9 ms·

Steganography Based Ad Payload That Drops Shlayer Trojan on Mac Users

128 points by saidajigumi 8y ago

rrggrr 8y ago
ELI5: Do I need to actively do something to be impacted, or is it enough to passively visit the infected site/ad?
- gcb0 8y ago
  if you're not using an Ad blocked, start now. or quit pretending you care about safety. sadly there's no middle ground.
  - ryanmarsh 8y ago
    Does Brave block it?
  - jszymborski 8y ago
    Slightly tangential, but people like to get on a moral high-ground and posture about content creator revenue, but do I really have to care about people not making a revenue from distributing malware and selling my browsing behaviour that's being tracked across the web? We really need to stop pretending that ad networks are these neutral entities. They are a backdoor that inserted on every website, and I shouldn't have to justify plugging it up, you should have to explain why you've sold my security.
    - cozzyd 8y ago
      Do there exist any ad networks that only accept an image from the advertiser and provide any analytics themselves (so you only have to trust the ad network and not the advertiser?)
    - mnm1 8y ago
      Not to mention the extreme negative psychological and societal consequences of these ad companies. There's no way ad companies are anything but an extreme negative even if they fix their security and only deliver inert payloads. Ad companies were a sickness for society and individuals in the days of TV and newspapers and they are a sickness now. Starving them out of business could be seen as a moral duty to oneself and a benefit to society. If content creators choose to partner with such ad companies, they should accept their fate, that of the ad companies. Or they can figure out a better business model. It's not up to the rest of society to sacrifice itself and the well-being of the people in the rest of society so some ad men can make billions or for some content creators to put out a bunch of content that's almost certainly just garbage. We in the rest of society, owe these ad men and anyone who aligns with them nothing. They're lucky that as a society we allow their sick, disgusting manipulation of others to continue ... for now.
- account0099099 8y ago
  Does anyone have an answer to this question?
  - eliya_confiant 8y ago
    The user still needs to go through with the fake Flash update. Even if one is to accidentally fat finger the download, they still have to proceed with the installation. To protect yourself, please be vigilant and only accept software updates directly from the vendor of the software you are using. This is more of a phishing attack to get folks to install malware / adware.
- endorphone 8y ago
  The "steganography" is simply to get around ad company filters, and the end result is the classic "You need to install Flash" nonsense soliciting the user to install a DMG.
- ChrisSD 8y ago
  Well the impact is to persuade you to download and run a file. I think most people on HN will be savy enough not to do that... even if it does claim to be a Flash update. As others have noted this issue is more about the lax security of ad networks (and their sub networks). Rather than introducing real security, most major ad networks play a cat and mouse game with malware.
  - paultopia 8y ago
    Especially if it claims to be a Flash update! What's the intersection of StillUsesFlash & ReadsHN? It's gotta be the empty set at this point, right? Which, come to think of it, is a great way to screen malware---anyone who will run a flash update probably thinks they need it to get their AOL e-mail, and will happily take the forthcoming call from Apple's Tech Support (TM) asking them for their password and SSN.
gcb0 8y ago
tl;dr malicious Ad stores payload in image. it then executes it with eval() if publisher had minimal CSP eval protection on Ads it will be safe. but I guess that would break every ad, even Google's. in the end, same old everything. just a slightly clever way to avoid static analysis, that is also not new at all.
sourthyme 8y ago
Maybe I'm missing something, but why is Apple fonts required here?
- callinyouin 8y ago
  Seems like an odd method, but I believe that is how they are specifically targeting macOS machines for this particular malware.
  - eliya_confiant 8y ago
    That's correct. It's just a subtle way of doing OS fingerprinting.
- deleted 8y ago
  [deleted]
mikeash 8y ago
I’m amazed that web sites still let ads run arbitrary scripts. Serve and image and/or some text along with a link and call it done. If interactivity is somehow really necessary, define a few templates and allow no deviation from them. But I guess these sites would rather just continue to be a conduit for screwing with their viewers.
- paultopia 8y ago
  This. It seems like the default model for ad impressions is just "run whatever you want, go wild." Untrusted code? SURE! Ads for blatantly fraudulent product? PARTY TIME! Even more basic shadiness is astonishingly rampant---I recently made the mistake of opening a well-known and very stuffy academic blog with countless daily visitors from a browser not stuffed full of ad blockers, and immediately got a half-naked Ashley Madison ad on my work machine. What we need is some third-party intermediary to screen, not the ads, but the sites hosting the ads---some kind of certification authority that says "this is a list of websites that don't allow people to run untrusted code or scams," and then allows users to block everything else by default.
