckily, for browsing there is AdBlock.
And I don't like the whining, either. If you business model relies on ads, then your business model is broken. But if you absolutely want to give me ads, how about using text ads? I don't mind those, they are a ton less distracting, which greatly improves your chances of me actually clicking one instead of hating it.
Assorted stuff I do sometimes: Lemuria.org
MS for the security holes, MSN for the exploits. One stop shopping! We have you rooted the fastest! Where do you want someone to make you go today!
MMO Quests are like orgasms:
You may solo them, I prefer them in a group.
I think thats a 2CV.
http://michaelsmith.id.au
88x31 and 468x60 animated GIF's.
I'm going to implement ad blocking at the router level at my house....
Nobodies Prefect
Tidbits for Techs Technology Blog
and what i say to those people is
sure i will stop blocking ads when
1 every provider can certify under penalty of law that the ads being served are relevant safe to view and are less than 10% of the page content
2 everybody stops cramming 60% of a given page with various ads cross site links and widgets so that an article thats 4 paragraphs does not need to be on 8 pages because the content pane is smaller than a postit
3 everybody also stops doing videos for everything and actually writes articles (a video of a talking head should be replaced with what the talking head said)
Any person using FTFY or editing my postings agrees to a US$50.00 charge
Thanks for the gratuitous rude stereotyping.
Damon
http://m.earth.org.uk/
1 every provider can certify under penalty of law that the ads being served are relevant safe to view and are less than 10% of the page content
How did you decide on 10%? I was just thinking that the Simpsons episodes these days are about 22:30 long. That means about 25% of the 30 minute "content" is ads. I wonder what percentage of a magazine or newspaper are ads... 50%?
And 4) Even under these conditions, ads will remain blocked on any connection for which there is a fixed transfer limit and overuse charge. I'm thinking mostly of mobile phones and internet. Ads are huge. Due to their need to attract attention, the old GIF banner just doesn't cut it any more: Many ads now are interctive flash files with many component graphics, scripts and even audio embedded.
But statistically, those annoying ads *work*. They wouldn't be used otherwise - I'm sure the advertising industry has done many studies of this.
Yes and no. Mind you, my marketing class has been more than 10 years ago, but I'm not sure if the basics have changed so much. True is that the marketing industry does invest a lot into research and studies. However, like in many other areas in business, that doesn't mean those results actually get applied. And while results of ad campaign get regularily checked, more often than not the results tell you whether it worked or not (i.e. sales increased) but not why. Which results in many, many legends that have no empirical support whatsoever, but a huge "nobody ever got fired for..." effect - basically, there are things you just do because if you don't and the campaign fails, everyone will blame it on you.
People will learn to just ignore unobtrusive advertising,
People are great at filtering out pretty much anything. It's just that the obtrusive stuff requires more subconscious processing power.
I don't know what comes next. Maybe sites in another year will start requiring users answer a simple question about the advert before they can access the content, to prove that attention really was paid.
Usually, things move in sinus-like waves. I don't know if we have reached the top yet, but I can hardly imagine how much worser it could get. So I imagine pretty soon things will start to move in the other direction, and we just may get the ad insanity under control again. Or things escalate further, until the counter-reaction is likewise strong and we will see a flat-out global ban on advertisement. Now that would be a sight to behold.
Assorted stuff I do sometimes: Lemuria.org
One of my honeypot VMs I use for Web browsing got hit by that when I was visiting a top named site.
In my experience, now that a lot of users are not just running executables willy-nilly, compromised ad networks serving up malicious pages to try to compromise browsers or add-ons is the #1 threat in my book.
To drive the point home, I use AdBlock on the main machine I use for Web browsing. I have yet to see a single script related to PC Antivirus. In reality, AdBlock provides more protection than most AV utilities, because once the Web browser is compromised, most AV utilities are completely useless in detecting and stopping that.
BadAnalogyGuy, is that you?
Trying to tell me that computers will be made safer by taking away their function is like trying to tell me that cars can be made safer by removing their ability to turn right
It's more like making cars sound an alarm if the seat belt's unbuckled. Yes, some people jailbreak this feature.
Free Martian Whores!
THIS is why class action lawsuits against the offending malware serving companies needs to be instituted, starting at the biggest baddest adware serving companies. If DoubleClick serves Malware, it is their responsibility and they need to be sued into oblivion.
Take the profit out of serving ANYTHING to everyone, and start making it cost money, and you'll see the changes you want.
Agent K: A *person* is smart. People are dumb, stupid, panicky animals, and you know it.