Slashdot Mirror

← Back to Stories (view on slashdot.org)

Ad Networks Lay Path To Million-Strong Browser Botnet

Posted by Soulskill on from the your-computer-is-broadcasting-an-ip-address dept.

jfruh writes "Every day, millions of computers run unvetted, sketchy code in the form of the JavaScript that ad networks send to publishers. Usually, that code just puts an advertiser's banner ad on a web page. But since ad networks and publishers almost never check the code for malicious properties, it can become an attack vector as well. A recent presentation at the Black Hat conference showed how ad networks could be used as unwitting middlemen to create huge, cheap botnets."

3 of 105 comments (clear)

  1. Yep, that. by intellitech · · Score: 5, Informative

    Ghostery and Adblock FTW.

    --
    vos nescitis quicquam, nec cogitatis quia expedit nobis ut unus moriatur homo pro populo et non tota gens pereat.
  2. Like hell they do by WD · · Score: 4, Informative

    If you care about security, you're running NoScript. And they do not run.

  3. The author is lying by SpicyBrownMustard · · Score: 4, Informative

    I've worked with several ad networks, on a number of issues, and can say with absolute confidence that the author has no concept of how the technology actually works, which results in an outright lie in his thread-starter.

    The JavaScript code originates with the ad delivery platform (DoubleClick, OpenX, 24/7, etc.), sometimes outsourced to the ad networks -- DoubleClick is a white label delivery platform for many ad networks. The JavaScript is tightly controlled and constantly subject to real-time auditing by several providers such as The Media Trust. The advertisers simply provide the assets -- the banner creative -- that is delivered by the ad network, optimization systems, and ad delivery platforms.

    Currently, yes, it all sucks and is why we have had blockers, but is also the only option to monetize free content -- for now.