Please create an account to participate in the Slashdot moderation system

 



Forgot your password?
typodupeerror
×
Advertising Security Yahoo!

Yahoo Advertising Serves Up Malware For Thousands 184

wjcofkc writes "Thousands of users have been affected by malicious advertisements served by ads.yahoo.com. The attack, which lasted several days, exploited vulnerabilities in Java and installed malware. The Netherlands based Fox-IT estimates that the infection rate was at about 27,000 infections per hour. In response to the breach in security, Yahoo issued the following statement, 'At Yahoo, we take the safety and privacy of our users seriously. We recently identified an ad designed to spread malware to some of our users. We immediately removed it and will continue to monitor and block any ads being used for this activity.' While the source of the attack remains unknown, Fox-IT says it appears to be 'financially motivated.' The Washington Post cites this incident as a reminder that Java has become an Internet security menace."
This discussion has been archived. No new comments can be posted.

Yahoo Advertising Serves Up Malware For Thousands

Comments Filter:
  • Become? (Score:5, Insightful)

    by gstoddart ( 321705 ) on Sunday January 05, 2014 @11:23AM (#45870959) Homepage

    The Washington Post cites this incident as a reminder that Java has become an Internet security menace.

    As far as I've been concerned, Java and Javascript have both always been security menaces.

    Letting web-sites and advertisers execute code has been a recipe for problems for a long time, which is why many of us here likely already block it.

    This is just another example of why we can't trust the companies doing the advertising, because they're part of the problem -- if Yahoo is serving malware, Yahoo can't be trusted.

    • Re:Become? (Score:5, Insightful)

      by Nerdfest ( 867930 ) on Sunday January 05, 2014 @11:39AM (#45871079)

      Java as a language is pretty much as secure as any other. Allowing it to run arbitrary code as 'applets' by default is a huge problem as the sandboxing seems quite poor.

      • Re:Become? (Score:5, Insightful)

        by gstoddart ( 321705 ) on Sunday January 05, 2014 @11:52AM (#45871165) Homepage

        Java as a language is pretty much as secure as any other.

        In the abstract, as a standalone app, sure.

        But on the web? No bloody way. Certainly not by default -- because it's always been a vector from annoying crap and malware.

        • Re:Become? (Score:5, Insightful)

          by Nerdfest ( 867930 ) on Sunday January 05, 2014 @11:56AM (#45871203)

          Any other language deployed the same way would offer a very similar attack surface. Simply put, it's the new ActiveX.

          • Re:Become? (Score:5, Informative)

            by gstoddart ( 321705 ) on Sunday January 05, 2014 @12:11PM (#45871315) Homepage

            Yup, didn't trust that either.

            NoScript, AdBlockPlus, Ghostery, ScriptSafe, and everything else you can find to keep the crap at bay is the only safe way to use the internet these days.

            Between advertising companies who feel entitled to your data, and all of the crap on the internet ... leaving that stuff on by default is just asking for problems.

            • Re:Become? (Score:5, Interesting)

              by Nerdfest ( 867930 ) on Sunday January 05, 2014 @12:16PM (#45871353)

              RequestPolicy for FireFox is great as well.

            • Re:Become? (Score:5, Funny)

              by ColdWetDog ( 752185 ) on Sunday January 05, 2014 @02:14PM (#45872217) Homepage

              Those blank white screens are refreshingly calm.

              • You know, I don't find there to be many sites I actually want to use that don't get by mostly without allowing scripts and the tracking shit.

              • Actually, if you use Chrome, ScriptSafe can be set to allow Javascript for the domain you're visiting. This still negates a lot of the security risks, yet allows most of the functionality to work for properly programmed websites, without further interaction.
                The only annoyances are having to whitelist scripts from affiliated domains or domains that provide useful external features such as Youtube or Disqus, especially when they trigger a cascade of script inclusions.

                When some website refuses to function prop

            • by Arker ( 91948 )

              I know, this is how I do it too, but doesnt it strike you as a little crazy to have to install all these *extensions* - not to add optional functionality, but to disable all this insanity that should never have been enabled by default to begin with?

