4 ms·

There is no "Advertisers" here - blackhats are using advertising tools but there is no advertiser involved at all. This is not a nitpick - advertisers aren't do

by soared 9y ago

There is no "Advertisers" here - blackhats are using advertising tools but there is no advertiser involved at all. This is not a nitpick - advertisers aren't doing this. 1. Ad networks / exchanges allow (don't catch) these ads 2. Publishers don't do enough to stop them 3. Browsers allow it to happen

tyingq 9y ago
This comment should be higher up. It's not the advertisers. It's the ad network not noticing that bad actors (that aren't advertisers) are gaming the system.
- na85 9y ago
  Is that distinction relevant to the user? I'm still blocking ads and javascript everywhere I browse. If the ad networks are the ones distributing this malware, they're either complicit or negligent. Either way, the source of the malware from my perspective as a user is still "ads".
  - soared 9y ago
    I just commonly see users get mad at "advertisers" when in cases like this, advertisers aren't involved at all. Not to say they don't carry some blame, but its blackhats doing the major wrong. Advertisers and publishers should pressure ad networks and browsers to do a better job fighting fraud though.
  - tyingq 9y ago
    If they want to direct feedback to the right place, sure. Ad networks need the pressure. Advertisers can't do much to help.
    - na85 9y ago
      Well, I don't think most users care about directing feedback. I know I personally would rather just deprive them of the impressions with noscript and/or ad block. I don't have time to be submitting complaints to faceless Internet corporations. I just want to use the web without being bothered.
      - tyingq 9y ago
        You don't have to, but I suspect your initial reaction is with the publisher anyway (vs the advertisers).
  - JustSomeNobody 9y ago
    For the user, no. But this is a technology forum so the distinction is relevant.
- Santosh83 9y ago
  And because you don't notice your PC infected by botnet s/w, does that mean you can expect to get a free pass from spam filters? Ad networks operate for profit, they are not charities, therefore they should invest the effort to secure their systems if they want what little goodwill that remains to not evaporate.
- bunderbunder 9y ago
  This seems to be an inherent problem with the ad network model. You've got 3 or 4 different parties involved in the current ad system: The content publisher who host the ads, the ad network, the advertisers, and, possibly, the company the advertiser hires to write the ad. And it's not like old school print ads where the content publisher gets to look over a proof before everything gets sent out. Several of these parties either don't or can't really understand how the ads really work and what the final product is going to be like. In this kind of situation, whose responsibility is it to maintain integrity and keep the bad actors out? I'm not sure that it's anybody's. _Maybe_ it's the ad network's, but, realistically, they're sitting on top of an immensely complex system that is going to be very hard to police properly, so they won't spend the money on it unless they're forced to. I suspect that the only way to force them to do it is to have a court find that an ad network hosting a malignant ad is either tortious, or makes them an accessory to a crime.
  - JumpCrisscross 9y ago
    > In this kind of situation, whose responsibility is it to maintain integrity and keep the bad actors out? Publishers bear liability for serving up malware to their readers; ad networks for serving up malware to the publishers. We're just waiting for an enterprising lawyer/litigation financier to put the pieces together.
    - bunderbunder 9y ago
      I don't know that the liability question is so clear cut. Is there any relevant legal precedent?
  - manicdee 9y ago
    If someone in the ad delivery chain doesn’t take responsibility, they won’t be selling ads for long. When it’s not malware it’s bitcoin miners. Actually … hang it, just thinking about where the threshold is has taken up too much of my time. I will just block all ads.
mnm1 9y ago
So you're saying it's seriously gross negligence and lack of security on the part of ad networks and publishers alike. I can accept that. Due to that negligence, however, they both are, willing or not, part of the threat and have to be defended against. I also agree that browsers could and should do more to stop unnecessary scripts. At some point, a blacklist will not be enough (I think we're here already) and a whitelist will be the only viable approach going forward. The question is, how to curate a whitelist for the majority of users? Also, why Firefox and other open source browsers don't include things like ad blocking and script blocking by default.
- soared 9y ago
  I don't think its negligence really, though it is bad. The problem isn't extremely widespread and it seems only smaller networks that don't have the resources are affected (google fixed that problem on youtube very quickly). I don't think white/blacklists are the best solution, though they do work most of the time right now - I'd rather see a flag that publishers can enable to browsers that lets them use more resources. IF your site is a web-app, allow it to use a lot of resources. If its a blog / non-intensive site, simply don't let it use a lot of resources or just ask the user if they want to use more resources. I don't know if sites would self identify or if a browser could just analyze them on the fly, but this approach seems to make sense. (A little rocky at the start, but it would scale effectively).
- fludlight 9y ago
  I would prefer a(n easily overridable) max resource allowance per tab rather than a whitelist.
  - GeorgeCarlin123 9y ago
    but that already exists, it is called uMatrix
ChuckMcM 9y ago
It could be publishers, there was this story on Salon recently: https://slate.com/technology/2018/02/salon-is-offering-readers-to-suppress-ads-in-exchange-for-cryptocurrency-mining-power.html https://slate.com/technology/2018/02/salon-is-offering-reade...
- soared 9y ago
  Similar, but the article above is talking about miners delivered through ad networks without the publishers consent. Publishers pushing miners themselves is super interesting, but definitely not fraud like in this article.
  - ChuckMcM 9y ago
    I understood the context of the article, but I was encouraging you to go a bit deeper. "bad guys" are not the only group that might be motivated by having your browser mine bitcoin. And "publishers" make the API call out to the ad network and get the ad ready to show in their page pipeline. I was insinuating that there is a financial interest by the publisher to "make more on ads" that is abetted by injecting bitcoin mining into the ads they serve up. Doing this in the ads gives them a great 'out' when they are discovered "oh its bad actors in the ad network, what can we do?" The Salon article is a demonstration that publishers do in fact consider this as an alternative. I doubt Salon was the only one and I doubt that all publishers would be so ethical as to "ask first" given their behavior in the adblocking war.
OnlyRepliesToBS 9y ago
The ad network is complicit, at BEST.
tgsovlerkhgsel 9y ago
1. Ad networks/exchanges allow ads to run arbitrary JS and try to rely on "catching" bad ads instead of properly restricting what ads can do. 2. Publishers tolerate this and use such ad networks. 3. Browsers do what they're supposed to do, execute the code delivered by the publisher's site and the resources it references. The only thing browsers could do is show a warning that "www.publisher.example.com is using large amounts of CPU resources" to discourage web sites from being shitty, but ultimately, it's the responsibility of the publisher to make sure his site doesn't serve malware. Keep in mind that next time, it could be a 0day exploiting your browser instead of a miner.

