How Malvertising Abuses Real-Time Bidding On Ad Networks 113
msm1267 writes Dark corners of the Internet harbor trouble. They're supposed to. But what about when Yahoo, CNN.com, TMZ and other busy destination sites heave disaster upon visitors? That's the challenge posed by malvertising, the latest hacker Golden Goose used in cybercrime operations and even in some targeted attacks. Hackers are thriving in this arena because they have found an unwittingly complicit partner in the sundry ad networks to move malicious ads through legitimate processes. Adding gasoline to the raging fire is the abuse of real-time ad bidding, a revolution in the way online ads are sold. RTB enables better ad targeting for advertisers and less unsold inventory for publishers. Hackers can also hitch a ride with RTB and target malicious ads on any site they wish, much the way a legitimate advertiser would use the same system.
It's all automated (Score:2, Insightful)
The second you take the human out of the loop on who approves something going into production, you open up a huge avenue of risk: that the automation will put something you don't want out on the Web.
plagiarism (Score:5, Insightful)
Direct copy-and-paste from an article should be quoted, to make it clear that in fact msm1267 wrote nothing at all.
Sigh, OTOH, at least the "summary" is not a gross misrepresentation, like so many others.
Re:plagiarism (Score:4, Insightful)
if it were my summary I would definitely attribute it to somebody else, because it makes absolutely no sense. what does this mean? "But what about when Yahoo, CNN.com, TMZ and other busy destination sites heave disaster upon visitors?" what does the rest of the summary mean?
Re: (Score:2)
if it were my summary I would definitely attribute it to somebody else, because it makes absolutely no sense.
Right. It makes no sense precisely because it is NOT in any way a summary, which would take a few moments' effort to write. It's just a copy and paste of the first few sentences of the article.
"But what about when Yahoo, CNN.com, TMZ and other busy destination sites heave disaster upon visitors?" what does the rest of the summary mean?
Exactly. The article goes on to explain that. A summary would at least give some idea. The copy & paste of the first few sentences, cut off at an arbitrary point, totally leaves you hanging.
Anonymous advertisers (Score:5, Informative)
Re: (Score:2)
What makes an ad agency reliable to you?
And what solutions do you recommend for individual blog authors to implement "host your own ads"?
Re: (Score:3, Interesting)
Re: (Score:2)
Until September 2013, no major ad network supported HTTPS at all. That is when AdSense added HTTPS support. But for people who wish to avoid AdSense, which other ad networks have HTTPS now? Besides, it's still possible to serve a Flash Player exploit over HTTPS.
Re: (Score:1)
"Host your own ads" is something only big sites can implement obviously.
Obviously?
I can (and occasionally do) sell advertising to local businesses that want to advertise on my website.
No middleman, no profit-share, and I know exactly who and what I'm advertising on what is, after all, MY website.
No one cares (Score:4, Insightful)
Absolutely NO ONE cares that some individual blogger makes a dollar from his blogging. Not the readers, not the corporations, not your ISP/host, not even the government, NO ONE. None of us gives a small rat's ass. But, yes, you CAN negotiate with some advertiser whom you deem to be reputable, and not suck at the Google teat, or whatever. Host your own ads, or I won't see them, it's really that simple. All the big ad servers are blocked on my machines.
Reliable ad agency? Yeah, I gotta agree, that's kinda funny. It may even qualify as a full fledged oxymoron.
Re: (Score:1)
Re: (Score:2)
Then how should individuals recover the $120/yr for a VPS?
Re: (Score:2)
Huh? Why should you recover it? ISP fees, VPN, VPS - all of those are something that YOU pay for, because YOU want to be "out there". Why SHOULD you recover it?
Of course, you could do what so many others do. Put your paypal account on your home page, and solicit funds in the form of "donations". I've actually sent donations now and then. I block the ads though.
Re: (Score:2)
$120 per year for one thing, $120 per year for another, and pretty soon all these recurring fees add up to real money that exceeds the income from an entry-level job.
Re: (Score:1)
Re: (Score:2)
Why should a blog have ads on it?
To pay for the VPS that hosts the blog.
Re: (Score:2)
One in which all of the employees are encased in carbonite, and whose computers and records have all been nuked from orbit.
Anything less and you have to assume they're still unreliable.
Not Our Fucking Problem.
Sorry, but I will continue assuming all ads are crap I don't wish to see, served by companies who don't give a crap about my privacy or security and whom I therefore
Re: (Score:2)
Let's start with has effective controls to prevent ever serving malware. Add in no history of serving malware.
Much like the food industry, I don't care how the grocery store avoids selling arsenic as flour, only that they do. If they claim that they can't, they shouldn't expect to sell much flour.
"effective controls" (Score:2)
What would you define as "effective controls"? And for how many years is a well-known ad network going to be able to keep a spotless record? Which if any existing network qualifies?