              Web browsers should ship with support for the web (that means HTML, semantic markup, period) and extensions should be used to add to that, rather than by default supporting every piece of nonsense any adware/spyware/malware pusher might ever want to use, and then

              • Web browsers should ship with support for the web (that means HTML, semantic markup, period) and extensions should be used to add to that, rather than by default supporting every piece of nonsense any adware/spyware/malware pusher might ever want to use, and then having extensions to try and turn that off after the fact.

                So fork Firefox or Chromium or build a browser atop webkit and offer such a thing. Nothing stopping you from doing it if you really think that's the way it should be.

          • Comment removed based on user account deletion
            • Yes, really (Score:5, Informative)

              by cbhacking ( 979169 ) <been_out_cruisin ... AT yahoo DOT com> on Monday January 06, 2014 @08:13AM (#45877253) Homepage Journal

              With all due respect, his post was a lot more insightful than yours. You don't appear to know what you're talking about.

              First of all, "deployed the same way" as in "deployed using an HTML <object> or <applet> element that instructs the browser to download and execute the code". The Microsoft Visual C++ redistributable runtime does not include any such mechanism for deploying C++ code. For that matter, not all Java runtime installations do either.

              Second, just what do you think ActiveX is programmed in? Hint: it's not its own language. It's a packaging system for COM classes, which are almost without exclusion written in C++, and it *is* possible to deploy and run it in the browser in much the same way as Java applets (object tags). Unlike Java, they run with basically no sandbox but instead require considerable amounts of confirmation before they download. The idea is that they are powerful but unsafe, so only use the ones that you trust. Unfortunately, a number of pre-installed ActiveX controls on Windows have security vulnerabilities in them, so an attacker who finds a way to exploit one of those pre-installed ones doesn't need to get the user to download anything. Hence the way that modern versions of IE require the user to confirm before running an ActiveX control that they've not previously indicated that they trust (and also give you an ability to disable ActiveX completely or only enable it on a site-by-site basis).

              I don't care for the Java installer any more than you do, but the security issues with Java applets have literally nothing to do with the language. The only way you could say Java itself is at fault is if you were to argue that Java shouldn't have any OS bindings at all (that is, no ability to access the file system, no ability to create processes, no ability to open network sockets, etc.). This is essentially the situation with JavaScript, of course; while the Java applet sandbox tries to *restrict* the use of functionality like I just mentioned, the JavaScript runtime (as found in browsers) simply lacks APIs to access such risky features. Even there, though, that's not a characteristic of the JavaScript *language* but merely of the sandboxed runtime used to execute JS in the browser. Other uses of JS, ranging from Windows Script Host to Node.JS, are perfectly capable of doing such things.

          • ActiveX made no attempt at sandboxing. Java does, but the problem is a monoculture. There are four JavaScript implementations in widespread use, and so if you want to exploit a vulnerability in JavaScript you won't get more than one browser. Exploitable JavaScript bugs tend to be partly due to the DOM and other components of the browser. In Java, there is one widely deployed JVM, including all of the supporting libraries. If you find a bug in it, then you can exploit anyone who still has the Java plugi
        • by afgam28 ( 48611 )

          "In the abstract"?! In what world do you live in where standalone, server-side Java and Android apps are rare?

          In the abstract, Java applets are a problem, sure. But by far most Java code runs on servers and on Android devices and there isn't as much of a problem with poor sandboxing in those environments.

      • Which is ironic since one of its principle design goals, that set it apart from being yet-another-language, was emphasis on sandbox security. But then features crept in...

    • by Z00L00K ( 682162 )

      Almost all ads are malicious in one way or another. If they don't carry bad stuff to your computer you can be misled to click on them and $DIETY knows where you end up sometimes. If nothing else they burn a lot of CPU ticks and makes your computer consume more power.

      • Re: (Score:2, Funny)

        by Anonymous Coward

        Almost all ads are malicious in one way or another.

        They may even trick you into buying stuff you don't need.

      • Almost all ads are malicious in one way or another. If they don't carry bad stuff to your computer you can be misled to click on them and $DIETY knows where you end up sometimes. If nothing else they burn a lot of CPU ticks and makes your computer consume more power.