by soared 9y ago

tyingq 9y ago

This comment should be higher up. It's not the advertisers. It's the ad network not noticing that bad actors (that aren't advertisers) are gaming the system.

na85 9y ago
Is that distinction relevant to the user? I'm still blocking ads and javascript everywhere I browse. If the ad networks are the ones distributing this malware, they're either complicit or negligent. Either way, the source of the malware from my perspective as a user is still "ads".
- soared 9y ago
  I just commonly see users get mad at "advertisers" when in cases like this, advertisers aren't involved at all. Not to say they don't carry some blame, but its blackhats doing the major wrong. Advertisers and publishers should pressure ad networks and browsers to do a better job fighting fraud though.
- tyingq 9y ago
  If they want to direct feedback to the right place, sure. Ad networks need the pressure. Advertisers can't do much to help.
  - na85 9y ago
    Well, I don't think most users care about directing feedback. I know I personally would rather just deprive them of the impressions with noscript and/or ad block. I don't have time to be submitting complaints to faceless Internet corporations. I just want to use the web without being bothered.
    - tyingq 9y ago
      You don't have to, but I suspect your initial reaction is with the publisher anyway (vs the advertisers).
- JustSomeNobody 9y ago
  For the user, no. But this is a technology forum so the distinction is relevant.
Santosh83 9y ago
And because you don't notice your PC infected by botnet s/w, does that mean you can expect to get a free pass from spam filters? Ad networks operate for profit, they are not charities, therefore they should invest the effort to secure their systems if they want what little goodwill that remains to not evaporate.
bunderbunder 9y ago
This seems to be an inherent problem with the ad network model. You've got 3 or 4 different parties involved in the current ad system: The content publisher who host the ads, the ad network, the advertisers, and, possibly, the company the advertiser hires to write the ad. And it's not like old school print ads where the content publisher gets to look over a proof before everything gets sent out. Several of these parties either don't or can't really understand how the ads really work and what the final product is going to be like. In this kind of situation, whose responsibility is it to maintain integrity and keep the bad actors out? I'm not sure that it's anybody's. _Maybe_ it's the ad network's, but, realistically, they're sitting on top of an immensely complex system that is going to be very hard to police properly, so they won't spend the money on it unless they're forced to. I suspect that the only way to force them to do it is to have a court find that an ad network hosting a malignant ad is either tortious, or makes them an accessory to a crime.
- JumpCrisscross 9y ago
  > In this kind of situation, whose responsibility is it to maintain integrity and keep the bad actors out? Publishers bear liability for serving up malware to their readers; ad networks for serving up malware to the publishers. We're just waiting for an enterprising lawyer/litigation financier to put the pieces together.
  - bunderbunder 9y ago
    I don't know that the liability question is so clear cut. Is there any relevant legal precedent?
- manicdee 9y ago
  If someone in the ad delivery chain doesn’t take responsibility, they won’t be selling ads for long. When it’s not malware it’s bitcoin miners. Actually … hang it, just thinking about where the threshold is has taken up too much of my time. I will just block all ads.