  - antsar 8y ago
    Certification sounds good until a major "certified" site goes rogue (or gets hacked) and hosts malware. Then everyone who trusted the "adblock except certified sites" premise gets burned, and reverts to regular adblock.
- ChrisSD 8y ago
  Outbrain does this. People hate Outbrain.
  - function_seven 8y ago
    Do people hate Outbrain because Outbrain does this? Or is it due to the nature of their ads? (I'm assuming we're talking about the "Around the Web" chum boxes, right?)
tbabb 8y ago
That's it. I'm disabling JS by default.
- CGamesPlay 8y ago
  If you're savvy enough to know that you can "disable JS by default" I'm betting you are also savvy enough to not download AdobeFlashPlayer.dmg from newtypeinstalllite.icu.
- zzzcpan 8y ago
  We might need a fork of Chromium for that in the future. I hope Mozilla does it, but they seem to be heading towards non-existence burning resources to just copy everything Google does.
- 4ec0755f5522 8y ago
  You will be astounded how much of the web breaks. I know you think you know, but it's worse than you can imagine. The number of sites that can't even display their images, the amount of third party css that is needed and won't load, dropdowns, search buttons, and endless Big Red Banners telling you that you need to enable javascript. I am 100% in agreement JS is the problem and should be abandoned. But the web falls apart if you disable it. source: disabled JS on iOS safari. I leave it disabled but have to open other browser all the time. Even stupid HuffPo "click to read" is JS. So when I click 'news' links from the main news widget they open in Safari and I can't read the article I have to copy and paste into Chrome (which does have JS enabled). There's no way this is an ok user experience. But JS is not an ok security experience. I'm like F THIS I'M SWITCHING TO LYNX. :-(
  - dreamcompiler 8y ago
    Exactly this. Ten years ago, sites would fail gracefully if the client didn't have JS enabled. But today, all the cool web kids want to do "100% client-side rendering" which means the page is completely blank if you disable JS. For a very few web sites, this makes sense. For the vast majority, it does not.
- toufiqbarhamov 8y ago
eliya_confiant 8y ago
Hi everyone, I'm the author of the blog post. We at Confiant help websites to protect their users by detecting and blocking malvertising. We are hiring in our security and engineering teams. If you're interested in working to combat the problem outlined in the blog post, we would love to hear from you! Please reach out to me [eliya AT confiant DOT com]. I will be back a little bit later to answer some of the questions that I see here in the comments as well. Thanks!
saidajigumi 8y ago
This is precisely why an ad-blocker is a non-negotiable part of defense in depth. I'm sympathetic to web publishers who legit need the ad revenue to operate, but they're caught in the middle: asking me to drop this critical layer of protection is a non-starter.
- MRD85 8y ago
  I had my experience with this in 2006 or 2007. I was younger then and I was served a malicious ad on a video game website. This ad was only showing for 1 in every 1000 or so users, which made it quite difficult to detect back then. Ever since then I've run an adblocker and/or scriptblocker. I'm constantly asked by websites to drop my ad blocker but why would I do that? If they want to serve ads than maybe there is a way they can do it themselves, as opposed to a third party serving them.
  - iaabtpbtpnn 8y ago
    Of course there is a way they can do that, because that's how it always used to work. It's just not as cheap or easy.
  - jnbiche 8y ago
    > If they want to serve ads than maybe there is a way they can do it themselves, as opposed to a third party serving them Indeed there is a way. And if they do it the old-fashioned way, using static ad assets, then the ads aren't typically blocked by ad blockers, anyway (at least not automatically). Furthermore, these kinds of embedded, static ads lead to more honest, authentic relationships between content providers, advertisers, and viewers.
    - Jernik 8y ago
      unfortunately for content producers, this kind of advertising is typically more work and less profit
    - fatboy 8y ago
      From what I’ve been told by the web team at the company I work at, images get blocked by ad blockers if they match the industry-standard advert sizes for banners etc. We serve our own ads that we sell directly to businesses related to our content, but it’s often done through the customer’s PR agency, who sort out the ads for various different outlets, and are not interested in making different sizes that wouldn’t be blocked just for us.
mschuster91 8y ago
