3 ms·

I don't know how it's done, but it happens. Forbes Shuts Down Ads Serving Malware http://www.forbes.com/sites/thomasbrewster/2015/09/22/forbes-website-served-m

by a3n 11y ago

I don't know how it's done, but it happens. Forbes Shuts Down Ads Serving Malware http://www.forbes.com/sites/thomasbrewster/2015/09/22/forbes-website-served-malware/#39407b513748 http://www.forbes.com/sites/thomasbrewster/2015/09/22/forbes...

chrisseaton 11y ago
I don't know how it's done either, and I've heard about them a few times. It seems somewhat unlikely that there is a remote code execution vulnerability being exploited only by adverts that hasn't been urgently fixed by the browsers. If there genuinely is an exploit, an advert blocker isn't enough as you could put it on any website as well. Therefore I wonder if it's possible that someone has a mis-informed definition of viruses and really it's something a little different, such as a simple link to actively download malware.
- ceejayoz 11y ago
  > If there genuinely is an exploit, an advert blocker isn't enough as you could put it on any website as well. Sure, but then people need to visit that website. Ad networks are a popular delivery method because it gets your code out to millions of people quickly. Putting your exploit on a new Tumblr blog doesn't get you a big botnet.
- FussyZeus 11y ago
  Does it really matter? I don't see the value gained in spending my CPU power on their dark pattern BS, OR is downloading malware via exploit code. The threat is there and I'm not interested in taking the risk.
- Kalium 11y ago
  > I don't know how it's done either, and I've heard about them a few times. It seems somewhat unlikely that there is a remote code execution vulnerability being exploited only by adverts that hasn't been urgently fixed by the browsers. Flash. And there are a lot of unpatched browsers out there. Between the two, there are lots of users vulnerable to malvertising. An ad blocker doesn't address the whole of the vulnerability space, but it is a significant mitigation.

by a3n 11y ago

chrisseaton 11y ago

I don't know how it's done either, and I've heard about them a few times. It seems somewhat unlikely that there is a remote code execution vulnerability being exploited only by adverts that hasn't been urgently fixed by the browsers. If there genuinely is an exploit, an advert blocker isn't enough as you could put it on any website as well. Therefore I wonder if it's possible that someone has a mis-informed definition of viruses and really it's something a little different, such as a simple link to actively download malware.

ceejayoz 11y ago
> If there genuinely is an exploit, an advert blocker isn't enough as you could put it on any website as well. Sure, but then people need to visit that website. Ad networks are a popular delivery method because it gets your code out to millions of people quickly. Putting your exploit on a new Tumblr blog doesn't get you a big botnet.
FussyZeus 11y ago
Does it really matter? I don't see the value gained in spending my CPU power on their dark pattern BS, OR is downloading malware via exploit code. The threat is there and I'm not interested in taking the risk.
Kalium 11y ago
> I don't know how it's done either, and I've heard about them a few times. It seems somewhat unlikely that there is a remote code execution vulnerability being exploited only by adverts that hasn't been urgently fixed by the browsers. Flash. And there are a lot of unpatched browsers out there. Between the two, there are lots of users vulnerable to malvertising. An ad blocker doesn't address the whole of the vulnerability space, but it is a significant mitigation.