Slashdot Mirror
Ad Networks Lay Path To Million-Strong Browser Botnet
jfruh writes "Every day, millions of computers run unvetted, sketchy code in the form of the JavaScript that ad networks send to publishers. Usually, that code just puts an advertiser's banner ad on a web page. But since ad networks and publishers almost never check the code for malicious properties, it can become an attack vector as well. A recent presentation at the Black Hat conference showed how ad networks could be used as unwitting middlemen to create huge, cheap botnets."
Ghostery and Adblock FTW.
vos nescitis quicquam, nec cogitatis quia expedit nobis ut unus moriatur homo pro populo et non tota gens pereat.
The equivalent on Chrome is "NotScripts".
The man who dies rich dies disgraced. -- Andrew Carnegie
If you care about security, you're running NoScript. And they do not run.
...why we use adblock and noscript, whining that we deprave them of income.
It's not that your ads are obnoxious, albeit even that alone would suffice as a reason. They're dangerous to us.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Thats the reason why I use adblock, I only block the adnetworks, not the local site served stuff.
If site operators want me to view ads, then they bloody well can vet them and host them themselves.
The problem is less that I need all the bells and whistles. The problem is more that a sizable portion of webpages simply doesn't work without its bells and whistles.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
I've worked with several ad networks, on a number of issues, and can say with absolute confidence that the author has no concept of how the technology actually works, which results in an outright lie in his thread-starter.
The JavaScript code originates with the ad delivery platform (DoubleClick, OpenX, 24/7, etc.), sometimes outsourced to the ad networks -- DoubleClick is a white label delivery platform for many ad networks. The JavaScript is tightly controlled and constantly subject to real-time auditing by several providers such as The Media Trust. The advertisers simply provide the assets -- the banner creative -- that is delivered by the ad network, optimization systems, and ad delivery platforms.
Currently, yes, it all sucks and is why we have had blockers, but is also the only option to monetize free content -- for now.
We were using java, flash and javascript to do this sort of stuff as early back as 1996.
Massive DDOS attacks were generated this way.
Even played around with Distributed computing all from banners place on various web sites.
We were able to run stuff in browsers that was next to impossible to remove.
And with browsers restoring all the windows most common users would never figure out how to kill these things.
I am always doing that which I can not do, in order that I may learn how to do it. - Pablo Picasso
The old non-JS discussion system is still there. To enable it, follow these steps:
- Click your user name at the top of the page
- From the pop-up menu, click on Account
- From the pop-up dialog's top bar, click Discussions
- Select the Classic Discussion System (D1) radio button
- Click the Save button
Was this answer helpful: yes or no? Would you also like to send all information from your computer to assist us in improving the performance and responsiveness of our product?