Slashdot Mirror
Yahoo Advertising Serves Up Malware For Thousands
wjcofkc writes "Thousands of users have been affected by malicious advertisements served by ads.yahoo.com. The attack, which lasted several days, exploited vulnerabilities in Java and installed malware. The Netherlands based Fox-IT estimates that the infection rate was at about 27,000 infections per hour. In response to the breach in security, Yahoo issued the following statement, 'At Yahoo, we take the safety and privacy of our users seriously. We recently identified an ad designed to spread malware to some of our users. We immediately removed it and will continue to monitor and block any ads being used for this activity.' While the source of the attack remains unknown, Fox-IT says it appears to be 'financially motivated.' The Washington Post cites this incident as a reminder that Java has become an Internet security menace."
As far as I've been concerned, Java and Javascript have both always been security menaces.
Letting web-sites and advertisers execute code has been a recipe for problems for a long time, which is why many of us here likely already block it.
This is just another example of why we can't trust the companies doing the advertising, because they're part of the problem -- if Yahoo is serving malware, Yahoo can't be trusted.
Lost at C:>. Found at C.
They'll continue to monitor, as in do something about a malicious ad once someone else identifies it and spreads the word.
Hey samzenpus, you better have another job lined up.
Netcraft confirms http://beta.slashdot.org is dying!
This wouldn't be an issue if they could only serve image or text only ads. Possible image based exploits can easily be prevented by re-saving the uploaded image so that the image only contains valid content.
But no, ad farms want to provide functionality to reach maximum annoyance for the users. You can blame Java all you want, but it's not the source of this problem.
Source unknown? Bullshit! Yahoo didn't run the ads without payment. Payment == traceable. Or is Yahoo accepting Bitcoins now?
It has been my contention that when websites no longer serve malware through Ads, then they can start complaining that users blocks ads. This is not an uncommon occurrence, even for large websites, and the fix is not always immediate. I recall not that long ago when the New York Times was serving malware for the entire weekend.
"She's a scientist and a lesbian. She's not going to let it slide." Orphan Black
a reminder that Java has become an Internet security menace
Java has always been a security menace.
Trolling is a art,
Java is a much safer language than say C because of the built in checks. It's the proprietary crappy browser plugins that make this kind of attacks possible.
... using ad blocking and/or host files to deep-six ad networks not only produces a nicer user experience, but it's a valid security measure.
Trusting the web site is not enough. You have to trust the ad network too. Since any Joe Schmoe can buy ad space on an ad network, trusting the ad network means you're trusting Joe Schmoe.
I don't know about you guys, but I don't.
--
BMO
New Yahoo Mail = complete unusable dog shit
New Flickr = complete fuck up! They don't even read user feedback.
New Ad delivery = source of malware! Even porn sites don't do that.
I kept my old Yahoo webmail accounts but use Thunderbird to read those as well as Gmail. Avoids dealing with asstastic webmail page layout as well as being bothered with adverts.
"This post is an artistic work of fiction and falsehood. Only a fool would take anything posted here as fact."
If that's the whole statement, then wow... that's really pathetic.
Spent All My Mod Points
" Fox-IT says it appears to be 'financially motivated" (Insert Nicolaw Cage "you don't say" pic here) Also, Yahoo has the billing info, IP address and username of the fine fellows behind this. Can't they sue them, or at least publish that info? Oh, I forgot, that would be "aggravating a partner" which is bad for the bottom line...
For the idiots who say with a smile they do not run AV software and think they are malware free because they don't click on anything, I told you so.
Some people even on Slashdot do not have a basic understanding of online security. Yes Linux Trojans exist too because like Mac users you all think you are invulnerable.
Basics: if you must use Java disable it in your browsers or put it in intranet zone only if you use IE at work. Disable adobe reader from launching automatically. Use foxit if you can or disable it in browser launching in which I do. Use flashblock and adblock. Even IE has adblock these days. Last do not run a browser with an admin/root account! In Windows I use a separate limited/standard account and do not browse as root in Linux. Doh. Run Windows updates!! But they may break my apps .... Please. I never had an issue and my security is worth it. Do that and these attacks will be plugged 90% of the time.
Do these in addition to not clicking on shit and then your system will be pretty darn secure.
http://saveie6.com/
> "The Washington Post cites this incident as a reminder that Java has become an Internet security menace."
That should read "The Washington Post cites this incident as a reminder that advertising has become an Internet security menace."
Adblock+ -- part of a sensible security policy.
