3 ms·
I was never at risk for this kind of attack due to my ad blocker, but I can't help but wonder why the ad was allowed to run in the first place. Surely Google of
by zeta0134 9y ago
I was never at risk for this kind of attack due to my ad blocker, but I can't help but wonder why the ad was allowed to run in the first place. Surely Google of all people have the resources to do analysis of javascript code that is submitted by an advertiser, and not push it out to the platform if this kind of stuff is detected. This isn't even that hard to automate: does the ad use excessive amounts of CPU while loaded? Reject it!
Of course if the advertiser is allowed to load their own unverified third-party javascript from anywhere, these kinds of things can and will continue to happen. That's why I don't run third party embeds in my browser, and I don't think anyone should. (An unpopular opinion, I know.)
- thenewwazoo 9y agoif (running_in_youtube()) { mine_coin(); } else { return; }
- jMyles 9y agoSurely Google operates a sandbox sufficiently similar to the ad environment to foil such a scheme, no?
- UncleMeat 9y agoCloaking is a hard problem. People have a massive monetary incentive to improve cloaking tools, meaning that basically every technique you can think of to detect malicious behavior dynamically has a finite timeframe to where it is no longer useful. Ad networks almost certainly have a system to detect cloaking. It is almost certainly not detecting all malicious scripts.
- bootlooped 9y agoThat must be the ad code that Volkswagen came up with.