Slashdot Mirror
Ad Networks Lay Path To Million-Strong Browser Botnet
jfruh writes "Every day, millions of computers run unvetted, sketchy code in the form of the JavaScript that ad networks send to publishers. Usually, that code just puts an advertiser's banner ad on a web page. But since ad networks and publishers almost never check the code for malicious properties, it can become an attack vector as well. A recent presentation at the Black Hat conference showed how ad networks could be used as unwitting middlemen to create huge, cheap botnets."
For Firefox fans there is an add on called "no script" that prevents Javascript from running automatically. There should be an equivalent for Chrome folks too.
I just block the ad networks.
now we need to go OSS in diesel cars
Ghostery and Adblock FTW.
vos nescitis quicquam, nec cogitatis quia expedit nobis ut unus moriatur homo pro populo et non tota gens pereat.
You mean there are other attack vectors, too?
From what I've seen, it seems like ad networks are either the main form of malware vector, or at least close to it. It isn't true proof, but I have had no issues with infections when using AdBlock and an add-on blocker (even if it is Chrome's "click to play" item), but if I fire up a VM and go browsing without those utilities... all hell breaks loose. Antivirus utility? Yeah, right. Those are OK for maybe scanning an infected machine's HDD that is mounted on another box. However, rootkits, especially RAM based ones will still be a gotcha.
I see nothing good about ad servers. They are a vector for malware at worst, at best, are a constant source of behavioral tracking and monitoring. At best, they throw a few bucks a month at sites that use them.
I like the idea of a subscription clearinghouse and micropayments, but there are issues of privacy and anonymity to be worked out.
Well, it's scary enough to make me want to turn off Javascript (unless I'm running Firefox—and I'm not—and can't turn it off). But Javascript provides to web pages features and abilities that I'd rather like to keep. For example, I love AJAX and how it allows a sufficiently sophisticated browser to do something like what Google did with Gmail. When I first saw Gmail my jaw dropped. "WOW!" I knew then that the thick client's life was limited. But as things get more and more nasty I'm wondering if perhaps the thick clients are not a safer approach for some applications.
It's really quite a simple choice: Life, Death, or Los Angeles.
I just block the ad networks.
If you're a content provider and are concerned about ad blocking hitting your bottom line then you need to be in your ad provider's face about this shit or I don't wanna hear any bitching.
...I blanket-block all ads. As much as I don't like ads, I'd tolerate them if they had the trust they need to _earn_ to run Javascript/Java/Flash content on my machine.
You trust Oracle Java and Adobe Flash enough to run them on your machine?
If you care about security, you're running NoScript. And they do not run.
Nice to know BlackHat has finally caught up with 2007 when malvertising was publicly identified as an issue (see https://isc.sans.edu/diary/Malvertising/3727). Strange that people actually working in the anti-malvertising world have never heard of these researcher's work.
I guess we can ignore RiskIQ and Twitters purchase of Dasient. The tens of millions a year spent on prevent malvertising is clearly "nothing". The methods being used might not be as effective as some want, it isn't due to a lack of funding. After 42 years we still can't reliably stop malware.
adblock plus? done :/
"That's right...I said it."
...why we use adblock and noscript, whining that we deprave them of income.
It's not that your ads are obnoxious, albeit even that alone would suffice as a reason. They're dangerous to us.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I've worked with several ad networks, on a number of issues, and can say with absolute confidence that the author has no concept of how the technology actually works, which results in an outright lie in his thread-starter.
The JavaScript code originates with the ad delivery platform (DoubleClick, OpenX, 24/7, etc.), sometimes outsourced to the ad networks -- DoubleClick is a white label delivery platform for many ad networks. The JavaScript is tightly controlled and constantly subject to real-time auditing by several providers such as The Media Trust. The advertisers simply provide the assets -- the banner creative -- that is delivered by the ad network, optimization systems, and ad delivery platforms.
Currently, yes, it all sucks and is why we have had blockers, but is also the only option to monetize free content -- for now.
We were using java, flash and javascript to do this sort of stuff as early back as 1996.
Massive DDOS attacks were generated this way.
Even played around with Distributed computing all from banners place on various web sites.
We were able to run stuff in browsers that was next to impossible to remove.
And with browsers restoring all the windows most common users would never figure out how to kill these things.