Ian Ameline
The moment that Yahoo allowed advertisers to use java they knew that minimally those ads would be used to annoy the crap out of the users. If your ad is a static picture with a clickable link then you don't need Java. What you need java for is to start prying into the user's business. Animations, sound, geolocations, saving data to the user's machine. So any "legitimate" ad using Java is halfway to being malware already. Plus why use Java instead of Flash? Generally ads should be made by Graphic artist types who are more familiar with Flash. Thus the primary reason to use Java is to access some feature that flash has blocked in Flash.
So if your goal with a Java ad is to circumvent something that Adobe has blocked then it probably should remain blocked. On top of that most users have turned off Java so it can't be to reach a wider audience.
So when Yahoo allows advertisers to use Java they knew perfectly well that the advertisers were up to no good whatsoever. Their acting surprised that some of the scumbags took it even further is total BS.
Basically at this point, anyone who has Java turned on in the browser is the same as having a house with a weeks worth of newspapers stacked up at the front door. Effectively a greeting card inviting the criminals in.
You can read about Java as the Internet security menace in the link above, but first you need to enable Java Script to read the article.
new letter/phrase: hex-u means "www"
Yahoo Advertising Serves Up Malware For Thousands
The attack, which lasted several days... the infection rate was at about 27,000 infections per hour.
That's nearly 2 million at least. C'mon Slashdot, it's not like you to supply a less sensational headline than necessary.
systemd is Roko's Basilisk.
I used Lynx up until 2010 until I realized that it might be compromised. So now just telnet to port 80 and manually send GETs and POSTs.
The source is a Yahoo ad customer. Do they not know who pays them? Or do they not want to lose a paying customer by outing them?
The ad didn't contain a Java applet.
It directed people to a website that then delivered the malware. Apparently it automatically redirected the browser, but that hasn't been confirmed.
So Yahoo allow Javascript in the ads, not Java.
Because there isn't really much wrong with Java, from a security point of view.
The Oracle Java Browser plugin on the other hand, is pretty dodgy.
Java zero days are easily avoided by using "click to play", which does exactly what it sounds like: disable flash and java applets until you click them. In Chromium, this is easily enabled in Settings -> Show advanced settings -> under "Privacy", Content Settings -> choose "Click to play" under Plug-ins.
Java (and Flash likewise) has never been safe, and it's a shame that click to play is not the default. Additionally, animated ads are often Flash or Java-based, so this also kills distracting movies.
You don't need javascript to read that article. The text and photo are at the bottom of the page. Just scroll past all of the whitespace at the top and you'll fine it.
If you're a zombie and you know it, bite your friend!
]You can read about Java as the Internet security menace in the link above, but first you need to enable Java Script to read the article.
That, or disable CSS (e.g. View/Page Style/No Style in Firefox).
As usual (unfortunately). Both the article and the summary are pathetic examples of journalism which should try to at least inform.
For instance, it would be useful to know (at a minimum) which OSs, browsers, etc are vulnerable, whether any of the virus detection programs will block or remove the malware and what effects the malware has on systems when they are infected.
In other words, this article is just "scareware" warning about some unspecified threat to do something bad to somebody and no idea who, what, when or where.
I don't read your sig. Why are you reading mine?
Hence why I advise people to install AdBlock on their browsers. The way things have been for the pas few years, it's probably more effective than antivirus software. (Before you flame me, I am speaking tongue-in-cheek. You really should have both.)
People still visit yahoo's website? How quaint!
Wow, that's hard core.
The big three browsers can trivially block Java, through something as simple as "click to play", or "always launch plugins from this site". Any browser that auto-executes stuff by default is broken.
On the other hand, I've had a malware distribution attempt via Javascript. It's certainly designed to attack Chrome, since it wipes the previous page content and URL, replacing it with its own.
Oh, and a trivial Javascript exploit that browsers took 10+ years to fix.
Adblock plus. Is all you need to know. In settings dont allow some.
should not default to allow any. Let the use take the risk in allowing do not assume it for me unless your going to pay for my damages.
...this is their Raison d'être - "advertisments - malware for the brain."
Requiem for the American Dream
"...reminder that Java has become an Internet security menace."
Actually, the largest menace is Javascript. That's why so many people use NoScript.
Any kind of in-browser active code execution will inevitably have security challenges.
I don't have Java installed. I run linux, but Java is cross-platform, and I don't fall into the "it can't happen here" camp. Besides, I save a few hundred megabytes of disk space by not installing Java.
Flash is another issue altogether. I follow one forum that autoruns Flash movie ads on occasion. If you hovered over the ad, it would enable sound too.Firefox used to lock up for a few minutes. Running with system load = 3 or 4, on a 2-core machine is begging for thrashing/near-lockup.
I now use 2 browsers...
1) one browser has Flash disabled entirely
2) the other one I launch when I see a link to Youtube/whatever. When the video finishes, I close it. The taskbar has a mini-version of "top" running. Sometimes, after turning off the Flash browser, I'll watch the system load fall from 1.3 down to 0.3... satisfying.
