10 ms·

Major sites including New York Times and BBC hit by 'ransomware' malvertising

162 points by oneeyedpigeon 11y ago

Rainymood 11y ago
Another good reason to use ad-blockers. If I can't use your site with an ad-blocker then bye bye ... looking at you Forbes.
- oneeyedpigeon 11y ago
  I wonder why The Guardian isn't (at the time of writing) allowing comments on that article. Could it be because their business model has an over-reliance on people not using ad-blockers?
  - philk10 11y ago
    maybe because it's an article and they usually only have comments on Opinion pieces?
    - oneeyedpigeon 11y ago
      It's nowhere near that simple, unfortunately. They have comments enabled on many news stories. They moderate very heavily, and as a result use a complicated system whereby comments may or may not be enabled on a given article at a given point in time, depending on a) how 'controversial' the subject is b) moderator availability.
      - emodendroket 11y ago
        Well, considering the trash that tends to get posted on news sites you can't really blame them.
  - CM30 11y ago
    Probably because the comments would make them look bad. That seems the general reason for a Guardian article having/not having comments. If they think the userbase are likely to agree with the writer they'll be on, and if they think the userbase is likely to eviscorate them (or in cases like this, talk about adblockers and stuff), then they'll turn them off.
    - Hoasi 11y ago
      Really? Selective commenting seems a terrible way to handle the matter if that's the case.
- tallanvor 11y ago
  Yes. It's funny how more and more sites act like it's morally wrong to block ads, but obviously aren't willing to do the work to protect their visitors from this sort of thing.
  - JorgeGT 11y ago
    They could deal with advertisers themselves and manually approve and display text/image ads from their own domain (as it was done in printed newspapers), but isn't it easier to just leave a div+javascript and have the right of arbitrary code execution in a chunk of your page get auctioned off to the highest bidder by several shady ad network? Just go to www.bbc.com and look at what domains your ad-blocker denies: edigitalsurvey.com, chartbeat.com, googletagservices.com, scorecardresearch.com, effectivemeasure.net, iperceptions.com, krxd.net, optimizely.com... now imagine if your printed newspaper shot at you a GPS receiver with a mic, a cam, etc. Surely it wouldn't be morally wrong to duck and avoid that bug?
    - ballsohardy 11y ago
      Wouldn't this...(gasp) cost them more money? Going through html/css/js to make sure it isn't hiding anything sketchy in it is why these things make it into ad networks in the first place, and automated review is never perfect, as we see with Google Play and iOS stores. Content providers need to 1) Shut the fuck up 2) Write less clickbait and more high quality shit actually worth subscribing to
    - stevesearer 11y ago
      You're still susceptible to ad-blocking if you serve an plain image ad from your own domain though, which sucks for those of us who do it. If there is a way to alert users that you vet, self-serve, and don't use animated ads, I'd love to know about it :)
      - CaptSpify 11y ago
        Many sites have a "please don't block ads" notice. Could you notify users via that method? Obviously it wouldn't work 100% of the time, but it might yield interesting results.
- e40 11y ago
  If I can't use your site with an ad-blocker then bye bye ... looking at you Forbes. I can use it with uBlock Origin and the 3rd-party filter "Anti-Adblock Killer | Reek‎" turned on.
  - parennoob 11y ago
    I know I can do this, but a) I like to limit the number of random extension I install on my browser. b) The fact that Forbes turned on an adblock-blocker shows me that they are seeing a significant revenue hit on account of adblocking, which will force them to do paywalled content sooner or later. I don't value Forbes content that much (in fact, it's often click-baity), so I'd like to wean myself off it sooner rather than later.
    - karlshea 11y ago
      For point a, it's not another extension, it's a list of filter rules you load in uBlock Origin like all of the others on its 3rd-party filters tab.
- thinkcontext 11y ago
  NYT just today pushed me to whitelist them on detecting adblocking.
- sxcurry 11y ago
  Fortunately, missing the Forbes site isn't a loss - might even be a positive in terms of information content!
- teaneedz 11y ago
  Yep. I haven't even attempted to click on a Forbes link (shared, or recommended) in ages. Any site that still serves interstitials also gets promptly sent to the pits of despair or dev/null.
oneeyedpigeon 11y ago
