Catch up on stories from the past week (and beyond) at the Slashdot story archive


Forgot your password?
Google Advertising Security The Internet Technology

Malware Delivered By Yahoo, Fox, Google Ads 319

WrongSizeGlass writes "CNET is reporting that Avast has tracked over 2.6 million instances of malware that have been served up to unsuspecting web surfers since last December by ad services such as Yahoo's Yield Manager, Fox Audience Network's and even some from Google's DoubleClick. Some high-profile sites include The New York Times, Drudge, TechCrunch and The practice has been dubbed 'malvertising.' I usually suspect the users of 'careless web activity' when I delouse a PC, but now I'm going to have to give some the benefit of the doubt."
This discussion has been archived. No new comments can be posted.

Malware Delivered By Yahoo, Fox, Google Ads

Comments Filter:
  • Yup....seen it. (Score:5, Interesting)

    by Em Emalb ( 452530 ) <> on Tuesday March 23, 2010 @10:17AM (#31583228) Homepage Journal

    At my work, we allow unrestricted access to the net, but log everything. We had a recent spate of vundo variants come through, and when we went through the logs, almost all of them were via the NYTimes or Wa Post. Frustrating, when large companies like this make work for you. For the most part, the allow everything, log it and using IDPS on the front-end(s) has helped quite a bit.

    • Re:Yup....seen it. (Score:5, Insightful)

      by tivoKlr ( 659818 ) on Tuesday March 23, 2010 @10:25AM (#31583362) Journal
      Having been an IT admin in my former life, and also having operated in a similar fashion to you, allowing unfettered access to the internet for our employees (it was a Fire Department, and the staff was there for 48 hrs straight, so allowing them some creature comforts such as facebook and youtube was appreciated). Having solid, centrally managed AV on each client machine, along with limited local user rights seemed to be effective.

      I wish more facilities would take this tact instead of letting some firewall with a blacklist subscription slowly narrow the available internet to static sites that are considered "safe." True irony that advertising from some of these safe sites are now delivering payloads. Ironically, where I work now (not in IT), plenty of popup ads from news sites make it through, so I would assume we're vulnerable through this vector.
      • Re:Yup....seen it. (Score:4, Insightful)

        by Em Emalb ( 452530 ) <> on Tuesday March 23, 2010 @10:36AM (#31583518) Homepage Journal

        Obviously, the biggest hurdle we're having to deal with is user education. I've got a select few folks in various departments learning to work with ad-block and no script, but for the average person, it's hard to figure out what they need to unblock and what they can block with no ill effects. It's frustrating to them, and by extension, our helpdesk guys who end up fielding calls from the same people (over and over) with the same questions. Of course, the other issue we have is vendor lock in, with their stupid sites working correctly ONLY in IE. I hate that, but in my case (financial industry) it's so rampant there's nothing we can do about it except lock stuff down as best we can.

        That said...these large companies that aren't paying attention to the ads their serving are just as at fault as any un-educated (or even educated) user is.

        • Re:Yup....seen it. (Score:4, Informative)

          by Em Emalb ( 452530 ) <> on Tuesday March 23, 2010 @10:43AM (#31583608) Homepage Journal

          aren't paying attention to the ads their serving are just as at fault as any un-educated (or even educated) user is.

          Aw man. They're. Not their. And I make that gaffe while writing about un-educated and educated. Fail, thy name is Em.

        • Re: (Score:3, Informative)

          by E-Rock ( 84950 )

          Because of this we have enabled inPrivate filtering for IE8 via group policy (not the same as inPrivate browsing). It's an effective ad blocking tool. I hate that we have to block the revenue sources of the pages we visit, but when they're being used to deliver malware, I don't see an alternative.

      • Re: (Score:3, Interesting)

        by tunapez ( 1161697 )

        What I've found to work is, again, unfettered access combined with some sagely advice on where to find safe smut(redtube,youporn,mega...), and setting up a sandboxie icon that looks just like a regular Firefox button. Whether it be masking the icon for sanboxing or to give them a blue E to start FF/Opera/Safari, I find giving less insight into what I'm doing and just making things seem like nothing has changed is the best policy.