Funny enough, just today it came out Google plans to neuter ad blockers by disabling the extension API they are using (https://www.heise.de/newsticker/meldung/Kontroverse-Plaene-Werbeblockern-droht-in-Chrome-das-Aus-4286274.html https://www.heise.de/newsticker/meldung/Kontroverse-Plaene-W...). So, Google, tell me what options do I have? Switch to CPU and memory hog Firefox, to the new Internet Explorer called Safari, or watch while ads that I can't block fuck up my computer?
- dwighttk 8y ago
  aw man... what OS are you on? Chrome is the CPU and memory hog on macOS... Though I guess Firefox isn't that far behind.
  - mschuster91 8y ago
    Same as you - macOS. I regularly have ~250-300 tabs open on my MBP (though I admit, I cheat via using The Great Suspender), the only time it hogs CPU is when some nasty advertising on sueddeutsche.de or Facebook decide they need to warm my lap. In addition, I vastly prefer Chrome's devtools. Nothing comes close, and I believe this is a huge part of why developers are so Chrome-loyal.
    - dwighttk 8y ago
      huh. I guess Ghostery isn't protecting me enough. My computer gets angry when I have just a couple of Chrome tabs open. Though I haven't tried it for general browsing in a long time.
    - atomwaffel 8y ago
      > In addition, I vastly prefer Chrome's devtools. Nothing comes close, and I believe this is a huge part of why developers are so Chrome-loyal. So do I (I’ve also heard good things about Firefox’s dev tools but never made the switch), which is why I use Chrome for web development and Safari for everyday browsing. It works really well for me and I like that my browsing history isn’t full of with localhost URLs, my form fill history isn’t spammed with entries like “testtest123”, and my dev tools are (nearly) unadulterated by extension scripts.
DGAP 8y ago
Any published IOCs for this? Any hashes for the malware itself?
ISPblocking 8y ago
Is there any point at which ISPs block these known malware domains? It seems like they are using the same site (veryield-malyst.com) over and over to distribute the payload in repeated malware campaigns. Why haven't the major ISPs blocked access to that domain? > The `veryield-malyst` domain, as a case in point, has been active for months, but only recently are VeryMal starting to smuggle it using steganography. Here’s one of their tags ad tags from early November for comparison: So we've known since at least November that this site is bad, but it's still serving this stuff up today? WTF?
iheartpotatoes 8y ago
20 years since Melissa. TWENTY YEARS. And people still click on things they shouldn't be clicking on. It is amazing the brainpower that goes into developing processes like this just to trick a person into doing what they've been told NOT to do. I understand every new generation of user's needs to be reminded this. Of course, right? Kids grow up, and have to be taught basic online hygiene. Maybe it is time to do away with the entire paradigm of "click to install" and have authenticated package managers for everything. Would that solve the problem? If the only way to install software was through an "app/apt-store" where everything is fingerprinted? This reminds me of the article on HN a few days ago about enabling HTTPS and Tor for apt. I learned a lot about how apt verifies untouched packages are installed. Why isn't that the ONLY method to add software to a computer? Just seems like we are attacking the wrong problem. People still get STIs because they don't want to use a condom (or don't know how to use one). My analogy sucks, but if we got rid of sex we wouldn't have STIs, by definition. Ok, F for that metaphor, but am I going in the right direction?
herodotus 8y ago
Spam emails with embedded links don't use steganography, but they use a similar redirect attack. I have reverse engineered many of them, and, for a lot of them, I am struck by the sense of whimsy in the choice of variable names the attackers use. Clearly, they are having fun doing these scripts. It always struck me as sad that these possibly talented (and apparently pretty happy) developers have been steered into crime instead of a probably lucrative honest career in software.
tracker1 8y ago
I think it's time to require bonded advertisers on advertising platforms. If you deliver third party content, you should be legally and financially responsible for it. Period. Google and others should be able to police their platform. They aren't... advertisers should have to put up a given dollar amount to advertise on the platform. If malware is detected, they get blackballed.
tracker1 8y ago
Maybe it's time to limit browser to 2 levels of IFrame and 2 redirects in an IFrame... let the ad companies figure out how to pass/share their data directly instead of adding payload to the browser. It's entirely possible for the ad networks to proxy their requests instead of layers of IFrames, scripts and redirects. The other side is that any advertising re-sellers should have to put up a bond/insurance against serving malware. If you get busted, you're out. It's up to the advertising companies to ensure that they don't deliver malware. If a campaign includes malware, then it's a $10K fine + $1 for every time that campaign was shown.
ghego1 8y ago
I think the title is a bit misleading, as it is still required a user action to actually infect the device