Shocking that the BBC is affected by this, given that it should be advertising-free. Presumably, this affected non-UK residents[1], but as a public service the BBC should have much higher standards when it comes to advertising. [1] With the obvious caveat that a website can't reliably determine that.
- tfm 11y ago
  Aren't all world-facing websites "a public service"? BBC within UK has a special remit because of the funding structure (thanks to the increasingly-inaccurately named "TV" licensing fees), but BBC [Worldwide] is just another content provider in the big old crazy world. It doesn't seem surprising that BBCW use an external advertising network: it would be a pretty huge investment to operate their own advertising markets throughout the world ... and surely if they did, they'd then on-sell those services! Seems that the notable part of this attack is that several high-profile websites were affected, so BBC (and NYT, and AOL, etc) suffered some damage to their brand, so they'll have to work on that. The article notes that "malware was delivered through multiple ad networks", which speaks to failures by those service providers. Reckon there will be some very heated conversations and perhaps fee renegotiations with the networks happening over the next few weeks ;-)
  - oneeyedpigeon 11y ago
    > it would be a pretty huge investment to operate their own advertising markets throughout the world It is becoming clearer and clearer to me that this is one of possibly two options left for businesses wishing to make money online via advertising. Self-hosted adverts are probably the best way to regain trust and circumvent ad-blockers. A quality, trustworthy third-party network is the only other possible option I can imagine, but that seems far less viable.
    - tfm 11y ago
      > A quality, trustworthy third-party network I'm sure that most networks start off with such lofty ideals, maybe they even believe them ... :-o EDIT: To expand a little on the previous thought: you were shocked that the BBC website was serving up dodgy ads, presuming maybe that they'd have their own curated advertising portfolio. Closest comparison I can think of is perhaps the Economist website, also London-based, and no small prestige branding that they make sure to protect by only showing ads for Lexuses and Rolices (Rolexen?). The major differences of course are that Economist is somewhat more up-market, and the ads are seen locally in the UK. I can't readily find any figures on how much cash BBCW makes off website ads, but I'd have to assume that it's burger money -- a few quid here and there for negligible effort, and after all who cares if the brand is tarnished abroad?! If on the other hand BBCW went into the ad curation business, and even if it happened to be profitable, there's every chance that voters or MPs would get stroppy about it, and BBC gets a hard time going into the next licence fee negotiations. Ultimately, BBC's brand outside the UK isn't something that the UK public necessarily worries about.
jkot 11y ago
Adblocking is immoral, but malware filtering is not :-)
- LeoNatan25 11y ago
  Ad blocking is indeed very much moral.
cm2187 11y ago
One more example of why users should have: - an adblocker - javascript disabled - addins disabled (click to play)
- reustle 11y ago
  Javascript disabled? Might as well be using Lynx :)
  - ddmf 11y ago
    "Ahh, this html is far too new and fiddly. Imma going back to Gopher."
    - cm2187 11y ago
      Actually the web doesn't look too bad without javascript. It's not only safer, but you get no annoying pop ups, no text moving as you read it, etc. You basically get raw HTML+CSS. Except when some idiot thought that he needed to create a complex SPA to render a blog article. But is the opinion of such an idiot really worth reading?
      - FussyZeus 11y ago
        I agree on principle, but many very not-idiots write for websites they don't entirely control that more or less require JavaScript. I have it enabled and use uBlock, and I've never had an issue with this sort of garbage getting on my machine.
        cm2187 11y ago
        With uBlock you rely on someone manually maintaining a blacklist of domains. So it's only as safe as this person is quick to update its list and your uBlock to load the new lists. There is zero reason to require javascript to display a few paragraphs of text. You might enhance it with javascript but that wouldn't be a problem when viewed without. The blogs designed by an idiot I am referring to are blogs that will display a white page with javascript disabled.
bakhy 11y ago
an example of the power of phrasing in journalism, perhaps? the title could have also been: "Reckless media sites serve malware to visitors".
- ta0967 11y ago
  Major sites including New York Times and BBC caught peddling 'ransomware' malvertising?
cafard 11y ago
Yes, I tried to get around the WSJ paywall for the WeLive article and some crummy site tried to hit me with a beastie.
