3 ms·
Stealing sensitive information by using pixels of ad banners
- devoply 10y agoIt's not that clever even. It's quite awesome that someone can go in there without any knowledge of the situation and figure this stuff out though. But writing the original code is trivial. The idea seems trivial too. They should have used stenography if they did not.
- shandor 10y agoYeah, but actually the easier the exploit the more concerning this kind of stuff is. I mean if we can't even trump the easy stuff, how about the more sophisticated attacks?
- devoply 10y agoWell yeah that's the interesting part the exploit is simple, but finding it is difficult. Which is very interesting. It's like the intelligence problem. Where hard stuff is easier than the simple stuff. I guess in the future we will scan for whether the js file is trying to read any other file which should put a stop to this sort of thing.
- grx 10y ago> These networks aggressively scan advertisers' javascript for suspicious code How is Javascript that (a) reads parts of a binary file to build a new routine or (b) does silent redirects to TinyUrl NOT suspicious?! What are they looking for in these cases?
- ephextom 10y agoRecent discussion: https://news.ycombinator.com/item?id=13129029 https://news.ycombinator.com/item?id=13129029