Hackers Use Banner Ads on Major Sites to Hijack Your PC

The worst-case scenario used to be that online ads are pesky, memory-draining distractions. But a new batch of banner ads is much more sinister: They hijack personal computers and bully users until they agree to buy antivirus software. And the ads do their dirty work even if you don't click on them.The malware-spiked ads have been spotted on various legitimate websites, ranging from the British magazine The Economist to baseball's MLB.com to the Canada.com news portal. Hackers are using deceptive practices and tricky Flash programming to get their ads onto legitimate sites by way of DoubleClick's DART program. Web publishers use the DoubleClick-hosted platform to manage advertising inventory." CT: Link updated to original source instead of plagerizer.

What are these "ads" you're talking about ?

[galaad2]

That's why Firefox+NoScript+AdBlock Plus+Flashblock were invented

Never Experienced This

[ilovegeorgebush]

I've never come across one of these ads. In fact, I rarely get ads as I use the Adblock Plus [mozilla.org] plugin for Firefox. This just gives even more reason to ban advertisements entirely. Thanks!

who is to blame

[cpearson]

Great, now we can await a round of finger pointing to begin over who is liable.

Ah, let the blame game begin

[SuperBanana]

The malware-spiked ads have been spotted on various legitimate websites, ranging from the British magazine The Economist to baseball's MLB.com to the Canada.com news portal.

...and since those sites outsource to Doubleclick, they'll point a finger at them. Doubleclick will no doubt point the finger at some previously-unheard-of company that "solicits advertisements for the Doubleclick network", and they'll point the finger at their "client."

Meanwhile, The Economist, MLB, Canada.com, etc won't take responsibility for the content they present on their website (after all, they chose to use Doubleclick, they chose to put advertisements on the website, they chose not to require approval of ads before they were shown on their website, etc.) Funny how everyone is trigger-happy when it comes to copyright, but when it comes to content they present causing harm, it ain't theirs, eh? :-)

Doubleclick, of course, won't accept responsibility for vetting advertising distributed via their channel (which seems like a standard business procedure for, oh, an advertising network?) The only comfort is the mechanism of the free market: if website users get pissed enough, said websites might put pressure on Doubleclick or leave them altogether. That's bad for Doubleclick business, so maybe Doubleclick will consider vetting ads better, or run checks to see that flash code doesn't do certain things, etc. Then again, if the malicious banner ad suppliers are paying good enough money, Doubleclick may be perfectly happy to issue a press release "apologizing" and keep right on doing business as usual.

Re:I only found these ads on....

[El Lobo]

Actually, this is not news. Those of you who are/wee usual visitors of WaReZ sites or WareZ engines like astalavista.com will know that this kind of "ads" have out there working for years now. The difference is that now it seems like respetable sites are hosting them directly or indirectly via some ad provider.

BTW these ads are not directly dangerous unless you are running on some old browser/old Windows system, but yes, they are annoying as hell.

Terrible relationships with their advertisers

[sseaman]

Content providers need to be responsible for the content of the ads posted on their sites - that's a given. TFA indicates that these content providers (the people behind NHL.com, for example) simply received payment for these ads via credit card or wire transfer and then posted the content. If these sites used a network television model, they would have intimate relationships with the advertisers and would work together to provide less offensive and more effective ads. I don't think they need to go that far (network television ads are far from perfect, although they are quite effective), but clearly MLB.com and NHL.com need to be held responsible for the content on their sites, and hopefully this will encourage better cooperation between site hosts and advertisers.

Re:The evils of Javascript

[Allicorn]

Javascript's alignment notwithstanding, it is not implicated by TFA in this particular situation. This is about the evils of Flash.

Re:Never Experienced This

[orclevegam]

Actually, these are getting into some reputable sites through places like DoubleClick, which is one of the domains that AdBlock targets, so in this case it will protect you. Now, on less reputable sites that are getting these things directly instead of through DoubleClick, yeah, AdBlock won't do much there.