        Do muni FDs allow internet access outside of email and work site nowadays? I've

      • Re:Yup....seen it. (Score:4, Informative)

        by jafiwam ( 310805 ) on Tuesday March 23, 2010 @03:13PM (#31587910) Homepage Journal

        It's not the sites, it's the ad networks.

        Go get a HOSTS file that blocks ads and keep it updated and pushed out on your network.

        I see ZERO ads most days. When some new ad network annoys me, I go add it to my HOSTS file. The same thing can be done with the network DNS server without needing to modify machines.

        Believe me, most people don't bitch (very much) about not seeing ads on the internet all of a sudden. They might be curious about it, but usually that's it.

    • Re: (Score:2, Informative)

      by Nos. ( 179609 )

      I work in the security group and we had a few machines on our help desk get infected with the Antivirus Live malware. After some research, we determined that it came through a legitimate site (help desk site that emulates various OS... can't think of the name), or more specifically the ads on the site.

      We do run WebSense, but this was a legitimate site that our help desk uses quite frequently. All machines were up to date with McAfee, but it was a new variation. We ran it through within hou

      • Re: (Score:3, Interesting)

        I run a program called "TeaTimer" that automatically blocks changes to your computer or registry. I'm not sure how well it works in a work setting, but for my home PC it's caught numerous browser-based programs from doing damage.

        • Re: (Score:3, Interesting)

          by Talderas ( 1212466 )

          As I write this message, I am running a scan to make sure I just finished cleaning this virus off one of my user's machines. This user has TeaTimer installed, yet still got infected. It's rather odd, seeing as the infect piggybacks on some registry values. So either the user is mindless hitting Allow on TeaTimer, or the virus is circumventing it.

          • >>>the user is mindless hitting Allow on TeaTimer

            Yes. TeaTimer won't allow the registry to change unless you first click "ok". As for the annoyance I've not noticed any problems. A lot of times I forget TeaTimer is even running. It's certainly less troublesome thatn NoScript's constantly nagging.

        • Re: (Score:3, Insightful)

          I believe using TeaTimer would teach the average user to constantly click "Yes" without thought. As mentioned before this kind of security has a huge education barrier. I haven't run with TeaTimer since it was first introduced with Spybot, but my experience was pretty awful being prompted anytime anything was run.

          Also if TeaTimer prevents changes to the registry prompted by some piece of crapware, said crapware has already been executed. What else has it done; how much protection does blocking changes to
    • Re: (Score:3, Insightful)

      Ouch. The two news sites I browse most often. Good thing I run AdBlock and NoScript, and I wrote myself a Greasemonkey script to rewrite all the internal links to point to the print-friendly (read: ad-free) versions of the articles.
    • by Hadlock ( 143607 )

      Hell, just last week (last Friday!) a flash ad on TechCrunch (linked to from Google News, no less!) opened a new tab in Google Chrome and downloaded a PDF to my desktop under XP SP3. That was an eye opening experience....

    • Why I don't run ads (Score:5, Interesting)

      by KingSkippus ( 799657 ) on Tuesday March 23, 2010 @11:25AM (#31584236) Homepage Journal

      Yup, I've seen it, too. I run a gaming web site that gets around 2 million page loads a month. A long time ago, I made a deliberate decision not to run ads. My rationale at the time was that I didn't mind paying the hosting cost because it's my hobby. Some people pay a lot on woodworking, some people pay a fortune on golf. My hobbyist indulgence is paying the monthly fee for a VPS to host the site.

      A while back, when I needed more power for the site and the hosting costs went up, I made a deal to move the site (which was a MediaWiki-based wiki) to Wikia. They promised me that there would only be one ad on the site, that it would never be injected in the content, that it wouldn't be obtrusive, and other such things. After the site was moved, they proceeded to go back on these promises, and several more.

      After less than a year, the other administrators and I decided to re-host the site ourselves, and ask for donations. Again, we don't run ads, and thanks to donations, I'm almost breaking even on the hosting costs.

      Recently, someone pointed me back to Wikia's site. It is a tragedy. Aside from being woefully out of date, there were six or eight ads, including javascript and Flash ads that obscure parts of the screen and injected into the articles. Worst of all, some of the "malvertising" discussed in this article.

