7 ms·

As a mid-sized US manufacturer that recently went through a ransomware scare, we contracted with FireEye for remediation and cybersecurity consultation. I was

As a mid-sized US manufacturer that recently went through a ransomware scare, we contracted with FireEye for remediation and cybersecurity consultation. I was shocked that they recommended we install ad-blockers as a corporate policy. I remarked ads are sometimes useful and that many local companies rely upon them (e.g., the local newspaper). I use an adblocker just to make the internet more useable, but I was reluctant to make that a corporate policy. I couldn't imagine there was any meaningful threat from malware in ads as every company from the Journal to the Times to Nordstrom would be screwed without ads. But FireEye insisted and we now have adblocking installed with the usual image. Wild times. I have to believe this is truly disruptive to the internet as we know it. It seems to me the ad providers would have a huge incentive to counter this narrative and to make damned sure ads are safe. I have no idea why that's not happening.

userbinator 5y ago
I couldn't imagine there was any meaningful threat from malware in ads as every company from the Journal to the Times to Nordstrom would be screwed without ads. It's almost always not the big sites that have malware in their ads, but the shadier parts of the Internet --- which people may inevitably need to visit at some point, even deliberately. I wouldn't be surprised if they started recommending you whitelist JS next. That would be really "disruptive to the internet as we know it" --- and might actually make things better overall, as in returning to static text/image ads and pressuring sites that have no business being a SPA to go back to static content. Of course, I suspect the huge company whose name begins with G would not like that at all and will try its hardest to fight against it.
- bdamm 5y ago
  Having client installed malware detection would be the step after blocking ads. Whitelisting JS would make 90% of the contemporary Internet, including essentials like Gmail and Office365, unusable.
  - krisoft 5y ago
    It wouldn’t make Gmail and Office365 unusable because they would be whitelisted. Nothing on the top-20 list you can come up with would be affected because those things you can think of from the top of your head would be things IT would also think of from the top of their head and whitelist it. The long-tail of sites is where the real impact would be in my opinion.
    - azalemeth 5y ago
      I do this -- I use uMatrix and effectively whitelist js. The net result is that you realise how a) websites work, b) fecking annoying cloudfront and gCaptcha are z and c) Facebook is everywhere. No way in hell I'd recommend this to anyone who isn't tech aware though.
- beerandt 5y ago
  I mean, it's always been a bit mind blowing to me that companies relied on client-side processing for their business models to work. It seems like server-side, dynamically generated static content would have at least been explored more than it seemingly has. I always assumed this was what Google was always trying to eventually get to with AMP.
  - closeparen 5y ago
    The people who control the backend servers have an obvious incentive to rip off the ad networks. Clients are more trustworthy in this context.
tim333 5y ago
>It seems to me the ad providers would have a huge incentive to counter this narrative and to make damned sure ads are safe. I have no idea why that's not happening. In the current model they have last second auctions with the ad going to the highest bidder. It's hard to reliably screen them in that kind of situation. I find it quite scary to have someone not very tech smart download software without an ad blocker - you get one proper download link and about 10 ads saying download here linking to malware.
- indigochill 5y ago
  I don't see why it's hard. You screen admission of an ad to the auction "floor". Shady javascript/links? You don't get to compete. Admittedly, this means you need an army of ad moderators, but that's not a hard problem. Social media giants already use an army of underpaid moderators for moderating their platforms, so seems like it's just table stakes for running a platform. Screening ads should be a cakewalk compared to moderating social media.
  - nickff 5y ago
    Google (and others) do screen ads; I think most of the insecure ads are served by smaller, less scrupulous ad networks.
    - hapless 5y ago
      If you want to make money on display advertising, you will grasp for whatever pennies you can get Google Adsense is not always the highest-paying option for a given impression There are entire companies that do nothing but figure out quietly, without the publisher's having to do anything, what will pay most at a given moment
      - nickff 5y ago
        I agree with what you're saying, but want to clarify that you're talking about 'AdSense' (the display advertisements), not 'AdWords' (the search ads).
AnimalMuppet 5y ago
> I have to believe this is truly disruptive to the internet as we know it. Maybe so. And maybe I'm all right with that. The ad-supported internet has turned into the ad-on-every-square-inch internet. We get lots of great content for free, but the amount of ads are overwhelming, distracting, annoying, and eventually disgusting. (Not necessarily the content of the ads, just the volume.) Back to security: We have come to the place where really interesting content that asks you to turn off your ad blocker is now a phishing vector.
binkHN 5y ago
