Major sites including New York Times and BBC hit by 'ransomware' malvertising

http://www.theguardian.com/technology/2016/mar/16/major-sites-new-york-times-bbc-ransomware-malvertising

by oneeyedpigeon • 10 years ago

162 83 10 years ago

Rainymood• 10 years ago

Another good reason to use ad-blockers. If I can't use your site with an ad-blocker then bye bye ... looking at you Forbes.

oneeyedpigeon6• 10 years ago

I wonder why The Guardian isn't (at the time of writing) allowing comments on that article. Could it be because their business model has an over-reliance on people not using ad-blockers?

philk10• 10 years ago

maybe because it's an article and they usually only have comments on Opinion pieces?

CM30• 10 years ago

Probably because the comments would make them look bad. That seems the general reason for a Guardian article having/not having comments. If they think the userbase are likely to agree with the writer they'll be on, and if they think the userbase is likely to eviscorate them (or in cases like this, talk about adblockers and stuff), then they'll turn them off.

tallanvor• 10 years ago

Yes. It's funny how more and more sites act like it's morally wrong to block ads, but obviously aren't willing to do the work to protect their visitors from this sort of thing.

JorgeGT2• 10 years ago

They could deal with advertisers themselves and manually approve and display text/image ads from their own domain (as it was done in printed newspapers), but isn't it easier to just leave a div+javascript and have the right of arbitrary code execution in a chunk of your page get auctioned off to the highest bidder by several shady ad network?

Just go to www.bbc.com and look at what domains your ad-blocker denies: edigitalsurvey.com, chartbeat.com, googletagservices.com, scorecardresearch.com, effectivemeasure.net, iperceptions.com, krxd.net, optimizely.com... now imagine if your printed newspaper shot at you a GPS receiver with a mic, a cam, etc. Surely it wouldn't be morally wrong to duck and avoid that bug?

mpclark2• 10 years ago

In mitigation I run a smallish B2B news site and I only run ads we've sold direct (and vetted) and Google Adsense to fill some of the unsold inventory. However, I found out not too long ago that Adsense now throws stuff from literally hundreds of ad networks at its clients, which is definitely not what I expected when I signed up all those years ago. I've had to go in and manually turn them off, and will soon be turning off Adsense altogether. I'm not seeking to maximise my display advertising revenue though, as I've observed it usually comes at the expense of irritating readers.

eli• 10 years ago

Not everyone has the ability or desire to personally sell ads. I think it's pretty cool that today you can earn maybe $1000/mo with a moderately popular website you run yourself.

e40• 10 years ago

If I can't use your site with an ad-blocker then bye bye ... looking at you Forbes.

I can use it with uBlock Origin and the 3rd-party filter "Anti-Adblock Killer | Reek‎" turned on.

parennoob• 10 years ago

I know I can do this, but

a) I like to limit the number of random extension I install on my browser.

b) The fact that Forbes turned on an adblock-blocker shows me that they are seeing a significant revenue hit on account of adblocking, which will force them to do paywalled content sooner or later. I don't value Forbes content that much (in fact, it's often click-baity), so I'd like to wean myself off it sooner rather than later.

thinkcontext• 10 years ago

NYT just today pushed me to whitelist them on detecting adblocking.

sxcurry• 10 years ago

Fortunately, missing the Forbes site isn't a loss - might even be a positive in terms of information content!

teaneedz• 10 years ago

Yep. I haven't even attempted to click on a Forbes link (shared, or recommended) in ages. Any site that still serves interstitials also gets promptly sent to the pits of despair or dev/null.

oneeyedpigeon6• 10 years ago

Shocking that the BBC is affected by this, given that it should be advertising-free. Presumably, this affected non-UK residents[1], but as a public service the BBC should have much higher standards when it comes to advertising.

[1] With the obvious caveat that a website can't reliably determine that.

tfm2• 10 years ago

Aren't all world-facing websites "a public service"? BBC within UK has a special remit because of the funding structure (thanks to the increasingly-inaccurately named "TV" licensing fees), but BBC [Worldwide] is just another content provider in the big old crazy world.