        Yeah displaying a link and a one-sentence blurb is really burning a lot of CPU clocks and making my computer consume more power.

    • by Lennie ( 16154 )

      Java exploits, sure. Or plugins in general really.

      But Javascript ? How many Javascript exploits have you see that infect the browser or the host ?

      I do see Javascript being used to 'deliver' or 'bootstrap' many exploits though.

      • Um, what's the difference? If I find, say, a user-after-free vulnerability in a JavaScript runtime (these have been found, and exploited, in the past) and use it overwrite an objects function table with arbitrary code (by, say, creating a long JavaScript string that contains the hex-encoded values of the machine cade that I want to execute) and then calling a function on the overwritten object to gain arbitrary code execution... is that not actually a JavaScript exploit for some reason? Did I merely use JS

      • How many Javascript exploits have you see that infect the browser or the host ?

        Last time I did a CVE search, I found about 20 within the six months prior to when I did the search, across a small handful of browsers. I haven't looked for a few months though, so maybe there's been a miraculous improvement recently.

    • Comment removed based on user account deletion
  • by stevez67 ( 2374822 ) on Sunday January 05, 2014 @11:23AM (#45870963)
    They'll continue to monitor, as in do something about a malicious ad once someone else identifies it and spreads the word.
  • by Anonymous Coward on Sunday January 05, 2014 @11:23AM (#45870965)

    Hey samzenpus, you better have another job lined up.

    Netcraft confirms http://beta.slashdot.org is dying!

    • by Anonymous Coward

      It does seem to be dying. I used to come one here several times a day. Now I might come by once a week. Mostly hoping the old site would reappear. Sad watching a once great site die.

      • I just had a look at it. It doesn't look awful, but continues the same mistake made with other attempts, in that it has *way* the hell too much white space.

    • It looks fine, but it's too fancy for my taste. Personally, when a someone tries to doll up a site to make it prettier, it always kind of irks me. It feels like it's losing its quality, so they have to compensate by making it prettier. I'm sure that's not the case here, but let's drop this redesign stuff. Unless you make it easier to navigate with a text-based browser.
      • But beta.slashdot.org serves you tons of stock photos. A stock photo for every story! That's what made /. great: meaningless images.

  • by El_Muerte_TDS ( 592157 ) on Sunday January 05, 2014 @11:28AM (#45870991) Homepage

    This wouldn't be an issue if they could only serve image or text only ads. Possible image based exploits can easily be prevented by re-saving the uploaded image so that the image only contains valid content.

    But no, ad farms want to provide functionality to reach maximum annoyance for the users. You can blame Java all you want, but it's not the source of this problem.

    • by Anonymous Coward on Sunday January 05, 2014 @11:59AM (#45871211)

      Indeed, the ad ops teams that "screen" these ads cant read code, and even if they could, the code in the ad tags is "minified" JS and they just can't logistically read each ad tag because of the sheen number of ads they need to run each day/week.

      If Java didn't exist, nor Flash or Acrobat, these criminals would STILL be using the ad networks to compromise the browser itself. That's not to say the plugin model is a good one, but it's important to focus on the real problem.

      This is true for all websites too. I suspect the WashPo uses the same ad ops standards Yahoo does, same as Slashdot, same as everyone. It's ad networks running arbitrary, 3rd-party, unknown code on users machines that's really fucking dangerous.

    • by SpaceLifeForm ( 228190 ) on Sunday January 05, 2014 @12:53PM (#45871641)
      Ask yourself this: How many ad farms are really NSA operations?
    • by digitalaudiorock ( 1130835 ) on Sunday January 05, 2014 @01:04PM (#45871721)

      I use NoScript all the time. Just recently...the last few week actually...I started noticing that a number of things on yahoo finance just plain stopped working because they required javascript from yimg.com...as if I'm going to allow that...ffs.

      • I use NoScript all the time. Just recently...the last few week actually...I started noticing that a number of things on yahoo finance just plain stopped working because they required javascript from yimg.com...as if I'm going to allow that...ffs.

        Last few weeks? You're lucky.