> It seems to me the ad providers would have a huge incentive to counter this narrative and to make damned sure ads are safe. Ad providers? You mean Google which provides the majority of the ads. I’m really surprised Google hasn’t done more here when major security companies are recommending denying Google their primary source of revenue.
- nickff 5y ago
  >"I’m really surprised Google hasn’t done more" I have used Google Ads, and think the ads themselves are quite secure; I am less certain about the advertiser websites (though it seems Google does some sort of link-testing/screening). What are you suggesting Google has failed to do? I think the problems with ad security are on smaller platforms/networks which are willing to host less-secure ads, and I'm not sure what Google could do about them.
  - binkHN 5y ago
    They are the leaders in the industry. To my way of thinking, if the recommendation is to block the entire industry as a whole, they are simply not doing enough.
drdeadringer 5y ago
Wild times? That's what I call this: reading an advocation FOR ads. Ads being great and wonderful instead of -- at best -- a necessary evil.
JohnFen 5y ago
> I was shocked that they recommended we install ad-blockers as a corporate policy. It's solid policy. The problem with ads in this regard is really that they allow random strangers to run code on your machine. That's never a good security practice.
- kasey_junk 5y ago
  That’s true of any JavaScript though right?
  - michaelt 5y ago
    Imagine I only visit websites like the New York Times. If an evildoer with a browser 0-day wants to target me, without an ad blocker any of a thousand companies can pay a few cents to have their javascript served to me. If I run an adblocker, there are a lot fewer ways to get their code in front of me. A statistical argument, in other words - that being exposed to code from 10 vendors is safer than being exposed to code from 1000 vendors.
  - JohnFen 5y ago
    Yes, it is. Which is a pretty large problem, and is why I don't allow JS to execute by default. I do whitelist specific things if the need is great enough.
  - mikestew 5y ago
    Do you supposed it is possibly more true for ads? There's "well, technically, yes" and then there's "which is the more realistic threat, an ad network or the JavaScript that the NYT serves up?"
- BLKNSLVR 5y ago
  Exactly. I'm actually surprised that it's not standard policy to block ads at most companies. Browsing sites at work is a frequent reminder of why I block ads at home.
  - dylan604 5y ago
apexalpha 5y ago
I've never worked in an IT department that didn't have massive DNS based blocklists for everything. It's internet hygiene 101 nowadays. Besides that it also makes for a more pleasant experience and saves resources too.
ahzhou 5y ago
I tried turning off my Adblocker in 2012 to better support newspapers and whatnot. One of the sites I visit regularly immediately loaded something that my antivirus quarantined. Never looked back.
fridif 5y ago
Conversely I have a work laptop where all browser extensions are blocked, including uBlock, because you guessed it, malware!
einpoklum 5y ago
> I remarked ads are sometimes useful and that many local companies rely upon them (e.g., the local newspaper). If the local newspaper has a local ad in a local website, the ad blocker will probably not pick it up :-P
- dorkwood 5y ago
  True! But I also feel like local newspapers would be more likely to put the word 'ad' in the name of their advertising jpegs, in which case adblockers would still pick them up.
srmatto 5y ago
The ad industry has known about their fraud problem for years, at least since 2015--and they did little to nothing about it. I don't have much sympathy for them.
- AniseAbyss 5y ago
  Honestly I don't care if it's "old fashioned" websites need to start taking responsibility for the ads that they run on their sites. Yeah auctioning your ad space in milliseconds is cool and maximum profit. I don't care.
  - david_shaw 5y ago
    If the threat you're seeking to mitigate is malicious ads ("malvertisements,") then you could easily pass that burden to the ad networks themselves. I think it's extraordinarily rare for a website to sell "banner space" instead of just throwing in an AdSense snippet or similar.
    - dsr_ 5y ago
      Yes, if only we could trust advertising networks to work in the best interests of their viewers.
      - dylan604 5y ago
        why would they? the viewers are not their customers.
        dsr_ 5y ago
        "They don't have sarcasm on Betelgeuse, and Ford Prefect often failed to notice it unless he was concentrating." -- Douglas Adams It turns out that sarcasm is sometimes not obvious to everyone. My apologies. You are correct. They cannot be trusted. The entire history of advertising and advertisers is evidence that they cannot be trusted. They cannot be trusted to self-regulate, to follow voluntary codes, or even to form an industry regulating body (sorry, UK, you know it's true). And yes, Google is an advertising agency... which spends up to $20MM a year on federal lobbying.
aborsy 5y ago
Curious, what other recommendations they made? I mean generally.
ohazi 5y ago
> as every company from the Journal to the Times to Nordstrom would be screwed without ads. The ad industry had the opportunity and the ability to address this problem, but (for short-term reasons) they decided not to. This is the long-term result. They did this to themselves, and now they deserve to suffer the consequences, up to and including a fiery death for the industry as a whole. Nordstrom, etc. don't need to suffer as a result of this, they can simply observe the online ad industry and make a decision about when to stop using it -- perhaps in favor of something new and different, or perhaps not. Print ads still work just fine. The Times, etc. charge for access, are happy to sign you up via web form, but then force you to call them if you want to cancel. As far as I'm concerned, they shouldn't be running online ads at all anymore. If ad blocking becoming prevalent hurts them, too fucking bad.