It doesn't seem surprising that BBCW use an external advertising network: it would be a pretty huge investment to operate their own advertising markets throughout the world ... and surely if they did, they'd then on-sell those services!

Seems that the notable part of this attack is that several high-profile websites were affected, so BBC (and NYT, and AOL, etc) suffered some damage to their brand, so they'll have to work on that. The article notes that "malware was delivered through multiple ad networks", which speaks to failures by those service providers. Reckon there will be some very heated conversations and perhaps fee renegotiations with the networks happening over the next few weeks ;-)

oneeyedpigeon6• 10 years ago

it would be a pretty huge investment to operate their own advertising markets throughout the world

It is becoming clearer and clearer to me that this is one of possibly two options left for businesses wishing to make money online via advertising. Self-hosted adverts are probably the best way to regain trust and circumvent ad-blockers. A quality, trustworthy third-party network is the only other possible option I can imagine, but that seems far less viable.

DanBC• 10 years ago

The BBC has adverts for people geo-located outside the UK.

http://www.bbc.co.uk/bbc.com/faq/

You will have noticed that the BBC website features a limited amount of advertising when viewed from outside the UK.

There's a bunch of people outside the UK who use BBC content and who want a way to pay the BBC. It's a shame the BBC uses ads (which are pretty horrible) rather than working out a better payment (or even micro payment) system. The BBC said this in 2014:

Can I pay a subscription to view the site without ads?
We're unable to provide a subscription service at the moment but will be able to do so in the future. As soon as the service is ready we'll communicate it to all our international users.

jkot• 10 years ago

Adblocking is immoral, but malware filtering is not :-)

LeoNatan25• 10 years ago

Ad blocking is indeed very much moral.

cm21874• 10 years ago

One more example of why users should have:

- an adblocker

- javascript disabled

- addins disabled (click to play)

reustle2• 10 years ago

Javascript disabled? Might as well be using Lynx :)

ddmf• 10 years ago

"Ahh, this html is far too new and fiddly. Imma going back to Gopher."

SixSigma2• 10 years ago

I run NoScript. I don't think my experience is worse.

I use browsers at Uni without it and get the full experience of autoloading video, flashing ads etc. and think "how do people live with this crap"

makecheck• 10 years ago

I wonder how much JavaScript is only being used to produce a small number of common effects. In other words, how necessary is it really for sites to execute arbitrary code?

Maybe we have reached the point where browsers should implement the top 10-20 effects in standard ways (that of course the user can choose to override). That would make it feasible for many web sites to avoid JavaScript entirely and still produce the effects they want, and let us move away from this “execute arbitrary remote code by default” aspect of web pages.

oneeyedpigeon6• 10 years ago

HTML5 has been going in exactly this direction re: form inputs (@autofocus, @required) but, yes, I agree that it would be nice to extend that to, for example, some of the core ui interactions present in frameworks such as bootstrap.

Raphmedia• 10 years ago

We can already do a bunch of effects that used to be done with JS using CSS alone (transition, animations, etc.).

Most of the JS that we do on websites those days is really helpful for the end user and are the result of the recommendation of UX specialists. (form management, navigational help, async loading of content, preloading content, front-end browser geolocalisation, better responsive for mobile, etc.)

unsignedqword• 10 years ago

If you're on Windows, having EMET and/or MBAE are also good ideas.

pmlnr• 10 years ago

I don't like the no JS approach, it kills an important part of the potential in the web, including polyfills for things like srcset.

Instead, I'm using Policeman ( https://addons.mozilla.org/en-US/firefox/addon/policeman/; similar to uMatrix https://github.com/gorhill/uMatrix/releases, but the first is easier to use for me ) which blocks 3rd party anything by default.

If they serve their own JS from their own servers, let it be. Others (Facebook connect, GAnalytics an Twitter seems to be _everywhere_): walk away.

This obviously renders most of the sites to bare HTML due to the excessive and unneeded use of CDNs, and is a massive pain to use for the first weeks, but after a while the whitelist gets you to a friendly web level.

uBlock also runs in the background, just in case things leak through, or I quickly want to check something and I need to turn Policeman off.

