21 ms·
The NSA and CIA use ad blockers
- WarOnPrivacy 5y agoI've been preaching safety thru adblocking for 15 years. I had locations that went from multiple infections per week to zero over 6 months - after implementing edge blocking (DNS & Squid).
- Macha 5y agoYeah, when I worked at a company in the internet ads space, one of the security engineers mentioned his team's regret they couldn't mandate ad blocking for optics reasons.
- deleted 5y ago[deleted]
- MattGaiser 5y agoIs this inclusive of Google's (and other large legitimate tech companies) various ad programs? Can you send a virus through Google's ads?
- HPsquared 5y agoWhy risk it, I suppose.
- neallindsay 5y agoI think there have been cases in the past, but that hardly matters. When you visit a site you run the risk that it has been exploited to spread malware. Would you want to also run the risk that one (or more likely a dozen) other sites running code on that page have been exploited as well?
- okl 5y agoWikipedia has something on past cases: https://en.wikipedia.org/wiki/Malvertising#History https://en.wikipedia.org/wiki/Malvertising#History
- prox 5y agoImgur had a couple of periods were trojans were being delivered through ads. The ineptitude of that place was staggering as it happened multiple times from 2010-2015 at least. Not sure how todays safety is in that regard.
- nkrisc 5y agoI don’t know if Google ad networks specifically have been compromised in the past, but it’s certainly happened to networks used by major sites. nytimes.com is one such example. At a minimum, any ad served by a third party network on a site you’re visiting should be considered a security threat. You gotta draw the line somewhere, but I think it’s reasonable to at least consider only first-party content from the site you’re visiting as reasonably safe. Perhaps blocking even JS unless it is absolutely necessary. Any site you visit could be compromised, but since the only 100% safe course of action is to completely disconnect from the web, blocking the most obvious vectors entirely seems appropriate. Of course, not only are ad networks vectors for malware, they don’t even serve a useful purpose to you that might justify the risk.
- Spooky23 5y agoGoogle is better than some, but is vulnerable to certain types of malicious use. Locksmith scams aren't a solved problem, AKAIK.
- Macha 5y agoConceptually, yes. Big vendors in this space have teams to detect malicious activity in their advertising network, but any team that claims to detect 100% is merely detecting 100% of what they know of. Browsers have gotten better and updates have gotten much faster, so less of that is drive by virus infections by exploiting the browser, but there's still cases of "Pick some users that you think are (a) real users and (b) naive enough" and serve them a exe download that contains a virus.
- annoyingnoob 5y agoI've instructed all of my users to never, ever, click on a Google ad when they've searched for something. Its been a couple of years now since someone has shown be a screen with a tech support scam on it. I had one user that was hitting tech support scams monthly. He would go to Google, search for Amazon, then click the first link on the page (which always had the little Ad word next to it).
- MattGaiser 5y agoI would argue that has more knowledge threat than a technical threat though.
- annoyingnoob 5y agoNo matter, cannot trust Google ads in our organization.
- colonelxc 5y agoThis is part of the reason the Google Safe Browsing project was created. At the time there were a lot of malicious sites either trying to get high SEO or paying for ads. The goal was to make it safe(r) to go to google and search (and click!) on things. For a project that didn't directly make money (there are some 'cloud' offerings now), Safe Browsing probably was a very high return on investment.
- yeezyseezy 5y agoI would love to see the tech support tickets filed at the less technologically inclined agencies after network level ad blocking is launched
- extheat 5y agoIf you want to browse safe, don't forget to disable JavaScript while you're at it.
- superkuh 5y agoYep. Somewhere a long the line running executables arbitrary third parties sent you became common practice instead of something you warn people not to do.
- vorticalbox 5y agoI did do this with no script and just allow websites I trust but it is a massive chore to keep everything working that I've given up
- mountain_peak 5y agoAbout 10 years ago, I was in a meeting with our security czar and I asked him what he was 'fiddling' around with in his browser toolbar. He replied, "NoScript. Highly recommended." Ever since then, I've become adept at picking out the 'minimum' amount of JS required to enable as much website functionality as I require and don't think about it much anymore (unless I'm visiting a new site). Highly recommended!