- barkingcat 5y ago
  Wasn't there some regular company who decided to delete all adsense/ad networks from their sites for a quarter and at the end of the quarter found no difference in ordering/sales, etc. Online ads is snakeoil
  - dredmorbius 5y ago
    Freakonomics two-parter on whether or not advertising works is worth listening to: https://freakonomics.com/podcast/advertising-part-1/ https://freakonomics.com/podcast/advertising-part-1/ https://freakonomics.com/podcast/advertising-part-2/ https://freakonomics.com/podcast/advertising-part-2/
  - g_p 5y ago
    Even better than this, large sites have found they actually made more from non-targeted ads [1]. Same for the NYT - revenue continued growing after turning off ad exchanges for European visitors [2]. There's also the question around whether the levels of fraud mean companies buying targeted ads are ever getting what they paid for [3] - Uber cut $120m of $150m ad spend without any impact on installs (which is what they were trying to drive) [1] https://www.theregister.com/2020/07/03/stop_tracking_increase_revenue_effectiveness/ https://www.theregister.com/2020/07/03/stop_tracking_increas... [2] https://digiday.com/media/gumgumtest-new-york-times-gdpr-cut-off-ad-exchanges-europe-ad-revenue/ https://digiday.com/media/gumgumtest-new-york-times-gdpr-cut... [3] https://indica.medium.com/how-uber-discovered-that-80-of-its-ads-were-useless-bb4d96ee46c8 https://indica.medium.com/how-uber-discovered-that-80-of-its...
charwalker 5y ago
My Grandma has DNS level ad blocking enabled. Why? Because her ISP home page (her 20 year strong default as well as login for email/etc) used run ads when a page was left open for a while. She'd unlock her laptop to find full on porn ads running full screen with no way to click away without quitting the browser. So now she runs ad blockers galore and pihole across all devices. So far no porn ads in her email. And no I did not ask if any of her browsing behavior would lead to such ads. She's a tiny old blonde Christian lady that...wait also a church donation site gave her porn ads too. Maybe I should avoid checking her history. So yes, do enforce ad blocking on your network, if able. It will save a few calls and probably embarrassment as well.
- throwaway2037 5y ago
  I laughed so hard when I read this post. And I assume it is all true. What a sad state of affairs! I can only imagine the amount of spam calls she gets to her phone.
blacksmith_tb 5y ago
Plenty of organizations run local DNS servers, you'd think it wouldn't be a big stretch to start adblocking at that layer (though doing it on the client does allow for more fine tuning).
- Unklejoe 5y ago
  I wonder how much longer DNS based ad blocking is even going to work with things moving to DNS over HTTPS.
  - cpeterso 5y ago
    Organizations can run their own DNS over HTTPS resolvers.
  - heavyset_go 5y ago
    I've relied on DNS-based ad blocking for years and, as of late, some ads have got through, especially on phones and streaming devices.
munchbunny 5y ago
As someone who worked on/with the ad serving stack, I agree with FireEye's stance on this one. The problem is this: ads are basically browser-injection-as-a-service, as in injecting code into websites of your choice, targeting audiences of your choice. Browsers mitigate this problem somewhat by sandboxing cross-site stuff in the webpage, and ad networks theoretically scan the payloads for malware like miners, but those tests aren't hard to work around. So ads can basically run whatever they want within the little aperture of an iframe that they get. If there's a zero-day like the Internet Explorer JPEG renderer zero-day (https://www.kb.cert.org/vuls/id/965206 https://www.kb.cert.org/vuls/id/965206), then the ad networks are basically broadly targeted zero-day-as-a-service. Ad blockers aren't a bad first line of defense for this.
- toss1 5y ago
  >>browser-injection-as-a-service Excellent description!! It is exactly what they do, and directly implies the failure and remedy modes.
maerF0x0 5y ago
Why can't the site just show ads directly from their domain? It'd be hard to block ads without blocking content then. Many websites used to just run ads that were directly negotiated and paid for by the company. eg: Plenty of Fish used to do that and they sold for $575M .
- doliveira 5y ago
  I don't get it either, but thankfully most don't. We had to create CSP basically to tame the thousands of third-party marketing scripts, it seems...
deleted 5y ago
[deleted]
hacker_newz 5y ago
Wild times? It sounds like if your company had better security controls in the first place you wouldn't have been exposed to ransomware.
devwastaken 5y ago
Go to edge or chrome without an ad blocker and do a search for software or something. You will get adware, malware, and outright wrong suggestions for the first ten results. Google AdWords does not directly host malware typically, but the sites behind them do. Fishing is trivial to pull off. I believe, as a matter of actual national security, online advertising that is deceptive or leads to deceptive locations should be illigal. I want to see heads roll when I get fake "download" buttons when trying to actually download an image for work.
unmole 5y ago
WSJ and NYT put their content behind paywalls. I doubt ads are how they make most of their money.
GoblinSlayer 5y ago
You can add the local newspaper to the adblocker whitelist, if it uses standalone ads like distrowatch, instead of an ad network. But keep scripts disabled there.

