Slashdot Mirror
HTML5 Ads Aren't That Safe Compared To Flash, Experts Say (softpedia.com)
An anonymous reader writes: [Softpedia reports:] "A study from GeoEdge (PDF), an ad scanning vendor, reveals that Flash has been wrongly accused as the root cause of today's malvertising campaigns, but in reality, switching to HTML5 ads won't safeguard users from attacks because the vulnerabilities are in the ad platforms and advertising standards themselves. The company argues that for video ads, the primary root of malvertising is the VAST and VPAID advertising standards. VAST and VPAID are the rules of the game when it comes to online video advertising, defining the road an ad needs to take from the ad's creator to the user's browser. Even if the ad is Flash or HTML5, there are critical points in this ad delivery path where ad creators can alter the ad via JavaScript injections. These same critical points are also there so advertisers or ad networks can feed JavaScript code that fingerprints and tracks users." The real culprit is the ability to send JavaScript code at runtime, and not if the ad is a Flash object, an image or a block of HTML(5) code.
...but we are better without it :)
When people bitched and moaned about ordinary banner ads and started blocking them, advertisers started making ads more intrusive. We could still have simple animated GIF ads except that you freeloaders started blocking them to begin with. Those ads were harmless but, thanks to all of you who had to go and block those ads, we're now stuck with malware and far more intrusive advertising. Thanks a lot for ruining the internet for everyone.
B.S.
http://abcnews.go.com/Business...
http://www.foxnews.com/story/2...
X10 Pop Under ads ring a bell ?
And what do you know the fist example of Malvertising is Flash
https://en.wikipedia.org/wiki/...
With HTML5 ads, the attack surface is the browser. With Flash, the attack surface is the browser plus the Flash plugin.
Its possible to block js based ads as well, and blocking works really well, just look at the ad blocking extensions.
No, the actual reason for js was that it allows the advertisers to run their own analytics on the users. They can find out what site they browse, etc.
Use them. There is literally no reason not to.
Time and again we have seen that ads are used to inject malware.
Why even take the risk?
I'd rather fuck a stranger without a condom than browse without noscript and adblock.
A bad ad network is a bad ad network, whether they're sending out flash units, html5 units, or putting up billboards on a highway overpass. A middleman injecting malware doesn't care what the underlying tech is, they care about if the network vets their shit on delivery.
Nobody with a brain thought HTML5 was 'more secure' than Flash in of itself.
If anyone is to blame, I think it would be Mozilla for making Firefox irrelevant by trying to imitate Chrome, even when Firefox's users said very emphatically that they didn't want that.
Firefox used to have over 30% of the market. Now the latest market share stats show that Firefox is down to maybe 7% across all versions on the desktop, with essentially no mobile presence at all.
When Firefox had 30% of the market, it was a force to be reckoned with! It held real sway over how the web developed. But then it's like the Firefox developers decided to throw it all away, for no good reason at all. I think that they trashed Firefox's UI, they added unwanted crap like Pocket and Hello. They even embedded ads into Firefox! Now Firefox is down to just 7% of the market, and this number is dropping. Nobody cares about a browser with only 7% of the market.
And don't waste your time trying to blame Firefox's decline in market share on Google advertising Chrome, or mobile becoming more widely used than desktop browsers (which isn't actually the case), or any other bullshit excuse like that. It was the numerous unwanted changes that Firefox's developers made that drove a large mass of Firefox users away.
Firefox users were faced with a really bad set of choices: either they could use Firefox and get a slow, bloated Chrome-like experience, or they could use Chrome and at least get a fast, lightweight experience. So they did the only sensible thing and used Chrome, even if they hated it. At least it wasn't as bad as the alternatives!
I think that the web would have been very different if Firefox had been developed sensibly, instead of what actually happened to it. Chrome would probably be much less used, and we'd see a more open and less commercialized web. Mozilla could have turned Firefox into a champion of privacy and an ad-free web. Instead all we ended up with was a shitty imitation of Chrome that has no influence at all on the web.
They didn't block 'ordinary banner ads', they blocked pop-ups. Your troll-fu is weak.
"I like to lick butts!" by MobileTatsu-NJG (#32700246) (Score:5, Informative)
Eh, no biggie, just block javascript and flash... and HTML
“He’s not deformed, he’s just drunk!”
Who among us in the inter-webs or you-tubes (yeah.. slang) ... you know who you are.. thinks that there is any vector, avenue or north-star-ip-address that the abomination called advertising/malvertising/malware/state-sponsored attacks cares about our own personal computer security? No new protocol/process/add-in or anything ratified by the IETF isn't immediately subjected to the violent will of those people/agencies/acting-countries that don't care about you but only care about the end-result being their profits?
Don't get me wrong... Adobe Flash is the bane of my IT role but it was just another in a long series of attack profiles that I have to defend against. The list won't end.. the patches won't end because the actors that can profit from an exploit are like prisoners in a prison. They have time.. lots of time...
Peace out.
They are arguing that they will still be relevant, when the vast majority of their usefulness evaporates.