tyingq 11y ago
BBC's ads appear to come from Google's ad network. I'm curious how much effort Google puts into monitoring/policing the landing urls for this sort of thing.
rwestergren 11y ago
Interesting to note that a number of these sites were recently also serving ads vulnerable to XSS: http://randywestergren.com/widespread-xss-vulnerabilities-ad-network-code-affecting-top-tier-publishers-retailers/ http://randywestergren.com/widespread-xss-vulnerabilities-ad...
mdip 11y ago
Sadly, I've always considered adblocking software a form of security software rather than a mere convenience. Years ago I had to remove a mess of malware from my parent's PC due to a malvertisement received via MSN[1]. Since that point I've installed privoxy and uBlock Origin or similar on all PCs that I am asked to help with. Despite all of the talk about "blocking the ad blockers", I've yet to receive a phone call from anyone saying this or another web site didn't work, "Can you fix it?" I'm guessing their usage is limited enough that they don't encounter it (my dad does visit Forbes, but I haven't heard complaints). There's no way I'd surf the internet these days without ad blocking enabled and I rarely white-list sites out of concern for my data. It's becoming as important as personal firewalls / antivirus once were. [1] There was a brief period during the time that they received the malware that MSN had been hit by malvertizing and they had that as their homepage, but it could have come from elsewhere. The bottom line was that there were no sites in the riskier categories that were in their browsing history and my parent's proficiency does not include a good understanding of "incognito browsing".
- jlarocco 11y ago
  uBlock Origin, or some of its filters, can block whatever mechanism sites use to detect blocking. A while back I had a few sites warn me about ad-block, but I haven't seen it in a while.
  - mdip 11y ago
    I just switched back to that, actually. Months ago, my default browser was Firefox Developer Edition and uBlock Origin had a bug related to LastPass that caused LastPass to hang the browser so I had switched to ABP. Unfortunately, LastPass started acting up in FireFox a few weeks ago and I decided to give in to Chrome, again, so I've happily returned to uBO. I go back and forth on which to install for people that routinely come to me for help (I'm a developer, not a helpdesk, dammit!). I'm not sure if it's still the case, but months ago I actually did receive a call from my father when he attempted to install an open-source PDF creation tool that he uses at work on his home PC. It was hosted by SourceForge which uBlock had large swaths of in its blacklist. The installer did contain a bull$#*+ toolbar (several, actually), but he's familiar with avoiding crapware directly placed within installers (and to avoid "Express Installations").
NelsonMinar 11y ago
This kind of exploit is going to keep happening. The most egregious cases involve PageFair, which offers a tool to publishers that circumvents ad blockers. They too have served malware, for instance at The Economist. http://www.theverge.com/2015/11/6/9681124/pagefair-economist-malware-ad-blocker http://www.theverge.com/2015/11/6/9681124/pagefair-economist... Sometimes I think we ought to have civil liability for software security. A few lawsuits would shut stuff like PageFair down.
- xphilter 11y ago
  I agree--but the issue will likely be traceability. That is, how can the victim prove that the malware they received came from PageFair? Unless the victim had a log of all network traffic, I'm not sure there's any way to show that.
- leggomylibro 11y ago
  It would be nice if the sites themselves took some responsibility. If your ad contract includes strong SLAs with massive penalties for malware distribution, the company providing you with ads will probably take a bit more time to vet them. It baffles me that that isn't already boilerplate in advertising contracts. Sites whine about having their revenue impacted by ad blockers, but they make no effort to ensure the security of their users. Why is nobody ever held accountable for these sorts of breaches? Shifting risk to your customer is a horrible idea - nobody would buy a new car without a warranty, so why on earth are we expected to play Russian roulette with our bank accounts, personal data, and often our employer's assets? I guess the market will teach them sooner or later, but I really do not understand why the current state of ads is so widely accepted by the people who are trying to sell them.
  - thephyber 11y ago