      Here's what's kind of bad. Because Wikia uses SEO crappy games, their site still comes up on top of the search results in Google. (You should see the page titles, they're 10 or 15 words long.) I recently posted a message on the game's official forums warning people of the malevolent advertising, because I wanted to make sure people used the right URL for our wiki, and it was a good chance to reiterate how important it is to us to keep the site ad-free.

      A week or so ago, one of the guys at Ars Technica ranted in an article about how people who use ad blocking are stealing content. It's the same argument I've seen higher profile people (Rubert Murdoch, I'm looking at you...) make the same claim. I said then, and I still maintain, that using ad blocking and Flash blocking is not just a matter of convenience, but a matter of maintaining the security of my system.

      Fortunately, I like sites like Ars Technica, because they provide an alternate means of reading their content without "stealing" it, and I have a paid subscription to the site. However, as long as a site's only business model is advertising, I don't feel one iota of guilt in protecting my system. If they block content if ad blockers are being used, more power to them, I'll find another site to read.

      But stories like this, stories I've actually felt first-hand, are why I support sites without advertising, I do what I can to opt out of advertising, and I don't force advertising on visitors to sites I run myself.

      • Re: (Score:3, Insightful)

        by Seedy2 ( 126078 )

        I saw the word "malvertising" and thought it was redundant. I have always considered ALL advertising to be malware. Including print and TV advertising. They are all an attempt to force me to view their message, which I neither want nor asked for, and block or delay me viewing what I want to see.

  • Never ever click an ad!
    • by Anonymusing ( 1450747 ) on Tuesday March 23, 2010 @10:22AM (#31583306)

      FTA: "Users don't need to click on anything to get infected; a computer becomes infected after the ad is loaded by the browser."

      • by oldspewey ( 1303305 ) on Tuesday March 23, 2010 @10:38AM (#31583546)
        Indeed, and for people browsing Fox News, you don't even need a computer to be infected.
      • I guess I'll start whitelisting advertising when they can stop drive-by malware infecting my computer.

        AdBlock can stay enabled for the time being. Sorry, Ars.
      • I thought the text-only ads from Google will not allow an advertiser to embed Javascript. Not sure about their newer Flash ads which can embed ActionScript, but one would think Google will be more careful with that. Maybe it is possible that Google still unknowingly redirects you to a malware page after you click on an ad, but the pie chart in TFA does not show Google DoubleClick (probably an insignificant amount under Others). In addition, Google may use the automated method behind to deter

      • by alexhs ( 877055 )

        FTA: "Users don't need to click on anything to get infected; a computer becomes infected after the ad is loaded by the browser."

        Which probably actually means :

        Users don't need to click on anything to get infected; a Microsoft Windows OS becomes infected after the ad is loaded by Microsoft Internet Explorer.

        • Nope, I've had users get infected with this that solely use Firefox for web browsing. This is not a virus that exploits Windows, it's really targeted at exploiting Adobe vulnerabilities plus a few others.

    • by julesh ( 229690 ) on Tuesday March 23, 2010 @10:24AM (#31583344)

      Never ever click an ad!

      Clicking not necessary. I was infected with malware earlier this month without any interaction after visiting the Pirate Bay. An advert used javascript to redirect me to an obscure URL ( [] ), which proceded to use a Firefox flaw of some kind to infect me. 3.6 doesn't seem to be susceptible, but 3.5.7 which I was running at the time *was*. The exploit installed a Firefox extension that randomly redirects links from google, yahoo and bing to advertising pages.

      • by stony3k ( 709718 )
        Use Noscript - it warns you when a URL hijack attempt occurs
  • by bhamlin ( 986048 )

    Really, who is surprised by this? What's the cost of an ad and fake credentials compared to getting a chance to infect millions of computers?

    • as far as I know the margins on selling infections aren't that fantastic.
      I depends on who you're infecting though.

  • Good thing the combo of AdBlock, NoScript & FlashBlock will basically prevent these kinds of attacks.