Re:Not exactly new

[orclevegam]

FlashBlock is your friend.

F the Flash garbage

[Anonymous Coward]

Flash has always been an insecure resource hog.

Unfortunately, I think a lot of folks get talked into using flash on their sites by web designers who just want to maximize billable hours. Often their sites fail at the basic function of conveying information because they don't include HTML versions of the information people are looking for. A great example are bands with tour information in Flash only. Most of the artists don't even know about the problem. Unfortunately the people who answer webmaster@site are often those reaping the cash rewards of flash-only implementations.

I don't allow flash in my primary browser and also disable javascript. I won't visit websites that require Flash. Just say no.

Why aren't we blaming the browser?

[bhmit1]

Everyone is cheering for AdBlock when they read this, but why is it ok that a browser can install spyware, viruses, etc when you are browsing a web page? Shouldn't this be something that can only happen on sites that you explicitly permit or upon agreeing to a dialog asking if it's ok to run a given program? If you can experience this problem with double-click, then you can experience the same problem with any web site out there, so I'd much rather see us fixing the security holes in various browsers.

Are you surprised? Risks of client-side scripting

[Anonymous Coward]

The risks of client-side scripting that use unsafe languages (including Flash and its ActionScript) make the extra functionality not worth it to me. If you want to be safe, disable scripting and live without it, or use NoScript. I hope some day scripting will become safe, but it clearly isn't now.

Doubleclick could fix this in 2 seconds

[oni]

From TFA: The malware looks like a ordinary Flash file, with its redirect function encrypted, so that when publishers upload it, the malware is not detectable.

All Doubleclick has to do is require the actionscript source code for all ads. There is *no good reason* for an advertiser to hide anything from doubleclick. Send doubleclick your sourcecode. They will compile it into a .swf file. If you don't like that policy, then you can find another distributer for your ads. If your actionscript is so convoluted or obfuscated that doubleclicks programmer can't figure it out, then you can wait in line until the programmer can figure it out, or you can simplify it.

Problem solved.

Re:Why aren't we blaming the browser?

[moderatorrater]

Flash is a plugin, it's what needs to enforce a security model. Also, sites need to step up and stop allowing exploitative ads. If an ad is clearly posing as a windows dialog box, then that ad shouldn't be allowed onto your site.

Yeah sure

[gerf]

When you find a company that allows people to use their copyrighted material however they want, and also takes responsibility (monetarily and apologetically both), for their own mistakes, let me know. And they have to still be in business, that is..

Re:Very stupid idea

[Anonymous Coward]

The "let's ban it" attitude seems awfully familiar. Are you a member of the US, UK, or EU parliament by any chance?

Like it or not, but advertising generates (directly and indirectly) the revenue that drives the Internet. When advertisement is passive, and does not attempt to hijack your computer, it is theoretically an win-for-all scenario: the advertisers get their clients, the consumers get their products, and the sites that host the advertisement get their costs and expenses covered.

You are very much mistaken. Advertising seeks good mediums to exploit, and always shows up AFTER the medium has established itself. Advertising funds garbage content.

Advertising does NOT generate the revenue that drives the internet, and without it, the internet would not only continue to thrive, but would improve. You're probably too young to remember it, but the internet existed long before anyone thought of using it for advertising. HTML existed long before anyone thought of using it for advertising. If every single ad-supported site vanished from the webernets overnight, things would be better. People with something worthwhile to publish would continue to publish, and those who spout useless drivel and subsist on advertising would have to crawl back to the holes from whence they came.

chain of responsibility

[SuperBanana]

And speaking of "trigger-happy", you seem to point the finger right back at the Web sites for not inspecting the ads and the underlaying code. Well, that's what they hire DoubleClick for,

And who decided to hire DoubleClick, instead of (as you mention) Google AdSense or a hundred other advertising networks, all of varying reputation, levels of annoying-ness, etc? Who negotiated the terms of the contract, which could have required vetting of ads by Doubleclick? Who had the power to chose between text, GIF, and Flash based ads? Who benefits financially from the presentation of those ads?