- vorticalbox 5y agoI might start using it again get over that learning curve so to speak
- sumtechguy 5y agoI run in the mode of deny everything. And it is annoying. If I whitelisted it probably would be a lot easier. I think there are maybe 2 sites where I did that. I have gotten pretty good at picking out the bare min too. But every once and awhile you have to pull out the 'allow all' just to get a site to work. Usually it is some sort of redirect and the redirect is doing some weird bit of JS and by the time you get to it it has already failed and the GUI has no idea what to show you. My thinking of 'deny all' is something like facebook where everyone seems to like to embed little bits into their pages. But I used to also use facebook. So if I made it work for one I would accidently make it work when I did not want it to on external sites. I have been using it like this for so long I hardly even notice it anymore though. But that is just me. If I give this sort of solution to anyone I usually just give them an adblocker. That gets most of the silly things.
- walrus01 5y agoI'd also be surprised if the nsa and CIA don't do things like public internet web browsing inside disposable thin client/remote desktop virtual machines.
- okl 5y agoSeparate room with separate PCs I'd guess, internet café style. Regarding VMs: https://en.wikipedia.org/wiki/Virtual_machine_escape https://en.wikipedia.org/wiki/Virtual_machine_escape
- annoyingnoob 5y agoThey are big organizations with people at all levels of computer skills. They have to plan for the lowest common denominator.
- trutannus 5y agoThis is how you end up with three layers of VMs for browsing the internet. Some gov organizations go a little into the deep end of security in the security-usability continuum.
- ThrowBackwards 5y agoI wonder what Tier of captcha's the NSA gets.
- harshreality 5y ago"Which of the following statements did Merkel make to Putin in email or phone conversations last week?"
- wp381640 5y agoThey had to change it from shots of drone footage because they kept failing click on the terrorists
- marcosdumay 5y agoThey just don't know what definition of "terrorist" to use. It's no different from people asking "does the end of the corner of a street light count?"
- formerly_proven 5y agoIf in doubt, just click on all squares in response to "Mark all enemies of state"
- sterlind 5y ago"Select pictures of field agents"
- whalesalad 5y agoI shove my entire home network's DNS thru pihole, cannot imagine life without it.
- vorticalbox 5y agoI found it enlightening with the amount of data an xbox sends home
- whalesalad 5y agoIt's enlightening when you see all the crap that all the devices on your network are doing. You can take things a step further and isolate IOT devices on isolated subnets, with additional firewall/security rules to create a choke point for all traffic. Only a matter of time before applications begin to roll their own encrypted forms of DNS in order to circumvent ad blockers.
- StillBored 5y agoYou mean like DOH? which is quickly becoming ubiquitous.
- blitzar 5y agoI expect they mean bypass your networks DNS completely and use hard coded ip's or a hard coded DNS (with some way to obscure it). DNS filtering and blocking is a very powerful tool great for bypassing many features/pitfalls of the internet.
- BeefWellington 5y agoIf you have the commitment to it, you can simply force all outbound connections not originating from your DNS servers to be NATed TO your DNS servers. I do this; no machine other than my 2 DNS servers are permitted to make outbound DNS requests (they are transparently handled by my LAN DNS). The real annoying change is the transition to DNS over HTTPS. The canary domain[1] is useful but apps are obviously free to ignore it. [1]: https://support.mozilla.org/en-US/kb/canary-domain-use-application-dnsnet https://support.mozilla.org/en-US/kb/canary-domain-use-appli...
- _jal 5y agoOn the one hand, this isn't surprising. An plain description of how the ad market works demonstrates why - one way of looking at it is a mechanism to run your code on random peoples' machines. On the other, policing, controlling and maintaining healthy markets is a primary government function. When the cops are afraid to look at a market for fear it will interfere with their jobs, that strikes me as a government failure reinforcing a market failure rather than attempting to fix it.
- SllX 5y ago> On the other, policing, controlling and maintaining healthy markets is a primary government function. The NSA and CIA are intelligence agencies, not cops. Their mandate is foreign, not domestic (despite not always acting like it).
- blitzar 5y agoYeah kinda sounds like they are using 'ad blockers' to prevent tracking of their, presumably quite large and trackable, userbase rather than blocking the banners on google search. Plus the fringe benefit of blocking malicious domains that may execute code in browsers of course. The real headline is probably - The NSA and CIA Blockers Chunks of the Internet Because the Internet is So Dangerous.
- twobitshifter 5y agoThe most dangerous thing about email is that it can send you to a malicious website. The troublesome thing is that you can’t (in general) choose who sends you emails. Ads are similar, you may choose to visit a site that you trust, but you don’t choose the ads that are served by that site to you and these ads can be malicious. The site owners that you trust may not even know the ads that are being served to their visitors.
- JohnFen 5y agoAny reasonable email reader will allow you to turn off HTML, execution of Javascript, and any resolution of outside URLs. That render email pretty safe. It's how I've been doing email for decades.