    • Re: (Score:3, Informative)

      by bunratty ( 545641 )
      In addition, you can also use the Plugin Check [] to make sure you have the most recent versions of plugins to decrease the risk of attack. And don't forget to turn on DEP [] for all programs and services on Windows.
    • Mod up, mod up...
      How many times do we have to repeat this?
      For those without Firefox and those extensions you point out, do your 'hosts' file: []
      Good for Chrome lovers and, of course, non-Windows platforms.
      Yes - Apple and *Nix users are vunerable too...especially if in a mixed network with Windows boxen.

      Peerblock is worth a look too... []

      • How exactly are Mac an *nix users vulnerable?

        All of the malware being delivered only runs on Windows.

    • by 0ld_d0g ( 923931 )

      Unfortunately, that makes the web unusable for many people. Most people commenting here aren't the kind who get infected by malware.

      • Well, AdBlock and Flashblock don't cause a problem for most people in my experience. NoScript drives them crazy though. And given that Flashblock (last I checked) doesn't provide real security (the Flash is loaded briefly before being replaced in the DOM, so the window of vulnerability remains), you're stuck with hoping the AdBlock filters are up to date. It's better than letting them browse on unprotected IE6, but without NoScript you're still vulnerable to exploits served from very new hosts (too new to s
        • by Jaysyn ( 203771 )

          When I "fix" a Windows PC I always make sure to explain to the owner exactly what NoScript does & how to use it. I also stress to them how important it is that they actually use it & don't just "enable all" scripts. I generally don't charge my friends or co-workers for the 1st time I clean a PC but the on the two occasions I did get a PC back that had the floodgates opened so to speak, I charged the owner about $10 less than what Best Buy does for cleaning a PC. You can't fix stupid, but you can

  • Adblockers anyone (Score:5, Insightful)

    by Galestar ( 1473827 ) on Tuesday March 23, 2010 @10:23AM (#31583330) Homepage
    Yet another reason to use ad blockers. I'm starting to think Firefox should come with it out of the box.
    • by Monkeedude1212 ( 1560403 ) on Tuesday March 23, 2010 @10:40AM (#31583572) Journal

      The problem is that a large amount of money on the internet is made through advertisements. If Firefox gains marketshare, and starts with adblocking, thats tons of revenue stream being cut off. Google makes a lot of money through advertising, and they seem to be the only ones pushing for progress right now. I don't know if I'd want to go and reduce their income.

      In Alberta - it's illegal to have a billboard on a Highway. Based solely on the idea that it causes more accidents because billboards are distracting. This isn't a direct attack on the speed limit, a major factor, or Alchohol, another major factor. Because attempting to control those other 2 factors would cause a huge upset.

      Same with internet advertising, you can't just stop it all and make the world a better place.

      • You could conceivably stop all flash and scripted ads though. Sure there have been cases in the past of people exploiting image formats but they're all pretty well locked down now, if you can't get your message across with images and text then you can't expect your audience to be too sympathetic when your flashy advert allows the bad men to infect their PCs.
    • by rtaylor ( 70602 )

      You might want to double check FireFox's revenue streams before suggesting they implement adblocking by default.

  • Adblocker (Score:5, Insightful)

    by wisnoskij ( 1206448 ) on Tuesday March 23, 2010 @10:32AM (#31583460) Homepage

    I would like to support sites by viewing their ads but if it leaves you more open to viruses even on high-profile sites then it is not worth the risk.

    • Re: (Score:3, Interesting)

      by jedidiah ( 1196 )

      Yes. This goes way beyond being "merely annoyed". If it becomes a security issue then ads need to go in general.

      This is another example of how "outsourcing" leads to loss of quality and control. If you are going to spam someone then you need to be in control of the relevant content. You need to take responsibility for it. That seems to be the real problem here. You end up needing to whitelist 10 or 20 scripting hosts for the average "legitimate" website.

      • I think you'll find very few malware writers outsource to India. They prefer their malware to actually work !

    • Make the Ads Safe (Score:5, Insightful)

      by The Angry Mick ( 632931 ) on Tuesday March 23, 2010 @10:51AM (#31583714) Homepage

      I would like to support sites by viewing their ads but if it leaves you more open to viruses even on high-profile sites then it is not worth the risk.

