Slashdot Mirror
Hackers Exploit Adobe Flash Vulnerability In Yahoo Ads
vivaoporto notes a report that a group of hackers have used online ad networks to distribute malware over several of Yahoo's websites. The attack began on Tuesday, July 28, and was shut down on Monday, August 3. It was targeted at Yahoo's sports, finance, gaming, and news-related sites. Security firm Malwarebytes says the hackers exploited a Flash vulnerability to redirect users to the Angler Exploit Kit. "Attacks on advertising networks have been on the rise ... researchers say. Hackers are able to use the advertising networks themselves, built for targeting specific demographics of Internet users, to find vulnerable machines. While Yahoo acknowledged the attack, the company said that it was not nearly as big as Malwarebytes had portrayed it to be."
Yahoo will not know how successful this attack was, since the traffic doesn't pass through their servers.
Now tell me again why I shouldn't block ads...
We need to ban ads immediately to protect ourselves from this threat. We cannot sit idly by any longer. Ads have been attacking our computers for too long. The time to act is now!
seriously all those who insist that ads must not be blocked have been evading the corresponding responsibility
That's not even funny anymore.
I've got it disabled for a while now, but for a lot of people it's not an option.
Let's get rid of it!
Irrelevant news and morons using moderation to mod down what they disagree on. 2018 resolution: so long.
Aside from reflexive ass-covering, which is to be expected; Yahoo(and any of their ilk in the advertisement slinging business) have a fairly obvious incentive to deny the seriousness of the problem.
Ad networks are a ghastly open sewer of shoddily vetted and frequently dangerous crap; usually served agonizingly slowly and heavy on Flash and scripts and crap. Even better, ads offer a nice way to hit a broad selection of users, across sites, and without needing to compromise specific operators or lure people into the seedy side of the internet where people stereotypically go to get unpleasant viruses.
Even if you are one of the 'But advertising experiences enable the content economy, ad-blockers are immoral and killing businesses, etc.' people, what do you say about the sheer danger? Leaving ads unblocked is about as safe as letting sewage into your drinking water distribution system. That's a problem. Fix your ghastly excuse for a platform, so I could at least let my guard down without getting cyber-syphilis, and then maybe we can have a chat about whether ads are wonderful or not. Until that time, don't even bother.
Using windows is like leaving your door unlocked. Using flash is like having no walls.
Friends don't let friends use Yahoo. Or Flash. Or ads.
A new web-based exploit is known as "a Tuesday", in the same way that a boot sector virus is "a monday", and a .EXE virus is "a wednesday".
A common thread of malware is that it uses whatever means to automatically execute without user interaction. Simply prevent stuff from automatically executing (NoScript, Flash block, or click-to-play), and the infection rate will become negligible - and perhaps more traceable in real-time.
You know what, stop telling us about Flash vulnerabilities ... when Flash hasn't been used in an exploit in several months, that will news worthy.
In the mean time, I assume Flash is the same old piece of shit security hole it has been for as long as it has existed.
Letting every web page execute arbitrary code on your machine has always been idiotic.
I'm with you, I'll continue to treat all ads as hostile entities and gaping security holes. Javascript will require whitelisting only if I really want your site and trust it somewhat, and Flash will always be blocked, because it's never been something you can trust.
Flash is defective, has always been defective, and it's time to make it go away.
Lost at C:>. Found at C.
I've been using ad-blocking extensions for 10+ years... I've found that blocking ads is a lot more useful than any AV program (barring Malwarebytes which actually blocks by IP) ever can do.
Toss a VM/sandbox into the mix, and security is decent. Not 100%, but good enough to resist most attacks.
You know what, stop telling us about Flash vulnerabilities ... when Flash hasn't been used in an exploit in several months, that will news worthy.
I think the hope is that if we keep bashing Flash that eventually it will go away forever. We're almost there but some lazy/cheap websites still cannot be bothered to update and ban flash entirely. Frankly if Adobe were a responsible company they would simply abandon flash altogether and that might finally move things along but that's almost certainly a pipe dream.
This event highlights - once again - the need for browsers to provide tighter control over scripts that are allowed to run. It is totally unacceptable that browsers in this day and age don't provide some sort of built-in mechanism to selectively permit or deny execution of remote code (no, "disable everything everywhere" doesn't count). Ideally, each "script" that requires external plugins (flash, java, ...), should be treated as dangerous, and should only be played on demand. Other scripts could be allowed in an opt-in basis, with the scripts from the "current" domain being allowed to run by default (presumably, if your navigate to a site, you trust it, right?).
Yes, we need provisions to deal with CDNs and such, but this would be a good start.
Their front page has turned into a mud pit of ads, it's all content from other sites, I can't see any compelling reason to go there in the first place and then they become an attack vector.
That's our life, the big wheel of shit. - The Fat Man, Blue Tango Salvage
i said it before and i'll say it again.
there are very few reasons to keep flash installed/enabled. if you must have it, use flashblock but chances are you can just disable/remove it completely. if some site still uses flash to play video, leave a complaint in the comments. those that haven't switched to html5 yet will do so soon enough.
if you still have java plugin installed, you better have a good reason because no (sane) sites use that shit.
Anons need not reply. Questions end with a question mark.
stop outsourcing your webads to third parties so you have control of what gets served to your visitors.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
Even if I did feel some moral compunction to let my eyeballs be smeared with ads (which I do not), why should I, when they're so freaking dangerous?
Bullshit.
youporn, pornhub, both work with HTML5.
If your dedicated porn site still requires Flash, ditch it.
"For seven days, hackers used Yahoo’s ad network to send malicious bits of code to computers that visit Yahoo’s collection of heavily trafficked websites, the company said on Monday."
..
Would these be 'computers' be running Microsoft Windows
"When a computer — in this case, one running Windows — visited a Yahoo site, it downloaded malware code."
Yes it does !
"As with the previous reported cases this one also leverages Microsoft Azure websites" ref
All of the ads say 'Activate Adobe Flash'
VMware.
I've installed 167 Flash updates, each one of them claiming to provide better security... there can't possibly be any vulnerabilities left in Flash!
That that is is that that that that is not is not.
You are all ducks. Ducks say quack. QUACKKKKKK! QUACKKKKKK! Quack ducks quack! Quack say the ducks. YOU DUCKS!!
Swedish ones say KVACK!
oops - did I just have a Sum Ting Wong moment?
The shepherds did so well protecting the flock that the sheep no longer believed that wolves existed.