Re: (Score:2)
Given the amount of malware served up by ad networks these days, I'd have to say better than they have now. I haven't really considered the question any further since that determination was all I needed to enable ad-blocking.
Let's just say it'll be up to them to make the case to me that they are now free and clear of malware. Since I have no actual desire to consume their content, the burden of proof will be quite high.
Please disable your ad blocker to view this page (Score:2)
Since I have no actual desire to consume their content
Until you hit a site that has Adblockblock. I've noticed that a lot of sites are doing this nowadays for videos and even for text beyond the first couple paragraphs.
Re: (Score:2)
I have seen a few of those. Just highlight a relevant bit of text and search it on google. It's rare that a page will have exclusive information anymore.
Advertisers reeling over this small fix! (Score:2)
Slashdotters discover cure for malware from infected ad servers from this simple tool
https://adblockplus.org/ [adblockplus.org]
Advertisers & Malware writters HATE THIS!
Re: (Score:1)
can I use HOSTS for this????
Re: (Score:2)
I'm afraid you're going to have to retire the "HATE THIS" meme.
From now on, you have to write the hooks to ad-laden drivel using the following as a guide:
<SUBJECT> <ACTION> <ACTION>. <NEXT ACTION> <MY DISPROPORTIONATE RESPONSE>
eg.
"He Downloaded Adblock And Installed. When He Reloaded The Page, I Was Amazed."
Ensure That You Capitalise Every Word For Maximum Impact.
Re: (Score:2)
I'm afraid you're going to have to retire the "HATE THIS" meme.
From now on, you have to write the hooks to ad-laden drivel using the following as a guide:
<SUBJECT> <ACTION> <ACTION>. <NEXT ACTION> <MY DISPROPORTIONATE RESPONSE>
eg.
"He Downloaded Adblock And Installed. When He Reloaded The Page, I Was Amazed."
Ensure That You Capitalise Every Word For Maximum Impact.
SLASHDOT USERS DISCOVER SHOCKING WEBSITE. SEE WHY THIS SITE HAS GEEKS IGNORING THREATS
LOCAL USER COLAMAN SAVED BIG! CLICK NEXT AT www.adblockplus.com TO SEE HOW??!
How was that?
clean your own stable first (Score:5, Insightful)
Re: (Score:2)
And why I hate freedom for making Flash click to play.
Because when you do that, your browser still reports to the sites that it supports Flash, which encourages them to continue using it. If you REMOVE Flash, then it's not reported as a supported type, and the statistics skew more and more toward showing Flash being unsupported, which contributes to the ultimate demise of Flash.
So, THAT is why I say you hate freedom for making Flash click to play ;-)
Why not restrict all ads to GIFs or JPGs? (Score:3, Insightful)
Users getting malware infection from ads is a really big problem even when you never click on them.
Why not restrict all ads to GIFs (static or animated) and JPGs?
Re: (Score:2)
Because flash/javascript ads pay way more.
Re: (Score:2)
Do they? I know there's a premium on popup ads and interstitial pages, but I've never met anyone who said "wow, what an amazing ad jumping around and flashing lights at me, let's click on that instead of checking out the content I came for". Maybe some people pay more for them but I wouldn't call it a well advised move.
The most interesting part of the article for me is the idea of real time bidding - maybe web adverts will finally start paying as well as print adverts.
Re: (Score:2)
Re: (Score:2)
Do they? I know there's a premium on popup ads and interstitial pages, but I've never met anyone who said "wow, what an amazing ad jumping around and flashing lights at me, let's click on that instead of checking out the content I came for".
Apparently you don't interact with my family - it is a sad, strange world out there.
Re: (Score:2)
What i have been seeing are the adds that disguise themselves and then make it impossible to navigate away from them. One of these days I would love to see one of these clowns in court explaining how it was just good business to trick the viewer and then trap them.
Re: (Score:2)
-So the user clicked on our ad. That means he wanted that content delivered.
-And then he clicked in the window again. That means he wanted the next level. So we delivered it to him.
-Your honor, it clearly states, "Click here if you want to exit" (said 'exit' looks completely different to a normal OS 'exit' thingie)
Meh (Score:3)
Reason number 48372534786 why it's better just to universally block advertisements on the internet.
Re:Meh (Score:5, Informative)
Reason number 48372534786 why it's better just to universally block advertisements on the internet.
Apple has been leading on this front with several initiatives to protect users from malicious ads. One of them was a setting in Safari to only accept cookies from the first-party site, so when you go to cnn.com the browser accepts a cookie from cnn.com but not from malvertiser.com, who has a banner ad on the site.
This upset google because it cut into their business model of selling effective ad space. So google inserted malicious code [wired.com] into webpages to hack the safari browser and override security settings so it could download unwanted and potentially malicious files onto users computers. Because of this, google received the biggest fine in FTC history [ftc.gov] and is being sued for privacy violations [computerweekly.com] in the UK.
