Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google Says 5% of Visitors to Its Sites Have Ad Injectors Installed

techcrunch.com

Post reply on HN
Print view View original

121–130 of 156 posts

Re: Google Says 5% of Visitors to Its Sites Have Ad Injectors Installed

#121

Post by jacquesm »

vbcr wrote: post #78
jacquesm wrote: post #44

Earlier quoted context omitted.

HTTPS will keep out injection during transit from the server to your computer. But it will do absolutely nothing against toolbars and other browser extensions and that is what this article is about so at a guess the 5% is on top of injection in transit.

Why does the browser even allow any toolbar/extension to modify the content that was delivered on a HTTPS connection. Isn't the data that is delivered over HTTPS pristine that it should not be modified at the browser endpoint by the browser. I am a layman in security and do not understand a lot of this. May be I missed something here. Is my question correct?

Not all HTTPS connections are to your bank.

You're probably reading this page using https and there are quite a few extensions to modify the look and feel of hackernews.

Changing on-page content is just about the only reason extensions exist in the first place. Without that you could retire just about all of them.

Re: Google Says 5% of Visitors to Its Sites Have Ad Injectors Installed

#122

Post by epel »

vbcr wrote: post #78
jacquesm wrote: post #44

Earlier quoted context omitted.

HTTPS will keep out injection during transit from the server to your computer. But it will do absolutely nothing against toolbars and other browser extensions and that is what this article is about so at a guess the 5% is on top of injection in transit.

Why does the browser even allow any toolbar/extension to modify the content that was delivered on a HTTPS connection. Isn't the data that is delivered over HTTPS pristine that it should not be modified at the browser endpoint by the browser. I am a layman in security and do not understand a lot of this. May be I missed something here. Is my question correct?

Extensions MUST be able to modify content. Think about noscript or adblock - if ads were served over https, and you were not allowed or could not technically block them? If analytics trackers were all over HTTPS and can't be blocked or disabled?

Re: Google Says 5% of Visitors to Its Sites Have Ad Injectors Installed

#123

Post by jacquesm »

TeMPOraL wrote: post #120
jacquesm wrote: post #113

Earlier quoted context omitted.

You answered your own question: > It just limits apps interactions with each other and the OS environment. That makes a whole slew of modifications and tricks harder and/or impossible without having access to the sourcecode of the software, which is (on windows at least) not rare at all. Any kind of interaction not explicitly allowed is then forbidden and the sandboxing will be a lot harder to overcome than two apps…

Exactly this. I still remember the times when if I needed to change something in an application, I could just write to its process memory directly. Those were fun times... What I want is to retain the ability to repurpose the software on my terms . To move data in and out of the software whether software's authors like it or not. It's becoming harder each day, as more and more tools move to the cloud and turn into ap…

I really hope not to see that day. So, how to avoid it and not be open to security issues like these?

It used to be that you could get a lot of use out of a computer all by itself, nowadays that's changed and the trend to 'always on, always online' translates into having your machine potentially under attack 24/7.

Being vigilant against enabling the war on general purpose computation is very good, it is the biggest threat in the longer term and one of the reasons why I think that all these large silos are a very bad development.

I don't think we have much to fear from the 'professionalization of programming', not if the kind of code I see on a daily basis is anything to go by ;)

There have been numerous attempts at slapping a gateway on the ability to write software for the hardware that you already own, the only environment where this has taken hold is on mobile platforms, I sincerely hope that that is a development that we will sooner or later be able to revert.

But in order to revert it you'd have to come up with a solution for the pandemonium that would ensue if everybody and their brother would use the likes of 'download.com' or some equivalent to install their software from. Maybe something along the lines of apt-get for phones would be a starting point.

Re: Google Says 5% of Visitors to Its Sites Have Ad Injectors Installed

#124

Post by TazeTSchnitzel »

hellbanner wrote: post #63

I googled for "Open Office download" on a family's computer and went with the first download -- download.com or cnet, I think. It downloaded very fast and I thought "well, maybe it's just an initializer that torrents the rest". NOPE. Within 30 seconds of the installer, it prompted to install an ad-bar in the browser. I quickly closed and researched for the official site. It was scary, being a technical professional,…

Off-topic, but: these days you should probably use LibreOffice, since most developers jumped ship to the fork and it's seen considerable improvements OpenOffice.org hasn't.