userbinator 5y ago

I couldn't imagine there was any meaningful threat from malware in ads as every company from the Journal to the Times to Nordstrom would be screwed without ads. It's almost always not the big sites that have malware in their ads, but the shadier parts of the Internet --- which people may inevitably need to visit at some point, even deliberately. I wouldn't be surprised if they started recommending you whitelist JS next. That would be really "disruptive to the internet as we know it" --- and might actually make things better overall, as in returning to static text/image ads and pressuring sites that have no business being a SPA to go back to static content. Of course, I suspect the huge company whose name begins with G would not like that at all and will try its hardest to fight against it.

bdamm 5y ago
Having client installed malware detection would be the step after blocking ads. Whitelisting JS would make 90% of the contemporary Internet, including essentials like Gmail and Office365, unusable.
- krisoft 5y ago
  It wouldn’t make Gmail and Office365 unusable because they would be whitelisted. Nothing on the top-20 list you can come up with would be affected because those things you can think of from the top of your head would be things IT would also think of from the top of their head and whitelist it. The long-tail of sites is where the real impact would be in my opinion.
  - azalemeth 5y ago
    I do this -- I use uMatrix and effectively whitelist js. The net result is that you realise how a) websites work, b) fecking annoying cloudfront and gCaptcha are z and c) Facebook is everywhere. No way in hell I'd recommend this to anyone who isn't tech aware though.
beerandt 5y ago
I mean, it's always been a bit mind blowing to me that companies relied on client-side processing for their business models to work. It seems like server-side, dynamically generated static content would have at least been explored more than it seemingly has. I always assumed this was what Google was always trying to eventually get to with AMP.
- closeparen 5y ago
  The people who control the backend servers have an obvious incentive to rip off the ad networks. Clients are more trustworthy in this context.