Think about this for a second, and what it means. A website overriding browser security settings to serve unwanted and possibly malicious files. This is outrageous and unethical, and if it were Microsoft then the entire internet community would be enraged. Also think about it in light of this article on malvertisements, which google was actively propagating.
Apple has since taken the cat and mouse game further, so the setting is "allow from current website only". I expect malvertisers to scramble to overcome this block, but I hope that legitimate respected top tier internet companies act a little more ethically.
Re: (Score:3, Informative)
Yeah, Apple *really* led with that. Firefox has had a "block third party cookies" setting since day one.
Re: (Score:2, Insightful)
but never as the default.
Re: (Score:1)
This so fucking much. Fuck you too sconeu
Re: (Score:2)
A website overriding browser security settings to serve unwanted and possibly malicious files. This is outrageous and unethical
And a major security bug in Safari, apparently.
Re: (Score:1)
Opera and Firefox have had such a setting (to allow only cookies from the server, and no third party cookies) since long before Safari. Curiously, they don't have the same security flaw that Safari has, and simply don't accept third party cookies when told by the user to do so.
Re: (Score:2)
Re: (Score:1)
Adblock+ (Or whatever your favorite variant/flavor/fork/alternative is) is the best security suite you can install on any computer.
Attack surface reduction is among the most basic and important of security practices.
Re: (Score:2)
Adblock+ by itself isn't enough. You need a script blocker, set up your browser to not accept third party cookies, and, most importantly, stop running flash.
Re: (Score:2)
Re: (Score:2)
There's a reason I specifically called out getting rid of flash. Every legitimate website should be going to HTML5 if they aren't there already. There is no reason to be sticking with flash exclusively in 2015. It's vulnerable but at the same time doesn't give you anything you can't do in a more safe framework. It is a relic that needs to die sooner rather than later. If a website isn't switching over, you have to ask yourself why.
And yes, I know there is a huge code base for flash based games and the
Re: (Score:2)
Why don't they recompress all the images? (Score:4, Insightful)
Aren't most exploits removed by loading the image and then recompressing it? Why would you ever serve the raw binary for an image at least that was directly given to you by an advertiser? Isn't that just asking for an exploit?
I understand flash is much harder to deal with. Maybe the ad networks need some kind of template for allowed flash so they can take the flash file, take it apart, recompress all the images in and and then load it into their own template so that any exploits in it are probably removed.
Re: (Score:2)
Yes, the system as it is at the moment is just asking for trouble.
Google tends to host a lot of the ads themselves, which makes it slightly more reliable. But they have had their fair share of trouble, too.
Paging Samuel L Jackson... (Score:2)
Mr. Jackson: your editorial advice is clearly needed here at Slashdot. Article summaries have become a leading cause of frustration for those of us who can actually read and write English.
Re: (Score:2)
I have had it with these motherf*cking ads on this motherf*cking site!
Re: (Score:2)
Javascript, motherfucker! Do you run it?
Liability (Score:5, Interesting)
Re: (Score:3)
If media sites become financially liable for the harm that their content does, Fox News is in deep trouble.
Re: (Score:2)
I swear the first time I glanced at your post I read it as 'media shites'. I may have been right the first time in light of the end of your sentence.
Re: (Score:1)
Re: (Score:2)
As much as I'd hate to see a circus of lawsuits around this issue, it's clear there is an ethical obligation of sites to warranty their advertisements to do no harm. A user willingly goes to www.reputablesite.com, but they have no informed consent over all the advertisements and other links that site displays, they just load along with the requested page. If the requested page is loading third party content and getting paid to do so, then clearly they should make every effort to screen for malware or abuse.
There's a lot of filtering and checking (Score:1)
All of the RTB platforms put a great deal of effort into validating adverts before they run, and are *very* responsive to anythingn which gets passed those filters and checks.
Security Assessments and 3rd party Ad providers (Score:1)
Re: (Score:2)
The trouble is, how do you identify where the malware comes from? Sifting through the outrageous numbers of ads on so many of the random click-bait web pages full of kitten videos linked to on Facebook is hard enough. Trying to nail down exactly which ad gave you the infection would be pretty much impossible. So there's no way to really know who to sue.
The only solution is to approach the internet like you would approach a lady of the evening. Don as much protection as you can before you interact becaus
Re: (Score:2)
Old news (Score:2)
This article is about 15 years late. Malware via adverts/trackers has been around since before the word "phishing" was coined. If the advertising industry gave any shits about fixing this, they'd have done it by now as it's a very simple problem to fix. But surprise surprise - they don't care, and neither do the sites complicit in selling their users to the advertisers!
And THIS is why I run AdBlock (Score:2)
Until ad networks can ensure that EVERY ad they run is 100% free of malware, I will continue to block their ads.