mnm1 9y ago

So you're saying it's seriously gross negligence and lack of security on the part of ad networks and publishers alike. I can accept that. Due to that negligence, however, they both are, willing or not, part of the threat and have to be defended against. I also agree that browsers could and should do more to stop unnecessary scripts. At some point, a blacklist will not be enough (I think we're here already) and a whitelist will be the only viable approach going forward. The question is, how to curate a whitelist for the majority of users? Also, why Firefox and other open source browsers don't include things like ad blocking and script blocking by default.

soared 9y ago
I don't think its negligence really, though it is bad. The problem isn't extremely widespread and it seems only smaller networks that don't have the resources are affected (google fixed that problem on youtube very quickly). I don't think white/blacklists are the best solution, though they do work most of the time right now - I'd rather see a flag that publishers can enable to browsers that lets them use more resources. IF your site is a web-app, allow it to use a lot of resources. If its a blog / non-intensive site, simply don't let it use a lot of resources or just ask the user if they want to use more resources. I don't know if sites would self identify or if a browser could just analyze them on the fly, but this approach seems to make sense. (A little rocky at the start, but it would scale effectively).
fludlight 9y ago
I would prefer a(n easily overridable) max resource allowance per tab rather than a whitelist.
- GeorgeCarlin123 9y ago
  but that already exists, it is called uMatrix

ChuckMcM 9y ago

It could be publishers, there was this story on Salon recently: https://slate.com/technology/2018/02/salon-is-offering-readers-to-suppress-ads-in-exchange-for-cryptocurrency-mining-power.html https://slate.com/technology/2018/02/salon-is-offering-reade...

soared 9y ago
Similar, but the article above is talking about miners delivered through ad networks without the publishers consent. Publishers pushing miners themselves is super interesting, but definitely not fraud like in this article.
- ChuckMcM 9y ago
  I understood the context of the article, but I was encouraging you to go a bit deeper. "bad guys" are not the only group that might be motivated by having your browser mine bitcoin. And "publishers" make the API call out to the ad network and get the ad ready to show in their page pipeline. I was insinuating that there is a financial interest by the publisher to "make more on ads" that is abetted by injecting bitcoin mining into the ads they serve up. Doing this in the ads gives them a great 'out' when they are discovered "oh its bad actors in the ad network, what can we do?" The Salon article is a demonstration that publishers do in fact consider this as an alternative. I doubt Salon was the only one and I doubt that all publishers would be so ethical as to "ask first" given their behavior in the adblocking war.

OnlyRepliesToBS 9y ago

The ad network is complicit, at BEST.

tgsovlerkhgsel 9y ago

1. Ad networks/exchanges allow ads to run arbitrary JS and try to rely on "catching" bad ads instead of properly restricting what ads can do. 2. Publishers tolerate this and use such ad networks. 3. Browsers do what they're supposed to do, execute the code delivered by the publisher's site and the resources it references. The only thing browsers could do is show a warning that "www.publisher.example.com is using large amounts of CPU resources" to discourage web sites from being shitty, but ultimately, it's the responsibility of the publisher to make sure his site doesn't serve malware. Keep in mind that next time, it could be a 0day exploiting your browser instead of a miner.