Slashdot Mirror
Ad Networks Lay Path To Million-Strong Browser Botnet
jfruh writes "Every day, millions of computers run unvetted, sketchy code in the form of the JavaScript that ad networks send to publishers. Usually, that code just puts an advertiser's banner ad on a web page. But since ad networks and publishers almost never check the code for malicious properties, it can become an attack vector as well. A recent presentation at the Black Hat conference showed how ad networks could be used as unwitting middlemen to create huge, cheap botnets."
Done.
For Firefox fans there is an add on called "no script" that prevents Javascript from running automatically. There should be an equivalent for Chrome folks too.
is this that staticlib.net crap that's been making the rounds lately?
Been happening since the beginning of broadband.
Ghostery and Adblock FTW.
vos nescitis quicquam, nec cogitatis quia expedit nobis ut unus moriatur homo pro populo et non tota gens pereat.
I wonder what the cost of doing this would be compared to renting a super-computer time.
You mean there are other attack vectors, too?
From what I've seen, it seems like ad networks are either the main form of malware vector, or at least close to it. It isn't true proof, but I have had no issues with infections when using AdBlock and an add-on blocker (even if it is Chrome's "click to play" item), but if I fire up a VM and go browsing without those utilities... all hell breaks loose. Antivirus utility? Yeah, right. Those are OK for maybe scanning an infected machine's HDD that is mounted on another box. However, rootkits, especially RAM based ones will still be a gotcha.
I see nothing good about ad servers. They are a vector for malware at worst, at best, are a constant source of behavioral tracking and monitoring. At best, they throw a few bucks a month at sites that use them.
I like the idea of a subscription clearinghouse and micropayments, but there are issues of privacy and anonymity to be worked out.
Well, it's scary enough to make me want to turn off Javascript (unless I'm running Firefox—and I'm not—and can't turn it off). But Javascript provides to web pages features and abilities that I'd rather like to keep. For example, I love AJAX and how it allows a sufficiently sophisticated browser to do something like what Google did with Gmail. When I first saw Gmail my jaw dropped. "WOW!" I knew then that the thick client's life was limited. But as things get more and more nasty I'm wondering if perhaps the thick clients are not a safer approach for some applications.
It's really quite a simple choice: Life, Death, or Los Angeles.
...I blanket-block all ads. As much as I don't like ads, I'd tolerate them if they had the trust they need to _earn_ to run Javascript/Java/Flash content on my machine.
You trust Oracle Java and Adobe Flash enough to run them on your machine?
If you care about security, you're running NoScript. And they do not run.
Nice to know BlackHat has finally caught up with 2007 when malvertising was publicly identified as an issue (see https://isc.sans.edu/diary/Malvertising/3727). Strange that people actually working in the anti-malvertising world have never heard of these researcher's work.
I guess we can ignore RiskIQ and Twitters purchase of Dasient. The tens of millions a year spent on prevent malvertising is clearly "nothing". The methods being used might not be as effective as some want, it isn't due to a lack of funding. After 42 years we still can't reliably stop malware.
noscript
I don't really have much of a problem donating some of my resources to a free web worker pool, as long as it doesn't adversely impact my own use. Some people already do this with various online distributed computing platforms.
As far as "servers being attacked" and "cracking passwords" goes, I think web security is important and will continue to become more so. I guess this might raise costs, but its money well spent if it makes the internet a more secure, robust, free, and useful tool in the long run.
...why we use adblock and noscript, whining that we deprave them of income.
It's not that your ads are obnoxious, albeit even that alone would suffice as a reason. They're dangerous to us.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Massive class action?
I've worked with several ad networks, on a number of issues, and can say with absolute confidence that the author has no concept of how the technology actually works, which results in an outright lie in his thread-starter.
The JavaScript code originates with the ad delivery platform (DoubleClick, OpenX, 24/7, etc.), sometimes outsourced to the ad networks -- DoubleClick is a white label delivery platform for many ad networks. The JavaScript is tightly controlled and constantly subject to real-time auditing by several providers such as The Media Trust. The advertisers simply provide the assets -- the banner creative -- that is delivered by the ad network, optimization systems, and ad delivery platforms.
Currently, yes, it all sucks and is why we have had blockers, but is also the only option to monetize free content -- for now.
We were using java, flash and javascript to do this sort of stuff as early back as 1996.
Massive DDOS attacks were generated this way.
Even played around with Distributed computing all from banners place on various web sites.
We were able to run stuff in browsers that was next to impossible to remove.
And with browsers restoring all the windows most common users would never figure out how to kill these things.
I am always doing that which I can not do, in order that I may learn how to do it. - Pablo Picasso
It's a solved problem, really.
Damn good thing that Firefox 23 makes javascript obligatory:
http://news.slashdot.org/story/13/07/01/1547212/firefox-23-makes-javascript-obligatory
From TFA:-
Assuming you're using the latest Firefox with Adblock and Noscript, how true is that claim?