tim333 5y ago

>It seems to me the ad providers would have a huge incentive to counter this narrative and to make damned sure ads are safe. I have no idea why that's not happening. In the current model they have last second auctions with the ad going to the highest bidder. It's hard to reliably screen them in that kind of situation. I find it quite scary to have someone not very tech smart download software without an ad blocker - you get one proper download link and about 10 ads saying download here linking to malware.

indigochill 5y ago
I don't see why it's hard. You screen admission of an ad to the auction "floor". Shady javascript/links? You don't get to compete. Admittedly, this means you need an army of ad moderators, but that's not a hard problem. Social media giants already use an army of underpaid moderators for moderating their platforms, so seems like it's just table stakes for running a platform. Screening ads should be a cakewalk compared to moderating social media.
- nickff 5y ago
  Google (and others) do screen ads; I think most of the insecure ads are served by smaller, less scrupulous ad networks.
  - hapless 5y ago
    If you want to make money on display advertising, you will grasp for whatever pennies you can get Google Adsense is not always the highest-paying option for a given impression There are entire companies that do nothing but figure out quietly, without the publisher's having to do anything, what will pay most at a given moment
    - nickff 5y ago
      I agree with what you're saying, but want to clarify that you're talking about 'AdSense' (the display advertisements), not 'AdWords' (the search ads).

AnimalMuppet 5y ago

> I have to believe this is truly disruptive to the internet as we know it. Maybe so. And maybe I'm all right with that. The ad-supported internet has turned into the ad-on-every-square-inch internet. We get lots of great content for free, but the amount of ads are overwhelming, distracting, annoying, and eventually disgusting. (Not necessarily the content of the ads, just the volume.) Back to security: We have come to the place where really interesting content that asks you to turn off your ad blocker is now a phishing vector.

binkHN 5y ago

> It seems to me the ad providers would have a huge incentive to counter this narrative and to make damned sure ads are safe. Ad providers? You mean Google which provides the majority of the ads. I’m really surprised Google hasn’t done more here when major security companies are recommending denying Google their primary source of revenue.

nickff 5y ago
>"I’m really surprised Google hasn’t done more" I have used Google Ads, and think the ads themselves are quite secure; I am less certain about the advertiser websites (though it seems Google does some sort of link-testing/screening). What are you suggesting Google has failed to do? I think the problems with ad security are on smaller platforms/networks which are willing to host less-secure ads, and I'm not sure what Google could do about them.
- binkHN 5y ago
  They are the leaders in the industry. To my way of thinking, if the recommendation is to block the entire industry as a whole, they are simply not doing enough.

drdeadringer 5y ago

Wild times? That's what I call this: reading an advocation FOR ads. Ads being great and wonderful instead of -- at best -- a necessary evil.

JohnFen 5y ago

> I was shocked that they recommended we install ad-blockers as a corporate policy. It's solid policy. The problem with ads in this regard is really that they allow random strangers to run code on your machine. That's never a good security practice.

kasey_junk 5y ago
That’s true of any JavaScript though right?
- michaelt 5y ago
  Imagine I only visit websites like the New York Times. If an evildoer with a browser 0-day wants to target me, without an ad blocker any of a thousand companies can pay a few cents to have their javascript served to me. If I run an adblocker, there are a lot fewer ways to get their code in front of me. A statistical argument, in other words - that being exposed to code from 10 vendors is safer than being exposed to code from 1000 vendors.
- JohnFen 5y ago
  Yes, it is. Which is a pretty large problem, and is why I don't allow JS to execute by default. I do whitelist specific things if the need is great enough.
- mikestew 5y ago
  Do you supposed it is possibly more true for ads? There's "well, technically, yes" and then there's "which is the more realistic threat, an ad network or the JavaScript that the NYT serves up?"
BLKNSLVR 5y ago
Exactly. I'm actually surprised that it's not standard policy to block ads at most companies. Browsing sites at work is a frequent reminder of why I block ads at home.
- dylan604 5y ago

apexalpha 5y ago

I've never worked in an IT department that didn't have massive DNS based blocklists for everything. It's internet hygiene 101 nowadays. Besides that it also makes for a more pleasant experience and saves resources too.

