Malware Hides in Advertising

2016-12-08 • SEND FEEDBACK |
Related: security

This site has never and will never use an ad network or javascript code for 3rd party advertisements.

This is a chilling development. It means that your computer (and thus money and privacy) could be compromised by ads on a web site you visit.

Bruce Schneier reports in his security blog WWW Malware Hides in Images:

For the past two months, a new exploit kit has been serving malicious code hidden in the pixels of banner ads via a malvertising campaign that has been active on several high profile websites.

...

Since a large number of advertising networks allow advertisers to deliver JavaScript code with their ads, the crooks also included JS code that would parse the image, extract the pixel transparency values, and using a mathematical formula, convert those values into a character.

Delivering javascript code with ads is inherently a Very Bad Idea. As in a what were these idiots thinking idea. Ads with extra javascript are all about compromising your privacy for starters (at their most benign) and draining your bank accounts (worst case).But that’s what ad networks do to make a buck.

What a shame that the genius (evil genius) of malware developers is not put to work in positive ways. I also wonder how long Google’s ad revenues might last in the context of such exploits. It is a very strong argument for ad blockers.