Re: Google Says 5% of Visitors to Its Sites Have Ad Injectors Installed

#125

Post by Sir_Cmpwn »

jfuhrman wrote: post #48
jacquesm wrote: post #2

You can't trust anybody except for open source repositories. The easiest way to get such trash on your computer is installing software from a commercial vendor. Oracle is one major source of headache, if you aren't careful you'll find your 'java' install also gives you a severe case of malware/crapware. There are whole companies dedicated to this concept of piggy-backing junk.

Open source isn't some magical protection. Even with being a much smaller target, there have been malware on Linux repos. Example on Gentoo(ignore the over the top headline): http://www.zdnet.com/article/linux-infection-proves-windows-... Not to mention that the repos themselves have been having security issues over the years.

Gentoo is hardly a server-ready operating system. Find similar stories on Debian or CentOS instead?

Re: Google Says 5% of Visitors to Its Sites Have Ad Injectors Installed

#126

Post by sandinmyjoints »

AgentME wrote: post #93
Someone1234 wrote: post #27

If you turn on CSP reporting for your web-site you'll see a LOT of reports about attempted script injection into your site. When you research it you'll find that these come from malware/extensions which are pushing ad content and other nonsense.

Similarly, if you have a site set up to make an ajax connection back to your server whenever an uncaught javascript exception happens (protip: if you do this, make sure to throttle it, or else if you push a bad update that makes users' browsers get stuck in a loop throwing errors, they will all try their damnedest to DDOS you!), then it's very easy for most of the reported errors to not actually originate from your s…

I also have wondered why this isn't talked about more often. We see an unbelievable amount of garbage from catching uncaught client-side errors.

Re: Google Says 5% of Visitors to Its Sites Have Ad Injectors Installed

#127

Post by killwhitey »

jfuhrman wrote: post #43
ceejayoz wrote: post #21

Earlier quoted context omitted.

Your rant is outdated. This is what "download firefox" looks like now: http://i.imgur.com/dG7wONC.png

There are still lot of Google ads on download sites that are extremely misleading and look like download buttons. http://blog.malwarebytes.org/wp-content/uploads/2012/10/Ad8.... As I wrote in another comment, even YCombinator invested in a bundleware company and PG defended it, so I guess the problem is deep rooted. https://news.ycombinator.com/item?id=9283176

A good illustration of how difficult it can be to download software if you're not well trained to spot ads: https://i.imgur.com/0vPdDYU.png

Re: Google Says 5% of Visitors to Its Sites Have Ad Injectors Installed

#128

Post by codeflo »

chatmasta wrote: post #66
fragsworth wrote: post #50

Earlier quoted context omitted.

It's definitely the people who are least inclined to install an ad blocker that could use it most. On the other hand, it takes a long time, but they do learn to be more cynical about the Internet if they're exposed to its raw state.

It takes less than sixty seconds and requires nothing more than installing a browser extension.

There's a lot of crapware disguising as adblockers that unsophisticated users can fall for...

Re: Google Says 5% of Visitors to Its Sites Have Ad Injectors Installed

#129

Post by [deleted] »

gergo_v wrote: post #55
anon1385 wrote: post #10

Well maybe they should stop allowing download sites that offer ad infected downloads to buy the top spots on the google search results page? https://i.imgur.com/Ote9c2k.png Adwords is probably one of the main infection vectors for malware these days. Previous rant: https://news.ycombinator.com/item?id=8879229

They've apparently updated their adwords policy regarding this. Now it's a matter of enforcement: http://ipensatori.com/2015/03/20/google-update-to-software-d...

[deleted]

Re: Google Says 5% of Visitors to Its Sites Have Ad Injectors Installed

#130

Post by kkamperschroer »

I'm a Chrome extension author and I've been contacted at least a half-dozen times by shady companies that want me to add some "totally unobtrusive" ad-injection javascript into my extension.

I've been told I could make $0.50/user based in the US per month. That would be a nice raise, for sure, but I'm not the type of person willing to sell out my users to make a little extra dough. Plus I am a user of my own extension, and I don't want ad-injection. And how long could one possibly retain users once you start injecting ads? Probably a steady decline until your left with the users that don't know where the ads are coming from.

Selfish plug to my extension here: https://chrome.google.com/webstore/detail/musicality-music-p...

Post reply on HN