ahzhou 5y ago

I tried turning off my Adblocker in 2012 to better support newspapers and whatnot. One of the sites I visit regularly immediately loaded something that my antivirus quarantined. Never looked back.

fridif 5y ago

Conversely I have a work laptop where all browser extensions are blocked, including uBlock, because you guessed it, malware!

einpoklum 5y ago

> I remarked ads are sometimes useful and that many local companies rely upon them (e.g., the local newspaper). If the local newspaper has a local ad in a local website, the ad blocker will probably not pick it up :-P

dorkwood 5y ago
True! But I also feel like local newspapers would be more likely to put the word 'ad' in the name of their advertising jpegs, in which case adblockers would still pick them up.

srmatto 5y ago

The ad industry has known about their fraud problem for years, at least since 2015--and they did little to nothing about it. I don't have much sympathy for them.

AniseAbyss 5y ago
Honestly I don't care if it's "old fashioned" websites need to start taking responsibility for the ads that they run on their sites. Yeah auctioning your ad space in milliseconds is cool and maximum profit. I don't care.
- david_shaw 5y ago
  If the threat you're seeking to mitigate is malicious ads ("malvertisements,") then you could easily pass that burden to the ad networks themselves. I think it's extraordinarily rare for a website to sell "banner space" instead of just throwing in an AdSense snippet or similar.
  - dsr_ 5y ago
    Yes, if only we could trust advertising networks to work in the best interests of their viewers.
    - dylan604 5y ago
      why would they? the viewers are not their customers.
      - dsr_ 5y ago
        "They don't have sarcasm on Betelgeuse, and Ford Prefect often failed to notice it unless he was concentrating." -- Douglas Adams It turns out that sarcasm is sometimes not obvious to everyone. My apologies. You are correct. They cannot be trusted. The entire history of advertising and advertisers is evidence that they cannot be trusted. They cannot be trusted to self-regulate, to follow voluntary codes, or even to form an industry regulating body (sorry, UK, you know it's true). And yes, Google is an advertising agency... which spends up to $20MM a year on federal lobbying.

aborsy 5y ago

Curious, what other recommendations they made? I mean generally.

ohazi 5y ago

> as every company from the Journal to the Times to Nordstrom would be screwed without ads. The ad industry had the opportunity and the ability to address this problem, but (for short-term reasons) they decided not to. This is the long-term result. They did this to themselves, and now they deserve to suffer the consequences, up to and including a fiery death for the industry as a whole. Nordstrom, etc. don't need to suffer as a result of this, they can simply observe the online ad industry and make a decision about when to stop using it -- perhaps in favor of something new and different, or perhaps not. Print ads still work just fine. The Times, etc. charge for access, are happy to sign you up via web form, but then force you to call them if you want to cancel. As far as I'm concerned, they shouldn't be running online ads at all anymore. If ad blocking becoming prevalent hurts them, too fucking bad.

barkingcat 5y ago
Wasn't there some regular company who decided to delete all adsense/ad networks from their sites for a quarter and at the end of the quarter found no difference in ordering/sales, etc. Online ads is snakeoil
- dredmorbius 5y ago
  Freakonomics two-parter on whether or not advertising works is worth listening to: https://freakonomics.com/podcast/advertising-part-1/ https://freakonomics.com/podcast/advertising-part-1/ https://freakonomics.com/podcast/advertising-part-2/ https://freakonomics.com/podcast/advertising-part-2/
- g_p 5y ago
  Even better than this, large sites have found they actually made more from non-targeted ads [1]. Same for the NYT - revenue continued growing after turning off ad exchanges for European visitors [2]. There's also the question around whether the levels of fraud mean companies buying targeted ads are ever getting what they paid for [3] - Uber cut $120m of $150m ad spend without any impact on installs (which is what they were trying to drive) [1] https://www.theregister.com/2020/07/03/stop_tracking_increase_revenue_effectiveness/ https://www.theregister.com/2020/07/03/stop_tracking_increas... [2] https://digiday.com/media/gumgumtest-new-york-times-gdpr-cut-off-ad-exchanges-europe-ad-revenue/ https://digiday.com/media/gumgumtest-new-york-times-gdpr-cut... [3] https://indica.medium.com/how-uber-discovered-that-80-of-its-ads-were-useless-bb4d96ee46c8 https://indica.medium.com/how-uber-discovered-that-80-of-its...

