15 ms·

Also, browser exploits. Blocking ads make sense as a decent antivirus strategy.

by 0x0 7y ago

KarlKemp 7y ago
I have never had any virus despite not running antivirus, occasional visits to the seedy underbelly of the web, and often having ad block disabled or not even installed. Nor do I remember anyone I know being infected without being tricked into installing something. When was the last time a browser vulnerability was actively exploited at any significant scale? So I can't shake the feeling this is really more of a post-hoc rationalisation for people not entirely comfortable to screw over creators in the rather selfish pursuit of personal comfort.
- magicalhippo 7y ago
  A couple of years ago, a fairly well known Norwegian news outlet's ad network was hacked, and visitors were served malicious code. If the user had Java installed the code would use a 0-day exploit to _silently and without any user intervention_ install a trojan which would activate when the user later visited the online bank of by far the most common bank here in Norway. It would then redirect money by modifying the target bank account when the user paid bills or whatnot. The web page looked entirely as it should, it would just modify the request before it got sent. Now, the user had to have Java installed you might say, so not a big deal. Well, big deal, because the same bank, the most popular one, _required_ Java for signing in to their online bank. Fortunately the breach was noticed fairly quickly and the harm was limited. But after that I decided no more ads.
  - taurath 7y ago
    Do you happen to have the link for a report for that incident?
    - magicalhippo 7y ago
      This is the exploit that was used: http://www.deependresearch.org/2012/08/java-7-0-day-vulnerability-information.html http://www.deependresearch.org/2012/08/java-7-0-day-vulnerab... Trying to find the original article I read, the bookmark I had no longer works :( Said bank has since moved away from Java to a JavaScript solution for their two-factor login. But yeah, the main problem with ads is that the ones displaying ads have no idea what they're sending to their users.
- yjftsjthsd-h 7y ago
  If you run no AV, how would you know if you were infected?
  - j88439h84 7y ago
    If the disease doesn't have any symptoms, why care at all?
    - caffeinewriter 7y ago
      It's not uncommon for compromised computers to be used as nodes in DDOS-for-hire networks, (though compromised IoT devices seem to be in vogue at the moment) proxies for ne'er-do-wells, sending spam, and other activities that might not be apparent to the user of the computer in the slightest, but still have effects that reach out to the world at large.
    - gilrain 7y ago
      Look up Typhoid Mary, please.
    - baq 7y ago
      do you vaccinate yourself or your children?
- bawolff 7y ago
  There is a list of examples on the wikipedia article for the subject https://en.m.wikipedia.org/wiki/Malvertising https://en.m.wikipedia.org/wiki/Malvertising

Also, browser exploits. Blocking ads make sense as a decent antivirus strategy.

by 0x0 7y ago

Also, browser exploits. Blocking ads make sense as a decent antivirus strategy.

I have never had any virus despite not running antivirus, occasional visits to the seedy underbelly of the web, and often having ad block disabled or not even installed. Nor do I remember anyone I know being infected without being tricked into installing something. When was the last time a browser vulnerability was actively exploited at any significant scale? So I can't shake the feeling this is really more of a post-hoc rationalisation for people not entirely comfortable to screw over creators in the rather selfish pursuit of personal comfort.

magicalhippo 7y ago
A couple of years ago, a fairly well known Norwegian news outlet's ad network was hacked, and visitors were served malicious code. If the user had Java installed the code would use a 0-day exploit to _silently and without any user intervention_ install a trojan which would activate when the user later visited the online bank of by far the most common bank here in Norway. It would then redirect money by modifying the target bank account when the user paid bills or whatnot. The web page looked entirely as it should, it would just modify the request before it got sent. Now, the user had to have Java installed you might say, so not a big deal. Well, big deal, because the same bank, the most popular one, _required_ Java for signing in to their online bank. Fortunately the breach was noticed fairly quickly and the harm was limited. But after that I decided no more ads.
- taurath 7y ago
  Do you happen to have the link for a report for that incident?
  - magicalhippo 7y ago
    This is the exploit that was used: http://www.deependresearch.org/2012/08/java-7-0-day-vulnerability-information.html http://www.deependresearch.org/2012/08/java-7-0-day-vulnerab... Trying to find the original article I read, the bookmark I had no longer works :( Said bank has since moved away from Java to a JavaScript solution for their two-factor login. But yeah, the main problem with ads is that the ones displaying ads have no idea what they're sending to their users.
yjftsjthsd-h 7y ago
If you run no AV, how would you know if you were infected?
- j88439h84 7y ago
  If the disease doesn't have any symptoms, why care at all?
  - caffeinewriter 7y ago
    It's not uncommon for compromised computers to be used as nodes in DDOS-for-hire networks, (though compromised IoT devices seem to be in vogue at the moment) proxies for ne'er-do-wells, sending spam, and other activities that might not be apparent to the user of the computer in the slightest, but still have effects that reach out to the world at large.
  - gilrain 7y ago
    Look up Typhoid Mary, please.
  - baq 7y ago
    do you vaccinate yourself or your children?
bawolff 7y ago
There is a list of examples on the wikipedia article for the subject https://en.m.wikipedia.org/wiki/Malvertising https://en.m.wikipedia.org/wiki/Malvertising