Slashdot Mirror
Google's Doubleclick Ad Servers Exposed Millions of Computers To Malware
wabrandsma (2551008) writes with this excerpt from The Verge:
Last night, researchers at Malwarebytes noticed strange behavior on sites like Last.fm, The Times of Israel and The Jerusalem Post. Ads on the sites were being unusually aggressive, setting off anti-virus warnings and raising flags in a number of Malwarebytes systems. After some digging, researcher Jerome Segura realized the problem was coming from Google's DoubleClick ad servers and the popular Zedo ad agency. Together, they were serving up malicious ads designed to spread the recently identified Zemot malware. A Google representative has confirmed the breach, saying "our team is aware of this and has taken steps to shut this down."
It is stuff like this that just demonstrates how annoying the internet ad delivery mechanisms are. Not only are they intrusive, bandwidth wasting, and often impairing my user experience, they can also spread malware.
I use Adblockers / flashblocker and NoScript.
And I utterly will not reconsider for any reason.
Stupidity is sufficient.
I have been blocking doubleclick on the corporate firewall for years, and in every hosts file I come in contact with. No one ever complained, but now if they do, I have ammunition. If you serve up a web site, you should personally vouch for not only the product you are advertising, but the source of the advert as well. I blame Google for placing advertising dollars above their users (I know, they don't have users, they have sheep for fleecing).
You're wrong!
The CIA and NSA are direct arms of Google.
So to all those site operators that cry foul when I say I block all ads all the time: This would be why. It's not because I object to being shown products I might be interested in. It's not because I'm trying to hurt your revenue stream. It's because ad delivery servers are so ubiquitous, they're a major malware vector.
Sorry, but funding your site is not worth my entire network getting infected. You want me to change, lean on the advertisers to stop pushing security responsibility solely on the end user.
One of the best endpoint security tools you can deploy.
DoublcClick has such negative value that their servers should be blocked at firewalls, or at least "host.txt". Even if you have AdBlock, blocking them earlier saves bandwidth.
... and doubleclick in particular, do not get past my firewall. Among the reasons I block 'em is this malware distribution issue.
pubads.g.doubleclick.net/gampad/ads?gdfp_req=
blocked by three different rules
d3.zedo.com/jsc/d3/fo.js
blocked
static.the-button.com/d2.php
blocked by a five-year old exploit protection rule
inter.wiab-service.ge/geobalancer/geo2.php
blocked (alright, by a geo-location rule, but still blocked!)
I don't think that one stood a chance here.
Anyone still using Proxomitron with Sidki scripts?
I can tell you're trying to trade off APK's "valuable reputation" too because the capitalization pattern doesn't match.
No, agregation into packages is completely unacceptable.
Then be prepared to pay $19.99 per year for each website, even if you plan to view only one page on that site, because you are unwilling to pay for bundles of multiple sites. Look at 50 different sites one month? That'll be a thousand dollars.
malwarebytes (imply that they) reported this on 30 August. Did they report it to Google?
Nearly 3 weeks till it was shutdown on the 19th. That's a hell of a lot of malware getting dished out.
I am not a robot. I am a unicorn.
I've been hearing this since 1995. It's getting old...
Not good enough. There are many:
0.0.0.0 ad.doubleclick.net
0.0.0.0 ad.uk.doubleclick.net
0.0.0.0 ad.n2434.doubleclick.net
0.0.0.0 doubleclick.net
0.0.0.0 a.doubleclick.net
0.0.0.0 b.doubleclick.net
0.0.0.0 c.doubleclick.net
0.0.0.0 d.doubleclick.net
0.0.0.0 e.doubleclick.net
0.0.0.0 h.doubleclick.net
0.0.0.0 i.doubleclick.net
0.0.0.0 j.doubleclick.net
0.0.0.0 k.doubleclick.net
0.0.0.0 l.doubleclick.net
0.0.0.0 m.doubleclick.net
0.0.0.0 n.doubleclick.net
0.0.0.0 o.doubleclick.net
0.0.0.0 p.doubleclick.net
0.0.0.0 q.doubleclick.net
0.0.0.0 r.doubleclick.net
0.0.0.0 s.doubleclick.net
0.0.0.0 ad.ar.doubleclick.net
etc...
DNS proxy, or BIND with RPZ technology , *.doubleblick.net
Please be objective in the articles. Windows computers, not "computers". And no malware here, adblock+host files to 127.0.0.1+OS/X+iOS
I worked at Zedo pretty early on. I did a year there, pretty much exactly year 2000 (now coworkers now know who I am).
I was their C guy, did an apache module for the adserver, and some mild javascript work until they got a better Javascript coder than me. I also helped out a bit in Java and DB work, and most of the Linux/FreeBSD sysadmin for a bit. We were in a small live-work loft in SOMA where I walked through two slums to get to work.
In the beginning, it was about "choice". We had a small on page ad client. At first a Java one, then a Javascript one, with a GUI that let you choose your ad. It was new, different, and a way to try to get people the ads they want and not have to keep huge track of users. (You can check the patent out if you like though I can tell you this was theoretical design and it wasn't built this way). It put the emphasis on the ad, not on the tracking. Ads needed to be designed to be engaging or they'd just be skipped. We kept track of your ad choices, not your pages. It was fun, true startup culture. We were going after the (then) mighty Doubleclick, railing the fact that they stored too much info. I remember tailing the server logs on our first paying gig, cheering as I noticed the URI fragment for the first ad clickthru. We checked the guys IP address, noticed he had an ICQ run webserver on his box, and talked to him over ICQ thanking him for clicking. In hindsight, yeah, that must have freaked him out.
We didn't see Google coming to crush the ad market at all. I had already left but Im sure Google's elephant sized footprints in the market made them radically change their business plan. I didn't talk to them much, and on the web I read stories about intrusive Zedo cookies, heard them called "king of the popunder" and heard stories about "popup blocker blockers". This made me a bit sad, why do all that? But I guess you either do that, or throw in the towel and close up shop. I can't say what I'd do if it was my savings on the line.
As an aside (always a tangent!) I had an 8MM videocamera. Though I filmed some stuff in San Francisco (hey Dave, any news on the video for me?) I always wanted to film us. But I couldn't both work and film. I was actually slightly pissed when Startup.com came out. Hey that was my idea! But you can't objectively film what you're in.
ads != doubleclick.
There are ways for sites to include advertising without surrendering their site to third-party-hosted malware. Many ways which aren't even blocked by adblockers by default. It's a bit more work for them than just using doubleclick/etc, but it's worth it.
So you're really saying that all the stupid/lazy sites will die off or retire behind paywalls. Surely that's "mission fucking accomplished."
(I'm constantly amazed that newspaper and TV-network sites mindless use doubleclick/etc for their websites, even though they have large advertising/marketing departments for their non-web products. You are already paying for an ad department! You already have a network of advertisers! You already have their actual ad-content on file! Why are you giving money to another company to do what you already do yourself and have done for over half a century?)
Science is all about firing a drunk pig out of a cannon just to see what happens.
I can't begin to say how many times Google's doubleclick ads have set off the "This website may damage your computer", even though I I'm relatively protected, as I use a Mac, and the warnings come from, of all places, Google Chrome!. It then warns me that if I choose to continue, "bad things" might happen.. However, it doesn't actually allow me to continue. So why the warning at all about what could happen? Go figure...