- Qub3d 5y agoYes, plaintext email is awesome! Too bad most major providers hide the option (or straight-up don't have it). I'll just plug https://useplaintext.email https://useplaintext.email as a great resource. The main recommendations are... opinionated (this site is run by Drew Devault, after all), but the instructions are very useful. I personally use thunderbird.
- rsync 5y ago"The most dangerous thing about email is that it can send you to a malicious website." (al)pine has never done this to me. 27 years and counting ...
- jedberg 5y agoWhen I worked at reddit, I refused to run Adblock. I felt like it would be hypocritical to work for a company that made its money from ads, and then block them. Also I wanted to make sure that I had the same experience as the users. When I left reddit, for the longest time I still didn't run Adblock because as a shareholder it still felt hypocritical. But a few years ago I couldn't take it anymore -- the web go so awful with ads on it became unusable. And so I relented and went full Adblock. And life got a lot better. (I did however whitelist reddit and a few other sites that I like whose ads are bearable)
- tubby12345 5y agothis is the weirdest flagellation i have ever seen. do you also believe that alcohol producers must daily consume alcohol? candy manufacturers daily consume candy? how about pharma? the list goes on.
- jagger27 5y agoShould companies eat their own dogfood? Uh, yeah.
- tubby12345 5y agoyou're reiterating GP without addressing exactly the counter examples that i allude to.
- jagger27 5y agoDo alcohol makers try their own products to ensure consistency day-to-day? I would hope so. I would certainly hope candymakers do too. Those are particularly bad examples.
- tubby12345 5y agoask yourself if you're willfully misconstruing what i'm saying in order to low brow dismiss my point. jedberg claims he consumed ads every day in order to empathize with this customers. the obvious implication is that everyone at such a company has the obligation to "try their own products".
- 2Gkashmiri 5y agonow imagine watching ads with the guilty feeling of "supporting poor youtubers". shit
- blitzar 5y agoTour of my new 12 MILLION!!!!! dollar house.
- ericholscher 5y agoWe've thought a lot about this issue. We have a page in our docs written up about it: https://www.ethicalads.io/surveillance-advertising/ https://www.ethicalads.io/surveillance-advertising/ -- there's definitely a small but growing movement of folks building a better advertising industry. It's a long road though..
- excalibur 5y agoI wonder if three-letters are maintaining a private stash of patches to fix some of the vulnerabilities they're hoarding.
- hcurtiss 5y agoAs a mid-sized US manufacturer that recently went through a ransomware scare, we contracted with FireEye for remediation and cybersecurity consultation. I was shocked that they recommended we install ad-blockers as a corporate policy. I remarked ads are sometimes useful and that many local companies rely upon them (e.g., the local newspaper). I use an adblocker just to make the internet more useable, but I was reluctant to make that a corporate policy. I couldn't imagine there was any meaningful threat from malware in ads as every company from the Journal to the Times to Nordstrom would be screwed without ads. But FireEye insisted and we now have adblocking installed with the usual image. Wild times. I have to believe this is truly disruptive to the internet as we know it. It seems to me the ad providers would have a huge incentive to counter this narrative and to make damned sure ads are safe. I have no idea why that's not happening.
- userbinator 5y agoI couldn't imagine there was any meaningful threat from malware in ads as every company from the Journal to the Times to Nordstrom would be screwed without ads. It's almost always not the big sites that have malware in their ads, but the shadier parts of the Internet --- which people may inevitably need to visit at some point, even deliberately. I wouldn't be surprised if they started recommending you whitelist JS next. That would be really "disruptive to the internet as we know it" --- and might actually make things better overall, as in returning to static text/image ads and pressuring sites that have no business being a SPA to go back to static content. Of course, I suspect the huge company whose name begins with G would not like that at all and will try its hardest to fight against it.
- bdamm 5y agoHaving client installed malware detection would be the step after blocking ads. Whitelisting JS would make 90% of the contemporary Internet, including essentials like Gmail and Office365, unusable.
- krisoft 5y agoIt wouldn’t make Gmail and Office365 unusable because they would be whitelisted. Nothing on the top-20 list you can come up with would be affected because those things you can think of from the top of your head would be things IT would also think of from the top of their head and whitelist it. The long-tail of sites is where the real impact would be in my opinion.
- sk00tmer1 5y agoI'm surprised they don't use DNS sinkholes
- rastafang 5y agoDoes that work with encrypted DNS?