(If at first you don't succeed, do it different next time!)
Derp. The "real" problem with Flash is its use as a vector for installing malware via buffer overflow (usually) attacks. Those are distributed via ad networks.
Javascript injection is a separate issue, and there are other Flash privacy concerns, but that's not why people are screaming from the hills that Flash must be exterminated.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
You now have to download, trust & configure a third-party plugin to block javascript.
No, no plugin needed at all. You just need to:
1. go to about:config (read more about about:config here: http://kb.mozillazine.org/Abou...)
2. toggle the option javascript.enabled to false
And no, disabling javascript does not miraculously protect the user from almost all exploits. Some time ago, firefox has used a fonts library. Simply loading a font then could infect you. They've changed it since.
is that Adobe doesn't put enough $$$ behind security. It's not any easier for Google/Mozilla/Microsoft to do this but Google/Mozilla are open source and Microsoft has deep pockets and juicy gov't & corporate contracts as the incentive to spend money on security.
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
How many technologies have died in large part due to security issues? VB and VB Scripting, ActiveX, Silverlight, Flash, Java, Browser plugins: the list goes on.
So when is JavaScript going to be tossed?
It's frustrating for so many client end technologies to be tossed partly due to the security issues they brought.
In a way, I actually miss the days when most applications were written using VB or MFC style interfaces, and GUI widgets were being developed and released by the hundreds.
Are you shitting us? The advertisers would have never stick to gif and animated gif for their ads campaign. They want to know about you and everybody. The more they know, the higher they can charge for an advertisement campaign to their customers. They would have used any eye candy possible to get people's attention. So, that is completely false to say they would have stick to animated gif. They are basically blood suckers with a budget.
These f... morons should be threaten without pitty until they discipline themselves. The website owners don't like ad blockers and javascript blockers, however they are asking people to let these morons to penetrate our computers without any regrets. They can all go to hell if you ask me.
Achille Talon
Hop!
I had no idea the advertisers were so willing to so accurately describe their efforts. It's such a delightful misread that I'm starting to wonder if they were created with intent.
You should turn signatures off.
I don't believe the absurdity of this article, and this research paper! It's claims read as if contrived and there are no references to support them. Moreover GeoEdge then offers their own product as a solution to these claims.
Truth is you are not safe from malicious advertising regardless the vector, flash, Javascript or plain text email.
If something is moving on the page, it prevents me from reading. Why can't we just do static PNGs and JPEGs?
You gain nothing with that, for most people on the XXI century, the browser is the OS (or almost).
Time for an ad-intrusion rating system, somewhat like movie ratings. A site and/or ads that want to be rated would pay to be audited and rated. Browsers would have to option of skipping sites with poor ratings and/or shutting off images, JS, etc.
Because sites would risk losing traffic if they have poorly-rated ads, they'd have an incentive to pay for being rated and monitored.
It would probably take a mutual agreement among at least a few big tech companies to get enough momentum to take hold.
Table-ized A.I.
because muh bandwidth. Anything not related to the content I shouldn't have to download. Much like how I cut out all the ads in a magazine so I don't have to carry around its combined weight.
Global js disable is a bad idea because all sites need js to function. Why should the user be forced to run js inside some random ad? It's Firefox's fault for not blocking javascript from third-party domains. Third-party sites are welcome to show text or image ads, but they should not be allowed to run javascript code.
Blocking 3rd party js would also solve the problem of tracking by sites like google analytics and addthis.com fingerprinting.
In much the same way that "all $S need $J to function", where:
$S = "Soviet diplomat"
$J = "lapel camera"
use an ad-blocker.
This article is pure, unadulterated bullshit. Probably the only truly honest thing in there is their admission that they have services available. It is not a "study" in any reputable sense of the word, and Softpedia is basically lying to you by calling it that. Softpedia is also very blatantly conflating vulnerabilities with mere attack vectors.
Let me highlight for you the most glaring example of "using a lot of words to lie" that are in the "study" they're linking to... Starting right in the middle of page two they try to compare and contrast a malvertising attack that uses flash as a vector and one that uses HTML5. Unfortunately for them, their HTML5 example is not only fairly nebulous but they cite a redirection to the Angler Exploit kit as if this really meant anything more than an attempt at compromise. One might then ask... what mechanisms does the Angler Exploit Kit use to compromise the system running the browser? Well... That's primarily exploiting vulnerabilities in Flash. This sort of logical shortcoming means one of two things... Either the author is too ignorant to speak authoritatively on the matter or they're just lying. Take your pick.
The Goatse and Rickroll fads relied on social engineering a user to visit an unintended site. If "not visiting the site(s)" were practical for a non-technical user to accomplish, then those fads would never have happened.
what about noscript? https://noscript.net/
umatrix? https://github.com/gorhill/uMa...
nope. The malicious adserver standards came before anti-adblock techniques, just because it's possible.
mod parent up.
Flash ads were not replaced by HTML5 ads because of security concerns ...
I volunteer for that job!