0xffff2• 10 years ago

FYI, the first link is broken because the semicolon was included as part of the hyperlink. Should have been https://addons.mozilla.org/en-US/firefox/addon/policeman/

nkrisc• 10 years ago

If you use a modern browser you probably don't need the polyfills anyway, so why are you concerned about blocking them?

While not necessarily related to privacy, I've found sites where blocking self-served JS creates a better browsing experience because it gets rid of annoying effects and things like scrolljacking.

bakhy• 10 years ago

an example of the power of phrasing in journalism, perhaps? the title could have also been: "Reckless media sites serve malware to visitors".

ta0967• 10 years ago

Major sites including New York Times and BBC caught peddling 'ransomware' malvertising?

cafard• 10 years ago

Yes, I tried to get around the WSJ paywall for the WeLive article and some crummy site tried to hit me with a beastie.

tyingq• 10 years ago

BBC's ads appear to come from Google's ad network. I'm curious how much effort Google puts into monitoring/policing the landing urls for this sort of thing.

rwestergren• 10 years ago

Interesting to note that a number of these sites were recently also serving ads vulnerable to XSS: http://randywestergren.com/widespread-xss-vulnerabilities-ad...

mdip3• 10 years ago

Sadly, I've always considered adblocking software a form of security software rather than a mere convenience. Years ago I had to remove a mess of malware from my parent's PC due to a malvertisement received via MSN[1]. Since that point I've installed privoxy and uBlock Origin or similar on all PCs that I am asked to help with.

Despite all of the talk about "blocking the ad blockers", I've yet to receive a phone call from anyone saying this or another web site didn't work, "Can you fix it?" I'm guessing their usage is limited enough that they don't encounter it (my dad does visit Forbes, but I haven't heard complaints).

There's no way I'd surf the internet these days without ad blocking enabled and I rarely white-list sites out of concern for my data. It's becoming as important as personal firewalls / antivirus once were.

[1] There was a brief period during the time that they received the malware that MSN had been hit by malvertizing and they had that as their homepage, but it could have come from elsewhere. The bottom line was that there were no sites in the riskier categories that were in their browsing history and my parent's proficiency does not include a good understanding of "incognito browsing".

jlarocco• 10 years ago

uBlock Origin, or some of its filters, can block whatever mechanism sites use to detect blocking.

A while back I had a few sites warn me about ad-block, but I haven't seen it in a while.

mdip3• 10 years ago

I just switched back to that, actually. Months ago, my default browser was Firefox Developer Edition and uBlock Origin had a bug related to LastPass that caused LastPass to hang the browser so I had switched to ABP.

Unfortunately, LastPass started acting up in FireFox a few weeks ago and I decided to give in to Chrome, again, so I've happily returned to uBO.

I go back and forth on which to install for people that routinely come to me for help (I'm a developer, not a helpdesk, dammit!). I'm not sure if it's still the case, but months ago I actually did receive a call from my father when he attempted to install an open-source PDF creation tool that he uses at work on his home PC. It was hosted by SourceForge which uBlock had large swaths of in its blacklist. The installer did contain a bull$#*+ toolbar (several, actually), but he's familiar with avoiding crapware directly placed within installers (and to avoid "Express Installations").

euyyn• 10 years ago

I've yet to receive a phone call from anyone saying this or another web site didn't work, "Can you fix it?"

Doesn't mean it's not happening. Maybe people assume the specific page is just broken.

mdip3• 10 years ago

Exactly.

I'll get a phone call every time when a piece of crapware causes videos to play on Google's normally spartan search page, or ransomware is asking for "... something called a 'Bitcoin'? I don't remember installing a 'Bitcoin'."

They don't bother calling when one of the thirty places they get news from stops working.

NelsonMinar• 10 years ago

This kind of exploit is going to keep happening. The most egregious cases involve PageFair, which offers a tool to publishers that circumvents ad blockers. They too have served malware, for instance at The Economist. http://www.theverge.com/2015/11/6/9681124/pagefair-economist...

