5 ms·
> I don't think I've ever seen evidence that ad publishers, or anyone in that massive ecosystem, can inject arbitrary code, running in the browser's context, in
by luckylion 4y ago
> I don't think I've ever seen evidence that ad publishers, or anyone in that massive ecosystem, can inject arbitrary code, running in the browser's context, into websites who monetize through Google AdSense script tags alone.
I've personally witnessed it three times over the years because it usually ends with all users of the targeted sites being pushed to malware sites. Yes, it's happening via Adsense, and usually takes 1-3 days to stop. See also this article, that was one of the waves I dealt with: https://www.seroundtable.com/google-adsense-hijacking-19709.html https://www.seroundtable.com/google-adsense-hijacking-19709....
- btown 4y agoThe followup https://www.seroundtable.com/google-adsense-auto-redirect-bug-19720.html https://www.seroundtable.com/google-adsense-auto-redirect-bu... mentions it was Flash ads in 2015, which... of course they were. And not sure if it was the same instance, but also in 2015, https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/malicious-ads-redirect-to-flash-zero-day-exploit-affects-top-video-sharing https://www.trendmicro.com/vinfo/us/security/news/cybercrime... mentions it was a Flash zero-day that was exploited, which... of course it was. I'd love to see if there was anything from the post-Flash era, but this certainly answers the root question.
- luckylion 4y agoI wouldn't swear on it, but I believe another wave was a few years later, 2018-ish. Not sure if Flash was still a thing back then, but Google has been allowing JS to run in ads as well (as far as I remember, at least in some formats), and someone bypassing their automated checks isn't unheard of.