      Very good point, especially in light of Ars Technica's recent plea [] to users to stop blocking ads.

      I, too, would be than more willing to disable the protective measures I've got in place, but as long as these sites rely on third party advertisers that are more concerned with eyeball collection than system security, we have a stalemate. If sites want me to see their ads, they have the burden of making sure the ads are safe (less annoying, would also be good). If I lower my guard out of "friendship" for a site, only to get a drive by download as a reward, I'm going to take it as a major breech of trust.

      • by IICV ( 652597 )

        Are the Breeches of Trust related in any way to the Trousers of Time?

        On a more serious note, this is exactly why Ars Technica's plea was in vain - they want users to stop blocking ads, because that will bring them more money from the people who buy ads on their site. However, the people who buy ads on their site aren't making enough revenue from the ads as it is, and so resort to these intrusive, virus-laden pieces of shit in a weird attempt to generate more revenue.

        This is why I don't feel bad about blocki

    • by ajs ( 35943 )

      You could always whitelist ads on sites that you want to support while turning off JavaScript (e.g. using noscript). Most ads will still display (unless they're flash, and then it really was their choice, wasn't it?)

      That's what I do. I even leave Slashdot's ad opt-out checkbox unchecked.

  • by geegel ( 1587009 ) on Tuesday March 23, 2010 @10:35AM (#31583498)

    The way I see it, no browser should be designed to require admin rights. All that it needs is a sandboxed environment for temporary files. When this mantra gets in the developers' heads, such exploits will no longer be possible. Of course, by that time, other type of exploits will be invented, but we'll cross that bridge when we reach it.

    • Re: (Score:3, Interesting)

      by Neil Watson ( 60859 )

      In UNIX one might try running the browser as another user via 'su'. That user could be isolated with no useful data or access. Probably some X permissions will have change to allow the browser to display on an X server owned by another user.

      Could this be accomplished with Windows?

      • by geegel ( 1587009 )

        Basically yes. What's to stop a developer to code a browser with an emulator type architecture? You load the environment and in that environment you load the browser, while restricting its rights to the bare minimum.

      • Re: (Score:3, Interesting)

        by TheRaven64 ( 641858 )
        The problem with this approach is that the browser itself contains useful data - things like access to your Internet banking site, for example. Ideally the browser would create a new process when you navigate to a new site and chroot() that instance so that it can't get any access to the filesystem beyond that. That way, a compromised browser would only ever gain access to caches and passwords for the site that performed the attack. The wrapper would reparent each of these processes' windows into somethi
    • The way I see it, no browser should be designed to require admin rights. All that it needs is a sandboxed environment for temporary files. When this mantra gets in the developers' heads, such exploits will no longer be possible. Of course, by that time, other type of exploits will be invented, but we'll cross that bridge when we reach it.

      The way I see it, no browser updates should be designed to require admin rights. Back in the day, FF installers for windows didn't require admin rights; anywhere a user could install was fair game. I don't know if that's still true. But, what if the core executables were owned by root, but updates could be owned by various users? i.e. on opening, browser checks web for updates, if it finds some, it downloads the updated exe or dll to local user dir, and then restarts itself using the new version. If no

    • Huh? AFAIK none of the major players require admin rights. In addition Chrome (on XP/Vista/7) and IE8 (on Vista/7, not XP) both sandbox themselves and have been doing so for over a year now...
      • by geegel ( 1587009 )

        Well, most Windows users login into their OS with admin rights and when they launch the browser they automatically assign these rights. Basically, a browser should start with minimum rights regardless of what type of user launches it. Thank you for helping me clarify my point.

        Chrome and IE8 have a combined market share of about 30% according to statcounter []. This is indeed the right approach, but until ALL the major players and their most important versions take the route of sandboxing, malvertising will con

  • Ars Technica (Score:5, Insightful)

    by Anonymous Coward on Tuesday March 23, 2010 @10:35AM (#31583500)

    And Ars Technica says I shouldn't block ads.

    I repeatedly told their staff that I don't block Ars Technica, but I do block ad servers. If they want to send me ads let them server them from their own domain.