128 points by saidajigumi 8y ago

rrggrr 8y ago

ELI5: Do I need to actively do something to be impacted, or is it enough to passively visit the infected site/ad?

gcb0 8y ago
if you're not using an Ad blocked, start now. or quit pretending you care about safety. sadly there's no middle ground.
- ryanmarsh 8y ago
  Does Brave block it?
- jszymborski 8y ago
  Slightly tangential, but people like to get on a moral high-ground and posture about content creator revenue, but do I really have to care about people not making a revenue from distributing malware and selling my browsing behaviour that's being tracked across the web? We really need to stop pretending that ad networks are these neutral entities. They are a backdoor that inserted on every website, and I shouldn't have to justify plugging it up, you should have to explain why you've sold my security.
  - cozzyd 8y ago
    Do there exist any ad networks that only accept an image from the advertiser and provide any analytics themselves (so you only have to trust the ad network and not the advertiser?)
  - mnm1 8y ago
    Not to mention the extreme negative psychological and societal consequences of these ad companies. There's no way ad companies are anything but an extreme negative even if they fix their security and only deliver inert payloads. Ad companies were a sickness for society and individuals in the days of TV and newspapers and they are a sickness now. Starving them out of business could be seen as a moral duty to oneself and a benefit to society. If content creators choose to partner with such ad companies, they should accept their fate, that of the ad companies. Or they can figure out a better business model. It's not up to the rest of society to sacrifice itself and the well-being of the people in the rest of society so some ad men can make billions or for some content creators to put out a bunch of content that's almost certainly just garbage. We in the rest of society, owe these ad men and anyone who aligns with them nothing. They're lucky that as a society we allow their sick, disgusting manipulation of others to continue ... for now.
account0099099 8y ago
Does anyone have an answer to this question?
- eliya_confiant 8y ago
  The user still needs to go through with the fake Flash update. Even if one is to accidentally fat finger the download, they still have to proceed with the installation. To protect yourself, please be vigilant and only accept software updates directly from the vendor of the software you are using. This is more of a phishing attack to get folks to install malware / adware.
endorphone 8y ago
The "steganography" is simply to get around ad company filters, and the end result is the classic "You need to install Flash" nonsense soliciting the user to install a DMG.
ChrisSD 8y ago
Well the impact is to persuade you to download and run a file. I think most people on HN will be savy enough not to do that... even if it does claim to be a Flash update. As others have noted this issue is more about the lax security of ad networks (and their sub networks). Rather than introducing real security, most major ad networks play a cat and mouse game with malware.
- paultopia 8y ago
  Especially if it claims to be a Flash update! What's the intersection of StillUsesFlash & ReadsHN? It's gotta be the empty set at this point, right? Which, come to think of it, is a great way to screen malware---anyone who will run a flash update probably thinks they need it to get their AOL e-mail, and will happily take the forthcoming call from Apple's Tech Support (TM) asking them for their password and SSN.

gcb0 8y ago

tl;dr malicious Ad stores payload in image. it then executes it with eval() if publisher had minimal CSP eval protection on Ads it will be safe. but I guess that would break every ad, even Google's. in the end, same old everything. just a slightly clever way to avoid static analysis, that is also not new at all.

sourthyme 8y ago

Maybe I'm missing something, but why is Apple fonts required here?

callinyouin 8y ago
Seems like an odd method, but I believe that is how they are specifically targeting macOS machines for this particular malware.
- eliya_confiant 8y ago
  That's correct. It's just a subtle way of doing OS fingerprinting.
deleted 8y ago
[deleted]

mikeash 8y ago

I’m amazed that web sites still let ads run arbitrary scripts. Serve and image and/or some text along with a link and call it done. If interactivity is somehow really necessary, define a few templates and allow no deviation from them. But I guess these sites would rather just continue to be a conduit for screwing with their viewers.