- standyro 5y agoI worked for a well funded adtech company, and even our CTO used AdBlock. I think that speaks volumes about the security of advertising online.
- andreygrehov 5y agoI worked for an AdTech company and _everyone_ had an adblocker installed on their laptops.
- titzer 5y agoI worked for Google for almost 10 years--nearly 7 on Chrome--and found the internet unusable without uBlock origin installed on my laptop. On my workstation I basically just didn't use the web unless it was obviously pertinent to the problem in front of me. Nowadays, I use Safari with Ghostery lite and Adblock Plus. I won't go back to web without a blocker.
- jl6 5y agoAs far as I can tell there are two classes of ad blockers: 1) Those that sit outside the browser and provide a proxy that blocks requests to known-bad domains or similar filtering, and 2) Those that integrate with the browser and have full control over every page, in order to neutralize any HTML or JS or CSS that looks like an ad. It seems to me that the latter type open up a vast new attack surface. These addons have full access to every piece of data flowing through a logged-in webpage. All your Gmail, all your bank, all your Hacker News. How am I supposed to believe that these addons are themselves not sources of malware and vulnerability? They need to have the same standard of transparency and testing and supply chain security as the browser itself. I’m willing to believe that Mozilla and Google and Apple will not willingly introduce vulnerabilities into their browsers, but the vendor of BlockUrAdsPlus or whatever? No way.
- habeebtc 5y agoI had a colleague using an adblocker. The adblocker publisher went rogue, and he started getting porn popups. I don't know if they got hacked, or if that was the plan all along.
- deleted 5y ago[deleted]
- fouric 5y agoYes, ad-blockers get access to All The Things (except in Chrom(e/ium), where they've intentionally been neutered so Google can keep serving you ads), so you should treat them as any other piece of software, and get one you trust. The current gold standard is uBlock Origin, which is open source[1], highly performant, and whose author (gorhill) has a stellar reputation in the community. [1] https://github.com/gorhill/uBlock https://github.com/gorhill/uBlock
- unobatbayar 5y agoThanks, switched from Adblock to uBlock.
- cmeacham98 5y ago
- Tommah 5y agoWhen I bought a new laptop a few years ago, the first thing I did on it was install Firefox and browse Reddit. After about 20 minutes, an ad (I'm guessing) tried to serve me a drive-by download. So yes, ad blockers are essential. If a malicious ad does damage to you, you have essentially zero recourse.
- LatteLazy 5y agoEveryone thinks ads don't work on them. Everyone. Its like that meme about people on 40k worrying about taxes on billionairs. Ads are about the most dangerous thing you encounter on a daily basis. They make you eat badly and stress you out and damage your self worth.
- deleted 5y ago[deleted]
- carlosdp 5y agoWhy was the title changed to remove "because online advertising is so dangerous"? That's in the title of the article.
- dang 5y agoI took it out because it seemed like linkbait and that's in the guidelines: "Please use the original title, unless it is misleading or linkbait" https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- godshatter 5y agoI wish companies would go back to the old-fashioned process of selling advertising directly to other companies, skipping the middle-men and the need to aggregate user data at all, except maybe at the unique visitor level. There wouldn't be all the hoopla about making sure they weren't gaming the click-through system or whatever, so they wouldn't need javascript. Just an image. I wouldn't have to worry about being tracked, and I wouldn't have to worry about potentially dangerous javascript running on my machine. The ads could be served from the same machine that serves their other images, and I wouldn't feel the need to go out of my way to block them. I know that's incredibly naive, and simple wish fulfillment, but damn the ad industry has made the web into a nightmare. I'm tired of playing the game of trying to decide which domains I need to temporarily allow to see the content they put out there for free without being tracked across the web. I'd rather go back to the "Punch the Monkey" days of online advertising.
- Godel_unicode 5y agoHow the ads are sold is entirely unrelated to the need to do user tracking to defeat gaming the system. If you're paying for ads on the internet you have 2 choices; live with (possibly crazy amounts of) fraud or do user tracking with JavaScript. Edit: or 3, use a metric for campaign success which doesn't rely on knowing how many impressions your ad got
- warkdarrior 5y agoThe tracking is not just for measuring success of the campaign, but also for measuring the level of service provided by the ad network. Did they put your ad on 1'000'000 websites like they promised? Or just 100?