    It seems like a circular argument you're having with the parent, but you haven't yet realized it. The profit motive is the ultimate incentive. If it takes too much time, reduces revenue by too much, or increases expenses, the ad publishers and networks will find ways to mitigate those issues. If there aren't waves of lawsuits from users who received malware from ads, there is no direct cost. If vetting ads before they are hosted costs money or reduces the bids for those ad placements, networks are incentivized against doing so. In my experience, most ad networks have blacklists for bad actors but no vetting and thus no whitelists. Blacklisting means there necessarily will be end-users that get infected and only a percentage of them will know it, a percentage of those will know where it came from, a percentage of them will report it, and only a percentage of those reports will culminate in advertiser blacklists. It's a numbers game and currently the expenses from lawsuits (the only perceived expense for publishers+networks) is much less than the revenue lost + expenses from pre-vetting all ads before they are used.
PhasmaFelis 11y ago
It's weird to me that we keep treating the sites that run malvertising as victims instead of fully complicit. If the print edition of the New York Times ran, say, a full-page ad for the KKK,* and responded to the outrage with "haha, sorry, we outsourced our advertising to a third party with no oversight," they'd be crucified. But somehow websites are exempt from responsibility for the things that they publish. Has anyone proposed getting sites that serve e.g. ransomware to pay the ransoms for everyone affected? That seems entirely reasonable. *Or insert your own offensive ad concept here.
bphogan 11y ago
I was wondering how long this would take. One of the things I've long known as a programmer for the web is that when you let a third party put content on your web site, you don't have control over what they do. Whether it's a person entering content and you fail to sanitize it, or pulling in ads from an external network, the end result is that you get something like this eventually. I don't have a solution, really, because nobody wants to pay for content, so sites have to use ad networks. But I'm surprised this hasn't happened much sooner.
- emodendroket 11y ago
  What are you talking about? This is far from the first time malicious software has been delivered through advertising.
  - bphogan 11y ago
    Ransomeware on the NFL or NYT website has been done before?
    - emodendroket 11y ago
      Ransomware specifically, no. But malicious software on major, reputable Web sites? Yes.
delinka 11y ago
If it's not served from the domain I've visited, I don't want it. If it is served from the domain I've visited but not over SSL, I don't want it. Then the certificate owner should be responsible for any damage resulting from the stuff signed by their key.
- matt_wulfeck 11y ago
  This gets tricky with things like imbedded youtube and twitter content. I would be right with you blocking content not from the same domain, but I will constantly be clicking off page to watch a video or view a tweet, etc.
  - CaptSpify 11y ago
    IMO: Those should just be offsite links anyway. I personally hate watching youtube videos shrunk down to fit in a small blog-column. YMMV, of course
matt_wulfeck 11y ago
> The vector of attack, through compromised ad networks, will also serve to inflame the debate around adblockers. This is the largest reason I install adblockers on my own laptop and phone as well as everyone in my family. I allow zero exceptions for ads. I'm willing to pay for content via other means (for example google contributor), but attack surface is simply too large.
- delecti 11y ago
  I actually use adblockers on my phones for a different reason. On my phone I'm reasonably sure I won't be affected by malware (up to date Nexus and I know not to install unknown applications), but ads take up data and slow down browsing.
ufmace 11y ago
Whenever I read stuff like this, I first wonder if my setup would be vulnerable to the attack, and if not, how much stuff I would have to turn off to be vulnerable? Chrome Stable + uBlock Origin + plugins disabled by default seems to be safe from everything but targeted zero-days. At least, I hope.
rewrew 11y ago
A lot of this has to do with these sites using ad networks instead of/along with selling ads directly. Ad networks are very common with consumer sites, but many B2B sites don't use any at all. When you work directly with the agency or company (and you know they're a real agency or company), this doesn't happen.
Geekette 11y ago
I hope AdBlock (and/or similar) works out a deal with respective companies involved (Mozilla, Apple, etc) in order to be pre-installed in future downloads of major web browsers. In addition to visual chaos and privacy concerns, the risk of compromised systems due to malware via ads is too damn high and non-tech savvy users shouldn't have to suffer for it.