paultopia 8y ago
This. It seems like the default model for ad impressions is just "run whatever you want, go wild." Untrusted code? SURE! Ads for blatantly fraudulent product? PARTY TIME! Even more basic shadiness is astonishingly rampant---I recently made the mistake of opening a well-known and very stuffy academic blog with countless daily visitors from a browser not stuffed full of ad blockers, and immediately got a half-naked Ashley Madison ad on my work machine. What we need is some third-party intermediary to screen, not the ads, but the sites hosting the ads---some kind of certification authority that says "this is a list of websites that don't allow people to run untrusted code or scams," and then allows users to block everything else by default.
- antsar 8y ago
  Certification sounds good until a major "certified" site goes rogue (or gets hacked) and hosts malware. Then everyone who trusted the "adblock except certified sites" premise gets burned, and reverts to regular adblock.
ChrisSD 8y ago
Outbrain does this. People hate Outbrain.
- function_seven 8y ago
  Do people hate Outbrain because Outbrain does this? Or is it due to the nature of their ads? (I'm assuming we're talking about the "Around the Web" chum boxes, right?)

tbabb 8y ago

That's it. I'm disabling JS by default.

CGamesPlay 8y ago
If you're savvy enough to know that you can "disable JS by default" I'm betting you are also savvy enough to not download AdobeFlashPlayer.dmg from newtypeinstalllite.icu.
zzzcpan 8y ago
We might need a fork of Chromium for that in the future. I hope Mozilla does it, but they seem to be heading towards non-existence burning resources to just copy everything Google does.
4ec0755f5522 8y ago
You will be astounded how much of the web breaks. I know you think you know, but it's worse than you can imagine. The number of sites that can't even display their images, the amount of third party css that is needed and won't load, dropdowns, search buttons, and endless Big Red Banners telling you that you need to enable javascript. I am 100% in agreement JS is the problem and should be abandoned. But the web falls apart if you disable it. source: disabled JS on iOS safari. I leave it disabled but have to open other browser all the time. Even stupid HuffPo "click to read" is JS. So when I click 'news' links from the main news widget they open in Safari and I can't read the article I have to copy and paste into Chrome (which does have JS enabled). There's no way this is an ok user experience. But JS is not an ok security experience. I'm like F THIS I'M SWITCHING TO LYNX. :-(
- dreamcompiler 8y ago
  Exactly this. Ten years ago, sites would fail gracefully if the client didn't have JS enabled. But today, all the cool web kids want to do "100% client-side rendering" which means the page is completely blank if you disable JS. For a very few web sites, this makes sense. For the vast majority, it does not.
toufiqbarhamov 8y ago

eliya_confiant 8y ago

Hi everyone, I'm the author of the blog post. We at Confiant help websites to protect their users by detecting and blocking malvertising. We are hiring in our security and engineering teams. If you're interested in working to combat the problem outlined in the blog post, we would love to hear from you! Please reach out to me [eliya AT confiant DOT com]. I will be back a little bit later to answer some of the questions that I see here in the comments as well. Thanks!

saidajigumi 8y ago

This is precisely why an ad-blocker is a non-negotiable part of defense in depth. I'm sympathetic to web publishers who legit need the ad revenue to operate, but they're caught in the middle: asking me to drop this critical layer of protection is a non-starter.

MRD85 8y ago
I had my experience with this in 2006 or 2007. I was younger then and I was served a malicious ad on a video game website. This ad was only showing for 1 in every 1000 or so users, which made it quite difficult to detect back then. Ever since then I've run an adblocker and/or scriptblocker. I'm constantly asked by websites to drop my ad blocker but why would I do that? If they want to serve ads than maybe there is a way they can do it themselves, as opposed to a third party serving them.
- iaabtpbtpnn 8y ago
  Of course there is a way they can do that, because that's how it always used to work. It's just not as cheap or easy.
- jnbiche 8y ago
  > If they want to serve ads than maybe there is a way they can do it themselves, as opposed to a third party serving them Indeed there is a way. And if they do it the old-fashioned way, using static ad assets, then the ads aren't typically blocked by ad blockers, anyway (at least not automatically). Furthermore, these kinds of embedded, static ads lead to more honest, authentic relationships between content providers, advertisers, and viewers.
  - Jernik 8y ago
    unfortunately for content producers, this kind of advertising is typically more work and less profit
  - fatboy 8y ago
    From what I’ve been told by the web team at the company I work at, images get blocked by ad blockers if they match the industry-standard advert sizes for banners etc. We serve our own ads that we sell directly to businesses related to our content, but it’s often done through the customer’s PR agency, who sort out the ads for various different outlets, and are not interested in making different sizes that wouldn’t be blocked just for us.