Would it, for example, stop the ad network attack vector mentioned in TFA?
I used to assume running Noscript is sufficient protection, but with all the news of exploits floating around, I'm no longer sure.
All of you who are so smart, that you will not be part of the botnet, you do not matter. You are an insignificant amount of people compared to the ignorant masses, that the botnet exploits.
Adblock, noscript, flashblock, giant hosts file.
And you guys wonder why everyone hates you... You're a bunch of annoying amoral lying assholes.
Can ./ finally stop requiring JavaScript, then? I don't want to hear about xyzblock -- they don't work for me. I don't enable Java or Flash either.
NoScript
http://noscript.net/
Film.
At.
Eleven.
Why don't they fix javascript, limit it to a handful of requests so it can download its data but not spam requests in a loop? Disable its popup ability, too. I have never needed it, and if I did, I'd be happy to click an open window approve box.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
Unless they are paying for their ads using anonymized Bitcoins couldn't the ad company be served a warrant and the perpetrator found through the payment records?
I'd be Shocked, yes Shocked to hear that some of the free Porn sites do this kind of "using your computer in the background from a supposedly idle web page".
It is the perfect target audience: People go to the sites, linger on the pages longer than random readers, and don't like to admit they went there (so it helps hide any such usage. Also completely immune to anti-virus protection, vs. say exploiting the machine.
Since they do more with less (a single file) & at a faster level of privelege (ring 0/rpl0/kernelmode) than browser addons (that slow up already slower ring 3/rpl 3/usermode browsers) by acting as a filter for the IP stack itself (written in C language & starts with the OS + 1st request to the internet, with over 45++ yrs.of optimization refinement put into it) - how do I gather, sort, deduplicate, normalize, & filter them? Easy:
---
APK Hosts File Engine 9.0++ 32/64-bit:
http://start64.com/index.php?option=com_content&view=article&id=5851:apk-hosts-file-engine-64bit-version&catid=26:64bit-security-software&Itemid=74
---
Using that app by "yours truly"? So can you!
(More specific details of its operation & what it does for you are in that link (which if you're like me, that site *may* just "interest you", since it features & hosts 64-bit wares galore since that's the "wave of the future" & not just for Windows users either mind you...)).
* It also does FAR more than AdBlock ("souled-out" to GOOGLE, & crippled by default) or Ghostery (Advertiser owned) do, by FAR - especially considering they're "Foxes guarding the henhouse" now.
APK
P.S.=> Custom hosts files give users of them great benefits in added speed (blocking adbanners & hardcoding your favorite sites into them - faster than remote DNS lookups), added security (vs. known malicious sites/serves/hosts-domains that serve up malware or are malscript bearing), added reliability (vs. Kaminsky bug vulnerable DNS servers, 99% of which are STILL unpatched vs. it & worst of all @ the ISP level), & even added anonymity to an extent (vs. dns request logs + DNSBL's you may not like too)...
... apk
Its independent and doesn't slow my browser down like Ghostery does. The latter isn't really written with users in mind... its primary purpose is to give the ad industry a 'self-compliance' fig leaf.
You're right - & I work around that easily, so can you, as follows (since it's not visible usually like for instance, adbanners are - sneaky, Sneaky, SNEAKY lol!)!
Start by surfing around as normal to sites you like/go to usually (or not), & using a tool called "network latency view" http://www.nirsoft.net/utils/network_latency_view.html
(Which is really just for doing this but it works for this purpose also)
That program shows me those trackers that AREN'T immediately apparent operating 'behind the scenes'.
Then, I just pop them into my custom hosts file like so:
E.G. -> 0.0.0.0 edge-star-shv-03-ash5.facebook.com
And voila: They're NOT going to connect to squat on my system locally, or work @ all, period.
APK
P.S.=> It works (it's pretty underhanded shit imo too, & pissed me off some when I discovered it a few years back) & of course? So does this by "your truly" (yes, shameless plug):
APK Hosts File Engine 9.0++ 32/64-bit:
http://start64.com/index.php?option=com_content&view=article&id=5851:apk-hosts-file-engine-64bit-version&catid=26:64bit-security-software&Itemid=74
Does a hell of a LOT more for you in added speed, security, reliability, & even anonymity to a degree -> http://it.slashdot.org/comments.pl?sid=4034107&cid=44439245 than AdBlock ("souled-out" to GOOGLE, doesn't block all ads anymore by default) &/or Ghostery (owned by advertisers & thus imo is a "fox guarding the henhouse") do.
NoScript rocks for FF users - but, I use Opera 12.16 64-bit here & disable cookies/plugins/javascript/frames-iframes BY DEFAULT globally for all sites - when I need any of those, I do an "exception" site, allowing for them (sometimes you have to for full function, usually ecommerce related or db access type stuff as you probably know).
"Always more than 1 way to skin a cat"
... apk
Microsoft sure is getting desperate. Too bad nobody wants your Surface hardware, either.