3 ms·
With the proliferation of real-time auction and backfill ad networks, the ability for a bad user to inject javascript or malicious Flash ads into the ad creativ
by davidu 12y ago
With the proliferation of real-time auction and backfill ad networks, the ability for a bad user to inject javascript or malicious Flash ads into the ad creative space carried on major sites has grown dramatically over the last few years.
It's hard to even tell who is serving up your ads sometimes without pulling out wireshark or some kind of HTTP proxy to look at the request chain.
- eli 12y agoAgain, though, if an ad blocker is the only thing standing between you and a zero-day, you need to immediately stop what you're doing and patch your browser. It's true there are bad actors taking advantage of ad networks. There are bad actors hacking Wordpress installs too.
- davidu 12y agoAt the very least, we didn't want users being infected from ad blocks that we, were ourselves, serving up! :-) But I'd argue it's one less vector for infection, and an important one at that.
- belorn 12y agoGoogle search and most browsers will protect users against known malicious websites that has been hacked. They can't do that with malicious adds.
- eli 12y agoThey can and do. If a site runs a malicious ad, Google will flag the whole site.
- mentat 12y agoPerhaps there are other ways to meaningfully compromise site security? It's not just a zero day that breaks out of the web browser sandbox and installs a rootkit, it's the hostile javascript running in the context of the page that might not be properly scoped and ends up stealing information straight out of the DOM (or stores or whatever.)
- josephlord 12y agoI don't think you know what a zero-day is or if you do I would be interested to know what is standing between you and one. By definition there is no patch for a zero-day.