        I did a script check on aoms sites recently. just kept enabling them until the sites worked. Ones like the New York Times had dozens of scripts that had to be enabled just to see the content. Yahoo is bad enough, but no where near the worst. They really do want you to allow facebook in order to see or comment.

        And thtat's the interesting part. Facebook and twitter - and of course Google in one form or another are tracking you even if you've never been to the respective sites

      • it appears yimg.com is owned by https://www.markmonitor.com/ [markmonitor.com]
        Not sure exactly what markmonitor does, even though it says they do "brand protection" I just downloaded one of markmonitors white pages to try and figure it out.
  • Source Unknown? (Score:5, Interesting)

    by Anonymous Coward on Sunday January 05, 2014 @11:28AM (#45870995)

    Source unknown? Bullshit! Yahoo didn't run the ads without payment. Payment == traceable. Or is Yahoo accepting Bitcoins now?

    • No they're just going to blame the NSA for being malicious hackers, and skip over taking any sort of responsibility for the situation.

    • by hawguy ( 1600213 )

      Source unknown? Bullshit! Yahoo didn't run the ads without payment. Payment == traceable. Or is Yahoo accepting Bitcoins now?

      Unless, of course, payment==stolen credit card number.

  • adaware (Score:5, Interesting)

    by fermion ( 181285 ) on Sunday January 05, 2014 @11:29AM (#45870999) Homepage Journal
    It has been my contention that when websites no longer serve malware through Ads, then they can start complaining that users blocks ads. This is not an uncommon occurrence, even for large websites, and the fix is not always immediate. I recall not that long ago when the New York Times was serving malware for the entire weekend.
    • Re:adaware (Score:5, Informative)

      by Anonymous Brave Guy ( 457657 ) on Sunday January 05, 2014 @11:42AM (#45871091)

      It has been my contention that when websites no longer serve malware through Ads, then they can start complaining that users blocks ads.

      Indeed. I block 100% of ads my tools can identify, I consider this a routine security precaution, and I make no exceptions. Sorry to the honest site operators, I won't take offence if you decide to block me because I block your ads, but no, I won't whitelist you. This became my policy shortly after the only virus infection I've ever been aware of picking up on any computer I operate, which was a Java zero day exploit I picked up browsing normally reputable tech news sites.

      • Java zero days are easily avoided by using "click to play", which does exactly what it sounds like: disable flash and java applets until you click them. In Chromium, this is easily enabled in Settings -> Show advanced settings -> under "Privacy", Content Settings -> choose "Click to play" under Plug-ins.

        Java (and Flash likewise) has never been safe, and it's a shame that click to play is not the default. Additionally, animated ads are often Flash or Java-based, so this also kills distracting movies

      • Agreed.

        Similar story here, when I left an IE session open on Drudge and went to sleep.

        Woke up and saw "Antivirus 2009" or some such crapware.

        Turned out to be 2 0-day exploits to javascript and pdfs to load executable code.

        Insult to injury was I turned off javascript in pdfs explicitly and an update turned it back on. Son of a beeyotch.

        Flew under the radar of Symantec 9 or 10, IIRC. Sucked because I was still in .edu and had no time for that kinda shite, but dealt with it just the same.

        Now it is the "only

        • by PNutts ( 199112 )

          A guy at work went to Druge a few years ago and got his work PC zapped. A visit to LiveLeak set off my A/V but nothing got in.

    • It has been my contention that when websites no longer serve malware through Ads, then they can start complaining that users blocks ads. This is not an uncommon occurrence, even for large websites, and the fix is not always immediate. I recall not that long ago when the New York Times was serving malware for the entire weekend.

      Yeah, they outsource their ad space to someone, that company gets them from who knows where. It isn't necessarily that easy to find out where each ad comes from.

      Ads and email attachments are obviously the most common attack vectors I hear about. Also binding malware to pirated files or crackz are notorious too. Not all cracks or pirated warez are malwared but a lot are.

  • "has become"? (Score:1, Insightful)

    by grub ( 11606 )

    a reminder that Java has become an Internet security menace

    Java has always been a security menace.
    • Re: (Score:2, Insightful)

      by Anonymous Coward

      Not sure if parent is trolling, or just confused.