162 points by oneeyedpigeon 11y ago

Another good reason to use ad-blockers. If I can't use your site with an ad-blocker then bye bye ... looking at you Forbes.

oneeyedpigeon 11y ago
I wonder why The Guardian isn't (at the time of writing) allowing comments on that article. Could it be because their business model has an over-reliance on people not using ad-blockers?
- philk10 11y ago
  maybe because it's an article and they usually only have comments on Opinion pieces?
  - oneeyedpigeon 11y ago
    It's nowhere near that simple, unfortunately. They have comments enabled on many news stories. They moderate very heavily, and as a result use a complicated system whereby comments may or may not be enabled on a given article at a given point in time, depending on a) how 'controversial' the subject is b) moderator availability.
    - emodendroket 11y ago
      Well, considering the trash that tends to get posted on news sites you can't really blame them.
- CM30 11y ago
  Probably because the comments would make them look bad. That seems the general reason for a Guardian article having/not having comments. If they think the userbase are likely to agree with the writer they'll be on, and if they think the userbase is likely to eviscorate them (or in cases like this, talk about adblockers and stuff), then they'll turn them off.
  - Hoasi 11y ago
    Really? Selective commenting seems a terrible way to handle the matter if that's the case.
tallanvor 11y ago
Yes. It's funny how more and more sites act like it's morally wrong to block ads, but obviously aren't willing to do the work to protect their visitors from this sort of thing.
- JorgeGT 11y ago
  They could deal with advertisers themselves and manually approve and display text/image ads from their own domain (as it was done in printed newspapers), but isn't it easier to just leave a div+javascript and have the right of arbitrary code execution in a chunk of your page get auctioned off to the highest bidder by several shady ad network? Just go to www.bbc.com and look at what domains your ad-blocker denies: edigitalsurvey.com, chartbeat.com, googletagservices.com, scorecardresearch.com, effectivemeasure.net, iperceptions.com, krxd.net, optimizely.com... now imagine if your printed newspaper shot at you a GPS receiver with a mic, a cam, etc. Surely it wouldn't be morally wrong to duck and avoid that bug?
  - ballsohardy 11y ago
    Wouldn't this...(gasp) cost them more money? Going through html/css/js to make sure it isn't hiding anything sketchy in it is why these things make it into ad networks in the first place, and automated review is never perfect, as we see with Google Play and iOS stores. Content providers need to 1) Shut the fuck up 2) Write less clickbait and more high quality shit actually worth subscribing to
  - stevesearer 11y ago
    You're still susceptible to ad-blocking if you serve an plain image ad from your own domain though, which sucks for those of us who do it. If there is a way to alert users that you vet, self-serve, and don't use animated ads, I'd love to know about it :)
    - CaptSpify 11y ago
      Many sites have a "please don't block ads" notice. Could you notify users via that method? Obviously it wouldn't work 100% of the time, but it might yield interesting results.
e40 11y ago
If I can't use your site with an ad-blocker then bye bye ... looking at you Forbes. I can use it with uBlock Origin and the 3rd-party filter "Anti-Adblock Killer | Reek‎" turned on.
- parennoob 11y ago
  I know I can do this, but a) I like to limit the number of random extension I install on my browser. b) The fact that Forbes turned on an adblock-blocker shows me that they are seeing a significant revenue hit on account of adblocking, which will force them to do paywalled content sooner or later. I don't value Forbes content that much (in fact, it's often click-baity), so I'd like to wean myself off it sooner rather than later.
  - karlshea 11y ago
    For point a, it's not another extension, it's a list of filter rules you load in uBlock Origin like all of the others on its 3rd-party filters tab.
thinkcontext 11y ago
NYT just today pushed me to whitelist them on detecting adblocking.
sxcurry 11y ago
Fortunately, missing the Forbes site isn't a loss - might even be a positive in terms of information content!
teaneedz 11y ago
Yep. I haven't even attempted to click on a Forbes link (shared, or recommended) in ages. Any site that still serves interstitials also gets promptly sent to the pits of despair or dev/null.