So, again tell me who is responsible for ME getting an infected PC visiting that website? If GM makes a car and the wheel falls off because Bob's Bolts sold them defective bolts, I can still sue GM for selling me a car on the reasonable assumption that GM would test bolts before putting them in a hundred thousand vehicles...and GM made the decision to buy from that particular supplier.

The way the world works is: I sue GM. GM then sues Bob's Bolts for damages (ie to reputation, the money they had to give me and spend on legal defense, cost of recall, etc.) Bob's Bolts then may sue Smith's Steel for selling them crappy steel.

Or, in this case: I sue The Economist for infecting my machine. The Economist turns around and sues Doubleclick for providing malicous ads. Doubleclick may then turn around and sue the company that made the malicious ads, for violating the terms of contract with Doubleclick specifying no malicious content...

Re:AdBlock and NoScript

[Stradivarius]

Even passive content like a JPEG may be malicious/unsafe. Suppose someone discovers a buffer overflow exploit in how IE processes images. You can bet that you'll start seeing images crafted to trigger the exploit and thus hijack the viewing computer. They may well end up on Doubleclick's network.

When you have (inevitably) imperfect software paired with untrusted content providers, there is no guaranteed way to be safe. Which is what makes Doubleclick such a menace - you can't even trust reputable sites anymore, because they're serving ads from unknown and untrusted sources via Doubleclick.

Adding insult to disgust to injury...

[JRHelgeson]

PayPal has a "Virtual Debit Card" that you can use to access your PayPal account. Prior to downloading the software, you're asked to verify your system requirements. If everything checks out, you can then download and install the software.

Here's the rub - when you click on the "Download Now" button, it actually sends you to DoubleClick.net site. Then the DoubleClick.net site redirects you back to the PayPal site and starts downloading the application. If you have DoubleClick.net blocked in your hosts file, like I do, then you can't download the software.

Why?

It is so that DoubleClick.net can plant a first-party cookie, spy on your activities, direct advertisements to you... PayPal has just submitted ALL your information AND the fact that you use PayPal, AND the fact that you purchase stuff online, AND, AND, AND... Then DoubleClick.net can target you for highly targeted advertisements.

This is just unconscionable. PayPal deserves all the flame they're gonna get over this one.

Re:I only found these ads on....

[Ron Bennett]

One should click the "X" to close out such windows - or likely better yet, especially when in doubt, do so via keyboard CTRL-F4 (think that's the combo).

Anyone who has done some VB programming, etc is well aware that the labels on dialogue boxes can say most anything and be assigned to most anything - problem here is that most Window's users don't know that "Cancel" can be assigned to the same function as "Yes", etc ... don't trust any option shown, use the "X" instead; that's not full-proof either, but much safer than clicking "No", "Cancel", etc.

Ron

just another reason to go to Linux

[rgiskard01]

Just another reason I am on the Microsoft colonic program!

Linux Mint
Firefox
Adblock Plus
No Script
Customize Google
Safe Cache
Safe History

Couldn't be happier with Mint, Open Office, Compiz, Thunderbird, etc.!

Re:Adding insult to disgust to injury...

[JRHelgeson]

True, problem solved. Delete the cookie, no problem.
My point is that any trust PayPal had was destroyed the moment they redirected my browser... What else are they doing with my financial information?

Re:I only found these ads on....

[fredklein]

yes, it asks you repeatedly. How is that "directly dangerous?"

If it can run the code to 'ask you repeatedly', it can run other code.

Or if you insist that there is no possible way in Windows to do this (I'm sure someone could post a half a dozen IE security holes that allow arbitrary execution of code), then how about popping up a window with the 'OK' and 'Cancel' buttons reversed? [cancel], [cancel],[cancel],[ok] oh, shit.

Re:Doubleclick could fix this in 2 seconds

[elchuppa]

Having the source code doesn't automatically mean you can detect funny business. There can be heavy layers of obfuscation that makes source code just as unreadable.