      Most of us know the difference between Java (a perfectly secure language) and the ability to run applets in a browser (a feature that can be exploited if the sandboxing is insecure). It doesn't matter whether we're talking about Java Applets or ActiveX. Hell, even interactive PDF forms have been used as attack vectors.

      • by grub ( 11606 )
        I meant running in the browser, not playing Minecraft. That ActiveX or PDF are also insecure doesn't change the fact that Java (in the browser) is shit and always in need of security updates.
    • Googles contentious rip off of Java is called Dalvik. In what aspects is it different than JAVA for security?

      • Because there isn't really much wrong with Java, from a security point of view.

        The Oracle Java Browser plugin on the other hand, is pretty dodgy.

  • by Anonymous Coward

    Java is a much safer language than say C because of the built in checks. It's the proprietary crappy browser plugins that make this kind of attacks possible.

    • by Jawnn ( 445279 )

      Java is a much safer language than say C because of the built in checks. It's the proprietary crappy browser plugins that make this kind of attacks possible.

      For 99% of the users out there, that is an absolutely pointless distinction.

  • And this is why... (Score:4, Insightful)

    by bmo ( 77928 ) on Sunday January 05, 2014 @11:32AM (#45871025)

    ... using ad blocking and/or host files to deep-six ad networks not only produces a nicer user experience, but it's a valid security measure.

    Trusting the web site is not enough. You have to trust the ad network too. Since any Joe Schmoe can buy ad space on an ad network, trusting the ad network means you're trusting Joe Schmoe.

    I don't know about you guys, but I don't.

    --
    BMO

    • FireFox + NoScript replaced my ad-blocker for years

      Now, I only find ad-blockers or hosts files to be necessary for handling crap that's embedded in flash files.

      /Does Chrome have a proper NoScript equivalent yet?

      • by gstoddart ( 321705 ) on Sunday January 05, 2014 @12:18PM (#45871363) Homepage

        /Does Chrome have a proper NoScript equivalent yet?

        ScriptSafe + DoNotTrackMe + Ghostery + AdBlockPlus are what I have in Chrome.

        ScriptSafe does about the same as NoScript.

        • by allo ( 1728082 )

          use adblock edge, abp is getting more and more stuff you do not want. read the blog entries from some time ago. Its not only the acceptable ads* stuff, they are working with ad companies at some more points.

          * which is a big deal anyway, because one of the first types of acceptable ads were the sedo-typo-squatting ads on misspelled domains.

        • by Arker ( 91948 )
          The last I checked there was no way to block scripts prior to download - the best the extension could do was step in after they have been downloaded and parsed and then walk them back out. Not acceptable, not even close.
      • HTTP Switchboard. This puts to rest all the false claims out there that Chrome doesn't have the proper API to block scripts. This thing does what NoScript, Request Policy and AdBlock do all together, plus it has nice privacy enhancing options.
  • by Anonymous Coward on Sunday January 05, 2014 @11:32AM (#45871027)

    New Yahoo Mail = complete unusable dog shit

    New Flickr = complete fuck up! They don't even read user feedback.

    New Ad delivery = source of malware! Even porn sites don't do that.

    • by Anonymous Coward on Sunday January 05, 2014 @11:55AM (#45871187)

      yep, blocked *.yahoo at the point i noticed them installing psudo-malware with uTorrent (the persistent default search engine replacement software which uses far more CPU time than something that supposedly just monitors search engine settings and resets them to Yahoo should. It was very malware like in it's choice of installation folder too and of course the fact it was both unwanted and self-repairing)

      once a company starts doing that shit they end up on my block list, permanently. uTorrent made it too for bundling the crap.

      sounds like I dodged a bullet by having them blocked.

  • I kept my old Yahoo webmail accounts but use Thunderbird to read those as well as Gmail. Avoids dealing with asstastic webmail page layout as well as being bothered with adverts.

  • If that's the whole statement, then wow... that's really pathetic.
  • > "The Washington Post cites this incident as a reminder that Java has become an Internet security menace."