- godshatter 5y agoI'm talking about, for example, a company that sells sports apparel contracting with a company that sells sports equipment to put an ad on their website. No advertising company involved, no worries about fraudulent clicks. No javascript needed, just an anchor tag with a specific url around an image tag. The apparel company wouldn't worry about almost all the normal metrics, just how many actual jerseys did they actually sell through this ad on average per time period. If it's more than they paid for the ad, then it was a good deal to have made. It's easy to check for fraud in this scenario. They paid for the ad to be visible for a specific period of time. All they have to do is take a peek at the website to see if they are being defrauded or not. And no information about any users (other than those who actually paid for apparel) needs to be known by anyone.
- Animats 5y agoBlocking ads works better than it used to. I've had third-party cookies blocked for everybody for a decade, and most ads blocked. Years ago, that broke some sites. Now, it doesn't break anything important. I hit the Admiral ad-blocker detector now and then, and go to some competing site that doesn't use Admiral. You definitely want to block Google Backdoor™, a/k/a Tag Manager, which allows ad vendors to inject Javascript onto the pages of others. This is a known attack vector.[1] [1] https://blog.group-ib.com/grelosgtm https://blog.group-ib.com/grelosgtm
- fortuna86 5y agoUsing the internet without an ad blocker is a security risk, I don't care who you are.
- cblconfederate 5y agobut but , this means they 'll never learn about the malicious ads
- eh9 5y agoI’m so curious – what do they mean by wide scale blocking? Are there any papers on this? I run PiHole in a GCP container for my wife and I to WireGuard into… am I running “wide scale blocking” in my network?
- brianbreslin 5y agoWhat's the best ad blocker these days? Should I be trying to block ads at my router level at home instead? I've seen some ad blockers render some sites almost unusable.
- emptyparadise 5y agouBlock Origin.
- wernercd 5y agoDon't block our ads! then get served ads... absolute classic story if you've never heard it. https://www.techdirt.com/articles/20160111/05574633295/forbes-site-after-begging-you-turn-off-adblocker-serves-up-steaming-pile-malware-ads.shtml https://www.techdirt.com/articles/20160111/05574633295/forbe... Professionals use ad blockers for obvious reasons.
- hammyhavoc 5y agoTo describe Mozilla as a "rival browser maker" is to fundamentally misunderstand both Mozilla and Google. One, a non-profit, the other, one of the biggest corps on the planet.
- not2b 5y agoAds wouldn't be a security/privacy risk if they didn't try to track people across multiple sites and build profiles on people. If ads were served from the same site as the publication and aggregate statistics were kept locally, I'd have no problem seeing them and they'd be more likely to be relevant. It isn't ads that I want to block, it's cross-site tracking. Advertisers need to figure out how to adapt or fewer and fewer people will see their ads.
- anotherevan 5y agoAnd that's why I don't call them ad blockers, I call them HTML firewalls.
- lugged 5y agoPeople here don't use adblockers?
- b0afc375b5 5y agoScrolling through some of the comments here, I haven't read anything that praises ads. Which begs the question, why do we still tolerate ads? If employees from Ad companies themselves use adblock (!!!), something must be fundamentally wrong. Isn't it about time we change the financial model of the internet? Or should we just let humanity suffer through this non-value adding ritual? Personally I've never bought anything directly because of web ads. I understand that some people do and that some people find them beneficial. But I believe the cons outweigh the pros this time. I don't claim to have a solution, but it annoys me when we all agree that something sucks yet do nothing about it.
- s1artibartfast 5y agoI think this happens when nobody likes the current solution oh, but all the other Solutions are worse. Do you know what people hate more than ads? Paying for things, self hosting, or doing additional work themselves.
- 1vuio0pswjnm7 5y agoWithout ads, the web will become unhealthy (Mozilla and Google say ads are needed for a "healthy" web). It might die out. Someone please tell the NSA and CIA. Save the web! "Ads are the only way to have that web everyone loves. There are no other options. We tried all them, they dont work. Well, we didnt but who cares. Trust us." - Tech bro (Disclaimer: "I do not speak for my employer. I depend on my employer who depends on ads for money, but that doesnt matter. No one cares anyway. I dont even know the reason why disclaimers exist, I just copy other tech bros.")
- unobatbayar 5y agoAfter finding out browser extensions can be dangerous, I removed AdBlock. Does anyone know the if AdBlock is safe? Are there any alternatives?
- mensetmanusman 5y agoAdd could be ascii art only, bring back the days of 1 kb average page sizes :)
- randomthought12 5y agoI'll never not fight ads and I will never feel bad for blocking them all. Whatever I can do to block them, I will. raspberry pi-hole at home, brave browser, adblock youtube, ublock origin, modified hosts file on my computers.
- giuliomagnifico 5y agoSeems legit