oneeyedpigeon 11y ago

Shocking that the BBC is affected by this, given that it should be advertising-free. Presumably, this affected non-UK residents[1], but as a public service the BBC should have much higher standards when it comes to advertising. [1] With the obvious caveat that a website can't reliably determine that.

tfm 11y ago
Aren't all world-facing websites "a public service"? BBC within UK has a special remit because of the funding structure (thanks to the increasingly-inaccurately named "TV" licensing fees), but BBC [Worldwide] is just another content provider in the big old crazy world. It doesn't seem surprising that BBCW use an external advertising network: it would be a pretty huge investment to operate their own advertising markets throughout the world ... and surely if they did, they'd then on-sell those services! Seems that the notable part of this attack is that several high-profile websites were affected, so BBC (and NYT, and AOL, etc) suffered some damage to their brand, so they'll have to work on that. The article notes that "malware was delivered through multiple ad networks", which speaks to failures by those service providers. Reckon there will be some very heated conversations and perhaps fee renegotiations with the networks happening over the next few weeks ;-)
- oneeyedpigeon 11y ago
  > it would be a pretty huge investment to operate their own advertising markets throughout the world It is becoming clearer and clearer to me that this is one of possibly two options left for businesses wishing to make money online via advertising. Self-hosted adverts are probably the best way to regain trust and circumvent ad-blockers. A quality, trustworthy third-party network is the only other possible option I can imagine, but that seems far less viable.
  - tfm 11y ago
    > A quality, trustworthy third-party network I'm sure that most networks start off with such lofty ideals, maybe they even believe them ... :-o EDIT: To expand a little on the previous thought: you were shocked that the BBC website was serving up dodgy ads, presuming maybe that they'd have their own curated advertising portfolio. Closest comparison I can think of is perhaps the Economist website, also London-based, and no small prestige branding that they make sure to protect by only showing ads for Lexuses and Rolices (Rolexen?). The major differences of course are that Economist is somewhat more up-market, and the ads are seen locally in the UK. I can't readily find any figures on how much cash BBCW makes off website ads, but I'd have to assume that it's burger money -- a few quid here and there for negligible effort, and after all who cares if the brand is tarnished abroad?! If on the other hand BBCW went into the ad curation business, and even if it happened to be profitable, there's every chance that voters or MPs would get stroppy about it, and BBC gets a hard time going into the next licence fee negotiations. Ultimately, BBC's brand outside the UK isn't something that the UK public necessarily worries about.

jkot 11y ago

Adblocking is immoral, but malware filtering is not :-)

LeoNatan25 11y ago
Ad blocking is indeed very much moral.

cm2187 11y ago

One more example of why users should have: - an adblocker - javascript disabled - addins disabled (click to play)

reustle 11y ago
Javascript disabled? Might as well be using Lynx :)
- ddmf 11y ago
  "Ahh, this html is far too new and fiddly. Imma going back to Gopher."
  - cm2187 11y ago
    Actually the web doesn't look too bad without javascript. It's not only safer, but you get no annoying pop ups, no text moving as you read it, etc. You basically get raw HTML+CSS. Except when some idiot thought that he needed to create a complex SPA to render a blog article. But is the opinion of such an idiot really worth reading?
    - FussyZeus 11y ago
      I agree on principle, but many very not-idiots write for websites they don't entirely control that more or less require JavaScript. I have it enabled and use uBlock, and I've never had an issue with this sort of garbage getting on my machine.
      - cm2187 11y ago
        With uBlock you rely on someone manually maintaining a blacklist of domains. So it's only as safe as this person is quick to update its list and your uBlock to load the new lists. There is zero reason to require javascript to display a few paragraphs of text. You might enhance it with javascript but that wouldn't be a problem when viewed without. The blogs designed by an idiot I am referring to are blogs that will display a white page with javascript disabled.

bakhy 11y ago

an example of the power of phrasing in journalism, perhaps? the title could have also been: "Reckless media sites serve malware to visitors".