I'm not repeating myself
I'm an X window user; I'm an ex-Windows user
Why do apk's posts remind me of reading a Dr. Bronner's soap label?
Can you think of any advantages to in-browser ad blockers?
Oh man, that stuff. It's like the Time Cube of liquid soap.
Rampant carbon sequestration destroyed the Dinosaurs' tropical paradise. I'm here to help repair the damage.
A/V doesn't protect against a lot of this stuff. Malwarebytes has a new anti-exploit beta for us Windows folks.
From the FAQ:
17- What techniques does MBAE use to detect and block exploits?
MBAE incorporates multiple exploit detection and blocking techniques at different stages of the typical exploit attack to provide a truly complete solution against all types of current and future exploits.
Stage 1 Layer: This layer of MBAE incorporates multiple techniques to detect and block exploits during stage 1 of the exploit attack, before the shellcode is allowed to run. In some cases, MBAE detects and prevents exploits before the operating system Data Execution Protection (DEP) protection.
Stage 2 Layer: This layer of MBAE incorporates multiple memory protection and payload execution techniques which prevent exploits from executing their stage 2 payload, thereby protecting the computer even if operating system protections and stage 1 protection techniques have been bypassed.
Most people running something other than IE with an ad block or script block most likely never would have had any problems. My boss still likes IE for whatever reason, needless to say Im at his computer every month or 2 removing spyware, viruses or a total computer hijacking (pay us 100$ to unlock this pc). Last virus he picked up was from an ad on msn.
With all due respect, his post was a lot more insightful than yours. You don't appear to know what you're talking about.
First of all, "deployed the same way" as in "deployed using an HTML <object> or <applet> element that instructs the browser to download and execute the code". The Microsoft Visual C++ redistributable runtime does not include any such mechanism for deploying C++ code. For that matter, not all Java runtime installations do either.
Second, just what do you think ActiveX is programmed in? Hint: it's not its own language. It's a packaging system for COM classes, which are almost without exclusion written in C++, and it *is* possible to deploy and run it in the browser in much the same way as Java applets (object tags). Unlike Java, they run with basically no sandbox but instead require considerable amounts of confirmation before they download. The idea is that they are powerful but unsafe, so only use the ones that you trust. Unfortunately, a number of pre-installed ActiveX controls on Windows have security vulnerabilities in them, so an attacker who finds a way to exploit one of those pre-installed ones doesn't need to get the user to download anything. Hence the way that modern versions of IE require the user to confirm before running an ActiveX control that they've not previously indicated that they trust (and also give you an ability to disable ActiveX completely or only enable it on a site-by-site basis).
I don't care for the Java installer any more than you do, but the security issues with Java applets have literally nothing to do with the language. The only way you could say Java itself is at fault is if you were to argue that Java shouldn't have any OS bindings at all (that is, no ability to access the file system, no ability to create processes, no ability to open network sockets, etc.). This is essentially the situation with JavaScript, of course; while the Java applet sandbox tries to *restrict* the use of functionality like I just mentioned, the JavaScript runtime (as found in browsers) simply lacks APIs to access such risky features. Even there, though, that's not a characteristic of the JavaScript *language* but merely of the sandboxed runtime used to execute JS in the browser. Other uses of JS, ranging from Windows Script Host to Node.JS, are perfectly capable of doing such things.
There's no place I could be, since I've found Serenity...
HTTP Switchboard. This puts to rest all the false claims out there that Chrome doesn't have the proper API to block scripts. This thing does what NoScript, Request Policy and AdBlock do all together, plus it has nice privacy enhancing options.
The only problem I have with using HOSTS is that it requires updating to be of use and when it comes to customers? If I did my job right hopefully I won't be seeing them again for years. With ABP and Privdog I don't have to worry about "will they update the thing" as it is done automatically with the latest version every time they launch the browser.
That said I've found a way to go one better than HOSTS, at least for me and my customers, remember how I ran my own DNS? Well I don't have to do that now that Comodo offers their secure DNS for free and with Dragon and IceDragon I can have the browser and ONLY the browser run through their secure DNS. This way anything like games or Steam can hook up directly while the biggest attack vector, the browser, is filtered. Its nice, again auto updating, and best of all for me its a "set and forget" so once set I don't have to ever touch it again and in point of fact since making ads verbotten the only infections I see now are social engineering (Yuo want teh tittiez? Run "Iz_Not_Viruz_Iz_Codex" to see teh hot tittiez!) or when they get "toolbarred" because they refuse to read EULAs. All the actual bugs? Gone, zip zero zilch nada squat.
ACs don't waste your time replying, your posts are never seen by me.