    Sites resposible for ad-vectored infections should be hit with hundreds of small claims court lawsuits to recoup the costs to clean up the infections.

    Maybe then they'll learn.

    • Advertising shitheads that want to run ad servers and serve up ads to hapless intarweb users should vet the content their customers are asking them to serve up. And not allow their customers to upload new content without being vetted. They should report any customers that misbehave. And they should be forced to do all this, on pain of literally having some guy named bubba come an break a finger for each offense.
  • by John Hasler ( 414242 ) on Tuesday March 23, 2010 @10:35AM (#31583506) Homepage

    > I usually suspect the users of 'careless web activity' when I delouse a PC...

    They are guilty of 'careless web activity': not blocking ads.

    • Re: (Score:2, Informative)

      Don't block ads. Use NoScript. Blacklists are easily compromised. Whitelists are much more difficult.

      • > Don't block ads. Use NoScript.

        I use NoScript to block scripts. I use Privoxy to block ads.

        > Blacklists are easily compromised. Whitelists are much more difficult.

        Nothing gets through and I can selectively allow scripts.

    • I'm more than happy to tolerate ads if it supports my continued free access to some great web content and services. To be honest, I pretty much never notice them anyway so if the site owner benefits from them being there and I don't suffer any detriment, that's a true win-win situation (I've never blocked /. ads for the same reason, even though they kindly give me the option to disable them, I'm happy enough with the service they provide). If, however, I was similarly infected by visiting a reputable site I
  • ORLY? (Score:2, Interesting)

    Let's see here... an anti-malvertising/malware firm reporting lots and lots of malicious "bad things" being served up by those terrible pesky Internet ads... no agenda here. The report failed to follow-through and dig into the real problem with malicious payloads associated with online ads, the ad network daisy-chain. If network-A has no impression for you, you're handed off to network-B, which may have no impression and then gives you to network-C... and so on. As your impression traverses the daisy chain
  • by WCMI92 ( 592436 ) on Tuesday March 23, 2010 @10:43AM (#31583616) Homepage

    Then we should start blocking the ad networks from our networks.

    If lots of people started doing that, I wonder how quick Google, Yahoo, et all would start screening advertisers for malware?

  • by MikeRT ( 947531 ) on Tuesday March 23, 2010 @10:52AM (#31583722)

    They complain about advertising revenues while they are serving up ads that contain malware. To someone who hates ads to begin with, that's like saying "we know you don't enjoy crawling over broken glass, so how about crawling over glass mixed with AIDS-infected blood and barbed wire?"

  • by Anonymous Coward on Tuesday March 23, 2010 @10:52AM (#31583736)

    how about badvertising?

  • by Anonymous Coward on Tuesday March 23, 2010 @10:53AM (#31583746)

    That's why I am so pissed at site designers who go "lalala I can't hear you" whenever I request they make their site accessible without "active content" (i.e. Javascript, Flash, Java or even worse things).

    It's nifty and all, but nowadays it's the main malware distribution mechanism. And you can't tell users "just switch off Javascript", because suddenly, half of the Web won't work (I do switch of Javascript: no, not NoScript. Just The Real Thing -- and for most, I'm even glad *this* half of the Web doesn't work -- but I can't tell a regular user to do the same). Heck, those $@#%! web designers even do regular links with javascript snippets for reasons inscrutable to me. Disgusting.

    Advertisers? Do you hear me? I'll look at pngs, jpegs and gifs, even animated. I'll read text. but I won't even see your Javascript/Flash/whatever stuff.

    There. Had to be said.

  • Ad networks should not enable their clients to include Javascript, Flash, Java, or other active content in the first place. If they have a compelling business case for doing so, all code should be "whitelist" filtered before being distributed. The ad network's reputation is on the line every time they serve an impression.

  • It's a small price to pay for not using AdBlock. So remember: don't use it.
  • Once again, we cannot trust advertising that does not come directly from the web site being contacted. No surprise there. Further, there are times when we cannot trust advertising that DOES come from the site being contacted.

    The only safe content, so far, is based on simple text and pictures.

