3 ms·

The bare minimum any ad network should be doing before allowing an advertiser to use a Flash .swf file on their network (or even custom HTML/JS for that matter)

by stevenh 11y ago

The bare minimum any ad network should be doing before allowing an advertiser to use a Flash .swf file on their network (or even custom HTML/JS for that matter) is to whitelist certain functions and elements. They need to automatically decompile the .swf for analysis upon upload and reject it if it contains any ActionScript commands that aren't specifically whitelisted. There is no reason for a Flash file on an ad network to be permitted to use any functions other than those necessary for basic animation, mouse/touch interaction handlers, and a navigateToURL call. The same principle applies to custom HTML/JS. Otherwise the advertiser might as well toss a bitcoin miner into their scripts; it's not like Yahoo is stopping them. By not implementing the bare minimum of incredibly obvious basic precautions for handling mysterious executable content before spraying it indiscriminately across the entire web, Yahoo's incompetence borders on malice and in my mind that makes them complicit in these crimes.

simonw 11y ago
Do you know if any ad networks actually manage to do this? This strikes me as an extremely hard problem. ActionScript supports an eval() function, which should make static analysis almost impossible - how can you tell if someone is compiling together an evil string (that calls functions you have banned) and then passing that string to eval()?
- jdangu 11y ago
  We (ClarityAd) do this for major ad platforms. We use a mix of static and dynamic analysis to assess risk. We've been able to detect and stop major exploit kit campaigns over the last few months. Ads have specific expected behaviors and their SWFs are not supposed to generate code dynamically.
jerf 11y ago
ActionScript is, as I understand it, a lot like Javascript, and that solution won't work for Javascript because there's too many ways to execute code. For a whitelist like that to even have a chance it would have to be implemented in the runtime itself as a sandbox, and even then I'd be skeptical about its effectiveness in JS. (Retrofitting sandbox-ness onto a dynamic language is on the list of things that are really hard to retrofit onto an implementation that wasn't designed for it, whereas if you design for it from day 1 it isn't necessarily that difficult.)

by stevenh 11y ago

simonw 11y ago

Do you know if any ad networks actually manage to do this? This strikes me as an extremely hard problem. ActionScript supports an eval() function, which should make static analysis almost impossible - how can you tell if someone is compiling together an evil string (that calls functions you have banned) and then passing that string to eval()?

jdangu 11y ago
We (ClarityAd) do this for major ad platforms. We use a mix of static and dynamic analysis to assess risk. We've been able to detect and stop major exploit kit campaigns over the last few months. Ads have specific expected behaviors and their SWFs are not supposed to generate code dynamically.

jerf 11y ago

ActionScript is, as I understand it, a lot like Javascript, and that solution won't work for Javascript because there's too many ways to execute code. For a whitelist like that to even have a chance it would have to be implemented in the runtime itself as a sandbox, and even then I'd be skeptical about its effectiveness in JS. (Retrofitting sandbox-ness onto a dynamic language is on the list of things that are really hard to retrofit onto an implementation that wasn't designed for it, whereas if you design for it from day 1 it isn't necessarily that difficult.)