I am always doing that which I can not do, in order that I may learn how to do it. - Pablo Picasso
If you're a content provider and are concerned about ad blocking hitting your bottom line then you need to stop using ad networks and host your own ads or I don't wanna hear any bitching.
FTFY
It stuns me that media operators who have run their own in-house advertising divisions for their dead-tree versions for decades, suddenly act like one-man amateur blogs for their online versions, needing third-party-hosted ad networks.
Science is all about firing a drunk pig out of a cannon just to see what happens.
I think the reason for that is that they aren't just ads anymore - they're collecting intelligence on the visitors. It doesn't work as well when you host the ads on your own, you need a third party to be able to track what pages your visitors are navigating to when they navigate away from your own site (assuming of course the site they navigate to is within the ad provider's network) as the web browser isn't going to allow multiple domains to share information.
It's one thing to show sponsored messages to users, but it's even more profitable to find out what your users want. Self hosted ads aren't as good at the later.
Careful with names containing L slashdot.org/~AiphaWolf_HK slashdot.org/~AlphaWoif_HK slashdot.org/~AiphaWoif_HK
Damn good thing that Firefox 23 makes javascript obligatory:
http://news.slashdot.org/story/13/07/01/1547212/firefox-23-makes-javascript-obligatory
From TFA:-
Assuming you're using the latest Firefox with Adblock and Noscript, how true is that claim?
Would it, for example, stop the ad network attack vector mentioned in TFA?
I used to assume running Noscript is sufficient protection, but with all the news of exploits floating around, I'm no longer sure.
How do you disable Java or 3rd party ads on platforms like iPhone or iPad?
Java isn't support on iDevices.
You must be confusing Java with Javascript. Which ... ... IS NOTHING TO DO WITH JAVA AT ALL.
Please hand in your geek pass to the DHS official and make your way to gitmo. Oh wait. They only do that for leakers...
The old non-JS discussion system is still there. To enable it, follow these steps:
- Click your user name at the top of the page
- From the pop-up menu, click on Account
- From the pop-up dialog's top bar, click Discussions
- Select the Classic Discussion System (D1) radio button
- Click the Save button
Was this answer helpful: yes or no? Would you also like to send all information from your computer to assist us in improving the performance and responsiveness of our product?
Why don't they fix javascript, limit it to a handful of requests so it can download its data but not spam requests in a loop? Disable its popup ability, too. I have never needed it, and if I did, I'd be happy to click an open window approve box.
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
1. Disable third-party cookies
2. Install Adblock Plus + Element Hiding Helper
3. Install NoScript
4. Install DoNotTrackMe
5. Turn on the worthless "Do Not Track" header, if only just to further get the point across.
6. Clear cookies if you previously went to sites before disabling them, because you've likely got some Facebook tracking garbage on your machine.
Done.
Unless they are paying for their ads using anonymized Bitcoins couldn't the ad company be served a warrant and the perpetrator found through the payment records?
There are three metrics for ads online. Impressions, clicks and conversions. Ad companies get paid for each at different rates.
The ads may read a cookie set previously or will set a cookie using an iframe. It has a beacon gif to log impressions. The destination reads the cookie using an iframe with same domain as prior. It also uses a beacon to log impressions.
The cookie tells the ad network: this user came from campaign id xxxxx. That cookie will also be read again on an order confirmation or any conversion success page (a thanks page for sign up or whatever).
So you have a beacon on the content site (payee) for impressions, a cookie set to track click throughs across domains via a 3rd party iframe and beacons on the destination (payer) to log click throughs and possibly conversions.
The beacons will send back a set of data including the campaign id, user agent info, time stamps, and anything needed by the contract which is provided by the payer, eg If its an affiliate program then the order subtotal (no tax or shipping) will be sent to log a commission. The user agent and and uid are used for analysis and segmentation to do things like a/b testing an offer (will a 5% or 10% discount work better - 5% is often good enough to drive traffic and 10% may not convert to higher sales).
A fool throws a stone into a well and a thousand sages can not remove it.
Its independent and doesn't slow my browser down like Ghostery does. The latter isn't really written with users in mind... its primary purpose is to give the ad industry a 'self-compliance' fig leaf.
And that is part of why people object to them (other trhan giving you cooties that is). No other medium has had the ability to automatically track people who read the ads and they have done fine. Some tracking for conversions can be done with discount codes or through the url in the ad.
I'll bet if the ad networks are held liable for malware they distribute, they'll suddenly be fine with those limitations.