mschuster91 8y ago

Funny enough, just today it came out Google plans to neuter ad blockers by disabling the extension API they are using (https://www.heise.de/newsticker/meldung/Kontroverse-Plaene-Werbeblockern-droht-in-Chrome-das-Aus-4286274.html https://www.heise.de/newsticker/meldung/Kontroverse-Plaene-W...). So, Google, tell me what options do I have? Switch to CPU and memory hog Firefox, to the new Internet Explorer called Safari, or watch while ads that I can't block fuck up my computer?

dwighttk 8y ago
aw man... what OS are you on? Chrome is the CPU and memory hog on macOS... Though I guess Firefox isn't that far behind.
- mschuster91 8y ago
  Same as you - macOS. I regularly have ~250-300 tabs open on my MBP (though I admit, I cheat via using The Great Suspender), the only time it hogs CPU is when some nasty advertising on sueddeutsche.de or Facebook decide they need to warm my lap. In addition, I vastly prefer Chrome's devtools. Nothing comes close, and I believe this is a huge part of why developers are so Chrome-loyal.
  - dwighttk 8y ago
    huh. I guess Ghostery isn't protecting me enough. My computer gets angry when I have just a couple of Chrome tabs open. Though I haven't tried it for general browsing in a long time.
  - atomwaffel 8y ago
    > In addition, I vastly prefer Chrome's devtools. Nothing comes close, and I believe this is a huge part of why developers are so Chrome-loyal. So do I (I’ve also heard good things about Firefox’s dev tools but never made the switch), which is why I use Chrome for web development and Safari for everyday browsing. It works really well for me and I like that my browsing history isn’t full of with localhost URLs, my form fill history isn’t spammed with entries like “testtest123”, and my dev tools are (nearly) unadulterated by extension scripts.

DGAP 8y ago

Any published IOCs for this? Any hashes for the malware itself?

ISPblocking 8y ago

Is there any point at which ISPs block these known malware domains? It seems like they are using the same site (veryield-malyst.com) over and over to distribute the payload in repeated malware campaigns. Why haven't the major ISPs blocked access to that domain? > The `veryield-malyst` domain, as a case in point, has been active for months, but only recently are VeryMal starting to smuggle it using steganography. Here’s one of their tags ad tags from early November for comparison: So we've known since at least November that this site is bad, but it's still serving this stuff up today? WTF?

iheartpotatoes 8y ago

20 years since Melissa. TWENTY YEARS. And people still click on things they shouldn't be clicking on. It is amazing the brainpower that goes into developing processes like this just to trick a person into doing what they've been told NOT to do. I understand every new generation of user's needs to be reminded this. Of course, right? Kids grow up, and have to be taught basic online hygiene. Maybe it is time to do away with the entire paradigm of "click to install" and have authenticated package managers for everything. Would that solve the problem? If the only way to install software was through an "app/apt-store" where everything is fingerprinted? This reminds me of the article on HN a few days ago about enabling HTTPS and Tor for apt. I learned a lot about how apt verifies untouched packages are installed. Why isn't that the ONLY method to add software to a computer? Just seems like we are attacking the wrong problem. People still get STIs because they don't want to use a condom (or don't know how to use one). My analogy sucks, but if we got rid of sex we wouldn't have STIs, by definition. Ok, F for that metaphor, but am I going in the right direction?

herodotus 8y ago

Spam emails with embedded links don't use steganography, but they use a similar redirect attack. I have reverse engineered many of them, and, for a lot of them, I am struck by the sense of whimsy in the choice of variable names the attackers use. Clearly, they are having fun doing these scripts. It always struck me as sad that these possibly talented (and apparently pretty happy) developers have been steered into crime instead of a probably lucrative honest career in software.

tracker1 8y ago

I think it's time to require bonded advertisers on advertising platforms. If you deliver third party content, you should be legally and financially responsible for it. Period. Google and others should be able to police their platform. They aren't... advertisers should have to put up a given dollar amount to advertise on the platform. If malware is detected, they get blackballed.

tracker1 8y ago

Maybe it's time to limit browser to 2 levels of IFrame and 2 redirects in an IFrame... let the ad companies figure out how to pass/share their data directly instead of adding payload to the browser. It's entirely possible for the ad networks to proxy their requests instead of layers of IFrames, scripts and redirects. The other side is that any advertising re-sellers should have to put up a bond/insurance against serving malware. If you get busted, you're out. It's up to the advertising companies to ensure that they don't deliver malware. If a campaign includes malware, then it's a $10K fine + $1 for every time that campaign was shown.

ghego1 8y ago

I think the title is a bit misleading, as it is still required a user action to actually infect the device