    Are you listening advertisers? TRUST the people you are advertising through to host and deliver your ads appropriately. RESPECT your audience enough to avoid using flash and other nonsense. Do this and people will

  • by rickb928 ( 945187 ) on Tuesday March 23, 2010 @11:07AM (#31583960) Homepage Journal

    I have a running dialogue with a webmaster of a celebrity paps site (ok, sue me) about the various bits of malware that are being served up by her various advertisers. This began a few months ago, and it took a while before I figured out they could not be expected to know this was happening. She has tracked down the source of these adverts to an agency that offered her triple the usual rate. Now she knows, among other things, that if it's too good to be true, there is a reason why.

    But, she and I have synched clocks so she can know to the few seconds what I got. She has to report back precise details to get her advertisers to figure out what happened, cause most of her direct advertisers are contracting out ads to other agencies, and they sell other ads, and the chain gets long and obscure in no time at all.

    So far, she is helpful, but last week I sent her a screenshot of a nasty one installing that 2010 antivirus onto one of my virtual machines, and it turned out to be her oldest and most loyal sponsor, and an entirely legitimate ad that had gotten hijacked on the way to her server. Yup, her server is compromised, and some ads are being re-written on the fly from other sources. Makes sense to me, just another vector. This is not good - even honest webmasters are vulnerable, though she called in a team/favor to fix up her server, which is supposed to be monitored for this stuff. Oh well.

    Is there any defense? I'm using VPC2007 to run browsers just to be able to look at the nasty stuff being inflicted on me (not the celebs, thank you) and I can't imagine the fun of doing this from my desktop. Ewww.

    When the NYT is being used, we are past blaming the source.

    Not to mention the waiting time I see for ad servers. I want the damned content I asked for, thank you, perhaps webmasters need to find a way to ditch slow ads and let us see what we wanted to in the first place, ok? Thanks!

  • I've been hit twice in two weeks with attempted installs of trojans/fake anti-spyware just from visiting pages linked to from Slahsdot stories. Not amusing.
  • ...that I never removed DoubleClick from the list of sites that aren't allowed to deliver content to my browser.

  • I install Firefox on every machine I set up and then add AdBlockPlus and Ghostery. It's amazing what these two block. Mind you, they are not perfect and sometimes you have to allow some code to get through with Ghostery or the site does not work. Lastly, of course, you should use Linux. That helps a lot...
  • by _KiTA_ ( 241027 ) on Tuesday March 23, 2010 @11:26AM (#31584260) Homepage

    I work at a pinch hitter Tier 2 Pay to Play tech support company that is outsourced to by several major ISPs.

    I see these damned things all the time. Usually they come with names like XP Antivirus 2010 or "Vista Security Center" or somesuch crap. They almost exclusively look the same, and there are new names that appear every so often -- XP Antivirus 2010 was "Internet Security 2010" not too long ago, for example. I suspect there is a kit that these companies are using to make their products.

    They are almost exclusively coming in from banner ads. Specifically they use a Flash ad that, after a few minutes, or upon webpage close, or mouseover, opens an infected PDF file on a random infected server. Google Chrome occasionally catches these domain names, usually they are IP addresses or something similar.

    Flashblock is NOT foolproof (although it does help), as occasionally they just have the ad banner on an infected server that auto-redirects you to a PDF file immediately.

    They are occasionally Java files instead, but almost exclusively they are PDF files.

    They're actually getting very creative in their infections. XP AV 2010, for example, sets itself up as the handler for EXE files -- in order to remove it, you have to install Malwarebytes and rename the mbam.exe file as or something similar. You can also dive into the registry to fix the EXE thing, except if the program is running it will just break it again immediately. Either windows does not have support for hijacking the .COM support in Windows XP/Vista/7, or these viruses just aren't thinking to try yet. Once they do, then our options drop to "OS Reinstall", as you can literally not run anything.

    Some of these programs install themselves in such a way that if you attempt to load Safe Mode, your OS will intentionally BSOD. Or, in at least one infection, the screen filled with ASCII smiley faces and didn't continue.

    Combofix will also remove most of these, and usually with "Security Center" or "XP AV 2010" we give up and run Combofix immediately.

