Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Online ad giant Adform was hacked, proving once again why ad blockers are needed

this.weekinsecurity.com

Post reply on HN
Print view View original

71–80 of 107 posts

Re: Online ad giant Adform was hacked, proving once again why ad blockers are needed

#71

Post by inigyou »

anang wrote: post #63
still_grokking wrote: post #61

Earlier quoted context omitted.

> I think it’s hard to argue that the amount of justice is unchanged for all of human history I agree. It got worse. The inequality between people was never so high in history! Hard fact. Now some people "earn" more money while they breeze in and out then large amounts of people earn in their whole life. Also now the slaves have to pay everything themself (like food, shelter, clothes, in some countries even education…

I just want to understand: Are you saying that a black person born in South Carolina today has a worse life and with less justice than a black person born into slavery a few hundred years ago? I don’t think slaves got university educations for free.

Do they have free university education in South Carolina?

And why only black people?

Re: Online ad giant Adform was hacked, proving once again why ad blockers are needed

#72

Post by ToucanLoucan »

CM30 wrote: post #67

It's definitely proof that dynamic ads added via an external script library are a massive security risk, that's for sure. Even if the provider doesn't actually get hacked like Adform here, you're still banking on them being able to reject/filter out malware and malicious ads, which plenty of 'credible' networks seem completely unable or unwilling to do. Going online without an adblocker just feels like playing with f…

Why would they? What's your recourse as a consumer if they fuck up your hardware? In the extremely unlikely event you manage to get it in front of a Court, they could point to the 3 other ad networks also present on the same page, and to the wider internet just infested with the fucking things. Odds are incredibly long you could even prove you were infected with whichever virus, and then what do you get? A few years of identity theft protection, a new phone if you're VERY lucky?

Re: Online ad giant Adform was hacked, proving once again why ad blockers are needed

#73

Post by downrightmike »

nashashmi wrote: post #16

Websites being hacked does not necessitate ad block. It necessitates better browser security. The title here is fallacious. I say this in all fairness as someone who uses adblock extensively, where I don't even like cookies being held by ad companies.

You are right, adware comes through ad systems regardless. Block everything regardless as well.

Re: Online ad giant Adform was hacked, proving once again why ad blockers are needed

#74

Post by dotancohen »

CM30 wrote: post #67

It's definitely proof that dynamic ads added via an external script library are a massive security risk, that's for sure. Even if the provider doesn't actually get hacked like Adform here, you're still banking on them being able to reject/filter out malware and malicious ads, which plenty of 'credible' networks seem completely unable or unwilling to do. Going online without an adblocker just feels like playing with f…

   > Going online without an adblocker just feels like playing with fire, especially nowadays.
It feels more like having casual unprotected sex. Easy to do in the moment, easy to ignore the risk, painful if "it never happens to me" doesn't come up cats eyes this time.

If we called the first programs that self-propagated worms and viruses as per the real world analogy, then I think it's time we rebrand adblockers as "condoms".

Re: Online ad giant Adform was hacked, proving once again why ad blockers are needed

#75

Post by edelbitter »

afarah1 wrote: post #51
jimt1234 wrote: post #13

Browsers should not have access to the clipboard.

You can disable it on Firefox by setting dom.event.clipboardevents.enabled to false. I haven't had any issues with it. Someone shared the code in the comments, it uses 'copy' and 'cut' event listeners, so disabling this setting would have prevented the exploit regardless of an adblock.

dom.event.clipboardevents.enabled=false removes the non-consensual clipboard read access, which is an enhancement but not a strict requisite for attacks of this type. The utility of the other events boils down to mostly convenience: The website can still indirectly observe how you use the clipboard, even when not explicitly notified. The website also remains in control of the CSS properties that can be used to create a meaningful difference between user selection and resulting clipboard content after copying. And, crucially, (blindly) overwriting the clipboard is still permitted.

Re: Online ad giant Adform was hacked, proving once again why ad blockers are needed

#76

Post by veeti »

giancarlostoro wrote: post #60
strictnein wrote: post #5

Probably should just link to the security researcher's post, since it's far more informative: https://doublepulsar.com/adform-compromised-to-serve-crypto-...

The bitcoin wallet swap thing that these malware scripts often push, how effective is it? It just seems so niche, if I'm doing stuff with my crypto wallet, I'm more likely to do it from my phone where I wont be copying and pasting to and from a web browser, maybe a webview if anything? I always double check the characters match up anyway... I am just shocked the level of effort for the most niche hack.

It sounds a little implausible at first, but Adform serves like a billion views on European consumer websites. For example, a state gambling monopoly: https://mstdn.social/@GossiTheDog@cyberplace.social/11701780... The attacker only has to get lucky once

Re: Online ad giant Adform was hacked, proving once again why ad blockers are needed

#77

Post by BLKNSLVR »

CM30 wrote: post #67

It's definitely proof that dynamic ads added via an external script library are a massive security risk, that's for sure. Even if the provider doesn't actually get hacked like Adform here, you're still banking on them being able to reject/filter out malware and malicious ads, which plenty of 'credible' networks seem completely unable or unwilling to do. Going online without an adblocker just feels like playing with f…

Google can't do it, with their resources.

If Google can't do it, no one can. Unless Google don't care enough, but even in that case, why would anyone else bother if the consequences cost less than the monitoring?

As far as I can tell right now, the consequences cost nothing.

Re: Online ad giant Adform was hacked, proving once again why ad blockers are needed

#79

Post by giancarlostoro »

veeti wrote: post #76
giancarlostoro wrote: post #60

Earlier quoted context omitted.

The bitcoin wallet swap thing that these malware scripts often push, how effective is it? It just seems so niche, if I'm doing stuff with my crypto wallet, I'm more likely to do it from my phone where I wont be copying and pasting to and from a web browser, maybe a webview if anything? I always double check the characters match up anyway... I am just shocked the level of effort for the most niche hack.

It sounds a little implausible at first, but Adform serves like a billion views on European consumer websites. For example, a state gambling monopoly: https://mstdn.social/@GossiTheDog@cyberplace.social/11701780... The attacker only has to get lucky once

Dang. That is wild, it seems like such a blatantly simple exploit, makes sense then.

Re: Online ad giant Adform was hacked, proving once again why ad blockers are needed

#80

Post by BLKNSLVR »

WarmWash wrote: post #44

The discussion around Ad blocking is, while definitely a needed discussion, is so rife with confusion, dishonesty and and self-serving ideology that we are going to kill the internet while being absolutely 100% sure that never giving compensation for value did not do any damage or play any part in making the internet suck.

I'm willing to go down that road to see where it ends up.
Post reply on HN