    That should read "The Washington Post cites this incident as a reminder that advertising has become an Internet security menace."

    Adblock+ -- part of a sensible security policy.

  • Yahoo knows (Score:5, Insightful)

    by EmperorOfCanada ( 1332175 ) on Sunday January 05, 2014 @12:32PM (#45871457)
    The moment that Yahoo allowed advertisers to use java they knew that minimally those ads would be used to annoy the crap out of the users. If your ad is a static picture with a clickable link then you don't need Java. What you need java for is to start prying into the user's business. Animations, sound, geolocations, saving data to the user's machine. So any "legitimate" ad using Java is halfway to being malware already. Plus why use Java instead of Flash? Generally ads should be made by Graphic artist types who are more familiar with Flash. Thus the primary reason to use Java is to access some feature that flash has blocked in Flash.

    So if your goal with a Java ad is to circumvent something that Adobe has blocked then it probably should remain blocked. On top of that most users have turned off Java so it can't be to reach a wider audience.

    So when Yahoo allows advertisers to use Java they knew perfectly well that the advertisers were up to no good whatsoever. Their acting surprised that some of the scumbags took it even further is total BS.

    Basically at this point, anyone who has Java turned on in the browser is the same as having a house with a weeks worth of newspapers stacked up at the front door. Effectively a greeting card inviting the criminals in.
    • by viperidaenz ( 2515578 ) on Sunday January 05, 2014 @12:54PM (#45871651)

      The ad didn't contain a Java applet.
      It directed people to a website that then delivered the malware. Apparently it automatically redirected the browser, but that hasn't been confirmed.

      So Yahoo allow Javascript in the ads, not Java.

      • Ah good clarification. So a good policy for yahoo would be if your site uses Java applets there is an 80% chance you are being a tool. I thought the coverage of Java Applet Ads would be pretty poor. I am not sure of the exact stats but with mobile devices growing this number must also be in freefall.

        The only legitimate sites that I see where a java applet is a critical feature are older science websites. Astronomy calculators would be a common example.

        Personally I am excited about the prospects of asm.
    • For what it's worth, a big reason they changed from making ads in Flash to Java is because

      a. People used to complain about Flash, and how slow and insecure it was.
      b. Flash didn't work very well with mobile phones (or at all for a long time).

    • "Allow Java"? Sorry, but you can't really block Java if you allow scripting or redirection.

      With redirection, you lose control over what the ad actually serves. You'd have to re-check it all the time. What will you do if it serves malware only to every tenth visitor? And never to yahoo IP space?

      With scripting... Well, unless you have the resources to manually analyze every ad before you allow it (who would accept that much delay?), you will never be entirely sure what the code does. Static analysis can only

  • by wonkey_monkey ( 2592601 ) on Sunday January 05, 2014 @12:33PM (#45871475) Homepage

    Yahoo Advertising Serves Up Malware For Thousands

    The attack, which lasted several days... the infection rate was at about 27,000 infections per hour.

    That's nearly 2 million at least. C'mon Slashdot, it's not like you to supply a less sensational headline than necessary.

  • The source is a Yahoo ad customer. Do they not know who pays them? Or do they not want to lose a paying customer by outing them?

    • by Greyfox ( 87712 )
      Perhaps they were paid with a stolen credit card. It's not like those are hard to come by.
  • As usual (unfortunately). Both the article and the summary are pathetic examples of journalism which should try to at least inform.
    For instance, it would be useful to know (at a minimum) which OSs, browsers, etc are vulnerable, whether any of the virus detection programs will block or remove the malware and what effects the malware has on systems when they are infected.
    In other words, this article is just "scareware" warning about some unspecified threat to do something bad to somebody and no idea who, what

    • Did you even read the articles, or did you just click the first link in the summary and call it a day? The one linking specifically to Fox IT's blog, which is the source of this discovery, goes into great detail about this. They specifically mention the following:

      This exploit kit exploits vulnerabilities in Java and installs a host of different malware including:

      ZeuS
      Andromeda
      Dorkbot/Ngrbot
      Advertisement clicking malware
      Tinba/Zusy
      Necurs

      • by mspohr ( 589790 )

        But do any of these run on Linux.. or Mac OSX?
        I guess we should just assume that they all run on Windows although the article is silent on this subject.
        Does any antivirus program detect or block any of these?
        What should I do if I think I have been "exposed"?