ta0967 11y ago
Major sites including New York Times and BBC caught peddling 'ransomware' malvertising?

cafard 11y ago

Yes, I tried to get around the WSJ paywall for the WeLive article and some crummy site tried to hit me with a beastie.

tyingq 11y ago

BBC's ads appear to come from Google's ad network. I'm curious how much effort Google puts into monitoring/policing the landing urls for this sort of thing.

rwestergren 11y ago

Interesting to note that a number of these sites were recently also serving ads vulnerable to XSS: http://randywestergren.com/widespread-xss-vulnerabilities-ad-network-code-affecting-top-tier-publishers-retailers/ http://randywestergren.com/widespread-xss-vulnerabilities-ad...

mdip 11y ago

Sadly, I've always considered adblocking software a form of security software rather than a mere convenience. Years ago I had to remove a mess of malware from my parent's PC due to a malvertisement received via MSN[1]. Since that point I've installed privoxy and uBlock Origin or similar on all PCs that I am asked to help with. Despite all of the talk about "blocking the ad blockers", I've yet to receive a phone call from anyone saying this or another web site didn't work, "Can you fix it?" I'm guessing their usage is limited enough that they don't encounter it (my dad does visit Forbes, but I haven't heard complaints). There's no way I'd surf the internet these days without ad blocking enabled and I rarely white-list sites out of concern for my data. It's becoming as important as personal firewalls / antivirus once were. [1] There was a brief period during the time that they received the malware that MSN had been hit by malvertizing and they had that as their homepage, but it could have come from elsewhere. The bottom line was that there were no sites in the riskier categories that were in their browsing history and my parent's proficiency does not include a good understanding of "incognito browsing".

jlarocco 11y ago
uBlock Origin, or some of its filters, can block whatever mechanism sites use to detect blocking. A while back I had a few sites warn me about ad-block, but I haven't seen it in a while.
- mdip 11y ago
  I just switched back to that, actually. Months ago, my default browser was Firefox Developer Edition and uBlock Origin had a bug related to LastPass that caused LastPass to hang the browser so I had switched to ABP. Unfortunately, LastPass started acting up in FireFox a few weeks ago and I decided to give in to Chrome, again, so I've happily returned to uBO. I go back and forth on which to install for people that routinely come to me for help (I'm a developer, not a helpdesk, dammit!). I'm not sure if it's still the case, but months ago I actually did receive a call from my father when he attempted to install an open-source PDF creation tool that he uses at work on his home PC. It was hosted by SourceForge which uBlock had large swaths of in its blacklist. The installer did contain a bull$#*+ toolbar (several, actually), but he's familiar with avoiding crapware directly placed within installers (and to avoid "Express Installations").

NelsonMinar 11y ago

This kind of exploit is going to keep happening. The most egregious cases involve PageFair, which offers a tool to publishers that circumvents ad blockers. They too have served malware, for instance at The Economist. http://www.theverge.com/2015/11/6/9681124/pagefair-economist-malware-ad-blocker http://www.theverge.com/2015/11/6/9681124/pagefair-economist... Sometimes I think we ought to have civil liability for software security. A few lawsuits would shut stuff like PageFair down.

xphilter 11y ago
I agree--but the issue will likely be traceability. That is, how can the victim prove that the malware they received came from PageFair? Unless the victim had a log of all network traffic, I'm not sure there's any way to show that.
leggomylibro 11y ago
It would be nice if the sites themselves took some responsibility. If your ad contract includes strong SLAs with massive penalties for malware distribution, the company providing you with ads will probably take a bit more time to vet them. It baffles me that that isn't already boilerplate in advertising contracts. Sites whine about having their revenue impacted by ad blockers, but they make no effort to ensure the security of their users. Why is nobody ever held accountable for these sorts of breaches? Shifting risk to your customer is a horrible idea - nobody would buy a new car without a warranty, so why on earth are we expected to play Russian roulette with our bank accounts, personal data, and often our employer's assets? I guess the market will teach them sooner or later, but I really do not understand why the current state of ads is so widely accepted by the people who are trying to sell them.
- thephyber 11y ago
  It seems like a circular argument you're having with the parent, but you haven't yet realized it. The profit motive is the ultimate incentive. If it takes too much time, reduces revenue by too much, or increases expenses, the ad publishers and networks will find ways to mitigate those issues. If there aren't waves of lawsuits from users who received malware from ads, there is no direct cost. If vetting ads before they are hosted costs money or reduces the bids for those ad placements, networks are incentivized against doing so. In my experience, most ad networks have blacklists for bad actors but no vetting and thus no whitelists. Blacklisting means there necessarily will be end-users that get infected and only a percentage of them will know it, a percentage of those will know where it came from, a percentage of them will report it, and only a percentage of those reports will culminate in advertiser blacklists. It's a numbers game and currently the expenses from lawsuits (the only perceived expense for publishers+networks) is much less than the revenue lost + expenses from pre-vetting all ads before they are used.