charwalker 5y ago

My Grandma has DNS level ad blocking enabled. Why? Because her ISP home page (her 20 year strong default as well as login for email/etc) used run ads when a page was left open for a while. She'd unlock her laptop to find full on porn ads running full screen with no way to click away without quitting the browser. So now she runs ad blockers galore and pihole across all devices. So far no porn ads in her email. And no I did not ask if any of her browsing behavior would lead to such ads. She's a tiny old blonde Christian lady that...wait also a church donation site gave her porn ads too. Maybe I should avoid checking her history. So yes, do enforce ad blocking on your network, if able. It will save a few calls and probably embarrassment as well.

throwaway2037 5y ago
I laughed so hard when I read this post. And I assume it is all true. What a sad state of affairs! I can only imagine the amount of spam calls she gets to her phone.

blacksmith_tb 5y ago

Plenty of organizations run local DNS servers, you'd think it wouldn't be a big stretch to start adblocking at that layer (though doing it on the client does allow for more fine tuning).

Unklejoe 5y ago
I wonder how much longer DNS based ad blocking is even going to work with things moving to DNS over HTTPS.
- cpeterso 5y ago
  Organizations can run their own DNS over HTTPS resolvers.
- heavyset_go 5y ago
  I've relied on DNS-based ad blocking for years and, as of late, some ads have got through, especially on phones and streaming devices.

munchbunny 5y ago

As someone who worked on/with the ad serving stack, I agree with FireEye's stance on this one. The problem is this: ads are basically browser-injection-as-a-service, as in injecting code into websites of your choice, targeting audiences of your choice. Browsers mitigate this problem somewhat by sandboxing cross-site stuff in the webpage, and ad networks theoretically scan the payloads for malware like miners, but those tests aren't hard to work around. So ads can basically run whatever they want within the little aperture of an iframe that they get. If there's a zero-day like the Internet Explorer JPEG renderer zero-day (https://www.kb.cert.org/vuls/id/965206 https://www.kb.cert.org/vuls/id/965206), then the ad networks are basically broadly targeted zero-day-as-a-service. Ad blockers aren't a bad first line of defense for this.

toss1 5y ago
>>browser-injection-as-a-service Excellent description!! It is exactly what they do, and directly implies the failure and remedy modes.

maerF0x0 5y ago

Why can't the site just show ads directly from their domain? It'd be hard to block ads without blocking content then. Many websites used to just run ads that were directly negotiated and paid for by the company. eg: Plenty of Fish used to do that and they sold for $575M .

doliveira 5y ago
I don't get it either, but thankfully most don't. We had to create CSP basically to tame the thousands of third-party marketing scripts, it seems...

deleted 5y ago

[deleted]

hacker_newz 5y ago

Wild times? It sounds like if your company had better security controls in the first place you wouldn't have been exposed to ransomware.

devwastaken 5y ago

Go to edge or chrome without an ad blocker and do a search for software or something. You will get adware, malware, and outright wrong suggestions for the first ten results. Google AdWords does not directly host malware typically, but the sites behind them do. Fishing is trivial to pull off. I believe, as a matter of actual national security, online advertising that is deceptive or leads to deceptive locations should be illigal. I want to see heads roll when I get fake "download" buttons when trying to actually download an image for work.

unmole 5y ago

WSJ and NYT put their content behind paywalls. I doubt ads are how they make most of their money.

GoblinSlayer 5y ago

You can add the local newspaper to the adblocker whitelist, if it uses standalone ads like distrowatch, instead of an ad network. But keep scripts disabled there.