        Useless articles.

        • None of those malware packages are new. They've been covered numerous times in the past. Google them up yourself if you weren't paying attention for the last 6 years. I certainly don't want to have to read through a bunch of information that I already know because it's not exactly new.

  • Freaking ad networks (Score:3, Informative)

    by Dega704 ( 1454673 ) on Sunday January 05, 2014 @02:02PM (#45872137)
    Hence why I advise people to install AdBlock on their browsers. The way things have been for the pas few years, it's probably more effective than antivirus software. (Before you flame me, I am speaking tongue-in-cheek. You really should have both.)
  • reminder that Java has become an Internet security menace."

    The big three browsers can trivially block Java, through something as simple as "click to play", or "always launch plugins from this site". Any browser that auto-executes stuff by default is broken.

    On the other hand, I've had a malware distribution attempt via Javascript. It's certainly designed to attack Chrome, since it wipes the previous page content and URL, replacing it with its own.

    Oh, and a trivial Javascript exploit that browsers took 10+

  • "...reminder that Java has become an Internet security menace."

    Actually, the largest menace is Javascript. That's why so many people use NoScript.

    Any kind of in-browser active code execution will inevitably have security challenges.

  • by knorthern knight ( 513660 ) on Sunday January 05, 2014 @10:45PM (#45875533)

    I don't have Java installed. I run linux, but Java is cross-platform, and I don't fall into the "it can't happen here" camp. Besides, I save a few hundred megabytes of disk space by not installing Java.

    Flash is another issue altogether. I follow one forum that autoruns Flash movie ads on occasion. If you hovered over the ad, it would enable sound too.Firefox used to lock up for a few minutes. Running with system load = 3 or 4, on a 2-core machine is begging for thrashing/near-lockup.

    I now use 2 browsers...
    1) one browser has Flash disabled entirely
    2) the other one I launch when I see a link to Youtube/whatever. When the video finishes, I close it. The taskbar has a mini-version of "top" running. Sometimes, after turning off the Flash browser, I'll watch the system load fall from 1.3 down to 0.3... satisfying.

  • by PNutts ( 199112 ) on Monday January 06, 2014 @12:48AM (#45876031)

    A/V doesn't protect against a lot of this stuff. Malwarebytes [malwarebytes.org] has a new anti-exploit beta [malwarebytes.org] for us Windows folks.

    From the FAQ:

    17- What techniques does MBAE use to detect and block exploits?

    MBAE incorporates multiple exploit detection and blocking techniques at different stages of the typical exploit attack to provide a truly complete solution against all types of current and future exploits.
      Stage 1 Layer: This layer of MBAE incorporates multiple techniques to detect and block exploits during stage 1 of the exploit attack, before the shellcode is allowed to run. In some cases, MBAE detects and prevents exploits before the operating system Data Execution Protection (DEP) protection.
      Stage 2 Layer: This layer of MBAE incorporates multiple memory protection and payload execution techniques which prevent exploits from executing their stage 2 payload, thereby protecting the computer even if operating system protections and stage 1 protection techniques have been bypassed.

  • Most people running something other than IE with an ad block or script block most likely never would have had any problems. My boss still likes IE for whatever reason, needless to say Im at his computer every month or 2 removing spyware, viruses or a total computer hijacking (pay us 100$ to unlock this pc). Last virus he picked up was from an ad on msn.
    • You can block ads and scripts in IE just fine. Heck, there are even built-in ways to do it, using filter lists from folks like EasyList (better known for their popular AdBlock Plus filter list). No need to download an extension (MS calls them "add-ons" but they are much the same thing) as long as you're using IE9 or newer, but ad-blocking and script-filtering are available at least as far back as IE6. There's also options like blocking using a HOSTS file or similar.

      Your boss's problem isn't that he uses IE,

The gent who wakes up and finds himself a success hasn't been asleep.

Working...