PhasmaFelis 11y ago

It's weird to me that we keep treating the sites that run malvertising as victims instead of fully complicit. If the print edition of the New York Times ran, say, a full-page ad for the KKK,* and responded to the outrage with "haha, sorry, we outsourced our advertising to a third party with no oversight," they'd be crucified. But somehow websites are exempt from responsibility for the things that they publish. Has anyone proposed getting sites that serve e.g. ransomware to pay the ransoms for everyone affected? That seems entirely reasonable. *Or insert your own offensive ad concept here.

bphogan 11y ago

I was wondering how long this would take. One of the things I've long known as a programmer for the web is that when you let a third party put content on your web site, you don't have control over what they do. Whether it's a person entering content and you fail to sanitize it, or pulling in ads from an external network, the end result is that you get something like this eventually. I don't have a solution, really, because nobody wants to pay for content, so sites have to use ad networks. But I'm surprised this hasn't happened much sooner.

emodendroket 11y ago
What are you talking about? This is far from the first time malicious software has been delivered through advertising.
- bphogan 11y ago
  Ransomeware on the NFL or NYT website has been done before?
  - emodendroket 11y ago
    Ransomware specifically, no. But malicious software on major, reputable Web sites? Yes.

delinka 11y ago

If it's not served from the domain I've visited, I don't want it. If it is served from the domain I've visited but not over SSL, I don't want it. Then the certificate owner should be responsible for any damage resulting from the stuff signed by their key.

matt_wulfeck 11y ago
This gets tricky with things like imbedded youtube and twitter content. I would be right with you blocking content not from the same domain, but I will constantly be clicking off page to watch a video or view a tweet, etc.
- CaptSpify 11y ago
  IMO: Those should just be offsite links anyway. I personally hate watching youtube videos shrunk down to fit in a small blog-column. YMMV, of course

matt_wulfeck 11y ago

> The vector of attack, through compromised ad networks, will also serve to inflame the debate around adblockers. This is the largest reason I install adblockers on my own laptop and phone as well as everyone in my family. I allow zero exceptions for ads. I'm willing to pay for content via other means (for example google contributor), but attack surface is simply too large.

delecti 11y ago
I actually use adblockers on my phones for a different reason. On my phone I'm reasonably sure I won't be affected by malware (up to date Nexus and I know not to install unknown applications), but ads take up data and slow down browsing.

ufmace 11y ago

Whenever I read stuff like this, I first wonder if my setup would be vulnerable to the attack, and if not, how much stuff I would have to turn off to be vulnerable? Chrome Stable + uBlock Origin + plugins disabled by default seems to be safe from everything but targeted zero-days. At least, I hope.

rewrew 11y ago

A lot of this has to do with these sites using ad networks instead of/along with selling ads directly. Ad networks are very common with consumer sites, but many B2B sites don't use any at all. When you work directly with the agency or company (and you know they're a real agency or company), this doesn't happen.

Geekette 11y ago

I hope AdBlock (and/or similar) works out a deal with respective companies involved (Mozilla, Apple, etc) in order to be pre-installed in future downloads of major web browsers. In addition to visual chaos and privacy concerns, the risk of compromised systems due to malware via ads is too damn high and non-tech savvy users shouldn't have to suffer for it.