    The solution to prevent future infections isn't to move to Firefox or Chrome -- these infect those just as easily, although Chrome seems to just crash it's Flash plugin instead. In order to fix these, you have to update Adobe Flash, Adobe PDF, and Sun Java to the latest versions. PDF is the most important, but not the only one. Better browsers won't work. Antimalware programs won't work. The only way to fix it is to patch the holes.

    • by mr.bri ( 886912 ) on Tuesday March 23, 2010 @11:59AM (#31584730)
      Yep. You don't have to click on anything to get infected. We've had a couple of our systems infected over the past couple of months. What scares me is:

      1. We were running the latest version of Firefox
      2. Acrobat Reader was fully patched (version 8, not 9. But, we have to leave the JS enabled)
      3. Adobe Flash was up-to-date
      4. Windows was fully patched
      5. We have web filters
      6. They got past 2 layers of IDS/IPS and 3 layers of antivirus scanners (different engines)
      7. Users are NOT admins!!!

      Since then, we have switched to a few new products and attempted to tighten things up even more, but these things have gotten incredibly complex. In one case, it was a triple attack. The Flash ad (0-day exploit) loaded an exploited PDF (0-day exploit) that took advantage of a 0-day IE exploit (keep in mind we use Firefox), which compromised the system. We have a nuke-from-orbit policy on any system we suspect has been infected, but what a waste of time!

      It was hosted from a site in India. The user was on Yahoo's website (we've had 4 infections through Yahoo's ads). They did NOT click on anything!

      Be very afraid!
    • Re: (Score:3, Informative)

      by E-Sabbath ( 42104 )

      Same experience except: my sneaky trick is to install mbam on the infected computer, then run the same version of it off a flash drive. Surprisingly, it works.

      Also, do you think using Foxit instead of Adobe might help? For that matter, setting PDFs to not auto-open?

  • by Coopjust ( 872796 ) on Tuesday March 23, 2010 @11:37AM (#31584444)
    Two weeks ago, someone asked me to reinstall Windows XP for them. Their disk was XP SP3.

    I reinstall, and open IE to visit Windows Update

    Instantly, I get a Vundo variant from a malicious ad attacking the out-of-date Flash Player that came with XP that installs without any user intervention whatsoever.

    This only served to reinforce that I was right and not a webmaster/free content hating jerk when I block ads online.
  • Doubleclick too... (Score:3, Informative)

    by Tteddo ( 543485 ) on Tuesday March 23, 2010 @12:14PM (#31584970) Homepage
    I fix PC's for a living and I have been seeing this too. Some people all the do is Facebook and they are getting "XP Antivirus" or it's variants, and I know there is no way they are doing anything. They all use Firefox, etc. The last 2 weeks I have been putting on Ad Block Plus and explaining to them what it does because I was having people get infected again in a manner of weeks after I clean it up the first time. I know that kinda sucks for website revenue, but what else is there to do. One guy got infected from Photobucket, and it was repeatable.
  • Remind me (Score:4, Insightful)

    by sjames ( 1099 ) on Tuesday March 23, 2010 @01:07PM (#31585890) Homepage Journal

    Why is it somehow un-ethical to block ads again?

    Perhaps it's a good idea for big sites with a reputation to maintain to borrow just a bit from the old model where they sell ad space with an approval process directly to advertisers and serve the images from their own servers.

  • Sue DoubleClick (Score:5, Interesting)

    by Animats ( 122034 ) on Tuesday March 23, 2010 @01:24PM (#31586160) Homepage

    A big class action against DoubleClick, etc. would be appropriate. They "exceeded authorized access", as defined in the Computer Crime and Abuse Act. That they got the attack from someone else isn't an absolute defense. The ad network obtained "something of value" for the attack. If they sent out one attack after they'd been informed, they were doing so "knowingly".

    The ad network has the right to find and sue the source of the ad, but that's their problem, not the end user's problem. This is well-established law. In general, you can sue the party you dealt with, and they can sue the next party up the chain.

"If it's not loud, it doesn't work!" -- Blank Reg, from "Max Headroom"