Sometimes I think we ought to have civil liability for software security. A few lawsuits would shut stuff like PageFair down.

xphilter• 10 years ago

I agree--but the issue will likely be traceability. That is, how can the victim prove that the malware they received came from PageFair? Unless the victim had a log of all network traffic, I'm not sure there's any way to show that.

leggomylibro• 10 years ago

It would be nice if the sites themselves took some responsibility. If your ad contract includes strong SLAs with massive penalties for malware distribution, the company providing you with ads will probably take a bit more time to vet them.

It baffles me that that isn't already boilerplate in advertising contracts. Sites whine about having their revenue impacted by ad blockers, but they make no effort to ensure the security of their users. Why is nobody ever held accountable for these sorts of breaches? Shifting risk to your customer is a horrible idea - nobody would buy a new car without a warranty, so why on earth are we expected to play Russian roulette with our bank accounts, personal data, and often our employer's assets?

I guess the market will teach them sooner or later, but I really do not understand why the current state of ads is so widely accepted by the people who are trying to sell them.

thephyber• 10 years ago

It seems like a circular argument you're having with the parent, but you haven't yet realized it.

The profit motive is the ultimate incentive. If it takes too much time, reduces revenue by too much, or increases expenses, the ad publishers and networks will find ways to mitigate those issues.

If there aren't waves of lawsuits from users who received malware from ads, there is no direct cost. If vetting ads before they are hosted costs money or reduces the bids for those ad placements, networks are incentivized against doing so.

In my experience, most ad networks have blacklists for bad actors but no vetting and thus no whitelists. Blacklisting means there necessarily will be end-users that get infected and only a percentage of them will know it, a percentage of those will know where it came from, a percentage of them will report it, and only a percentage of those reports will culminate in advertiser blacklists.

It's a numbers game and currently the expenses from lawsuits (the only perceived expense for publishers+networks) is much less than the revenue lost + expenses from pre-vetting all ads before they are used.

code777777• 10 years ago

Agreed. I did see a few "disable your ad-blocker or you can't use our website" notices a couple months back but haven't seen one since.

It would be interesting to see what happened to their numbers. I imagine they alienated a lot of users by doing that and had to stop.

At my company we have an initiative to roll an ad-blocker out to about 2,500 desktops just to prevent the clean-up costs and improve user experience while using our own white lists. Given our industry, we just can't risk it even with threat management firewalls, OpenDNS Umbrella, and some well-engineered multi-layer security going on.

The disappointing thing for me is that I appreciate well-placed and curated ads. I white list some sites to support them, etc.

It's the websites the remind me of the sort of silliness in the movie Idiocracy [1] are impossible to use, not to mention trust with your computer.

[1] https://filmdump.files.wordpress.com/2013/06/idiocracy-1.jpe...

PhasmaFelis• 10 years ago

It's weird to me that we keep treating the sites that run malvertising as victims instead of fully complicit. If the print edition of the New York Times ran, say, a full-page ad for the KKK,* and responded to the outrage with "haha, sorry, we outsourced our advertising to a third party with no oversight," they'd be crucified. But somehow websites are exempt from responsibility for the things that they publish.

Has anyone proposed getting sites that serve e.g. ransomware to pay the ransoms for everyone affected? That seems entirely reasonable.

*Or insert your own offensive ad concept here.

bphogan2• 10 years ago

I was wondering how long this would take.

One of the things I've long known as a programmer for the web is that when you let a third party put content on your web site, you don't have control over what they do.

Whether it's a person entering content and you fail to sanitize it, or pulling in ads from an external network, the end result is that you get something like this eventually.

I don't have a solution, really, because nobody wants to pay for content, so sites have to use ad networks. But I'm surprised this hasn't happened much sooner.

emodendroket3• 10 years ago

What are you talking about? This is far from the first time malicious software has been delivered through advertising.

bphogan2• 10 years ago

Ransomeware on the NFL or NYT website has been done before?

delinka• 10 years ago

If it's not served from the domain I've visited, I don't want it. If it is served from the domain I've visited but not over SSL, I don't want it. Then the certificate owner should be responsible for any damage resulting from the stuff signed by their key.

matt_wulfeck2• 10 years ago

This gets tricky with things like imbedded youtube and twitter content. I would be right with you blocking content not from the same domain, but I will constantly be clicking off page to watch a video or view a tweet, etc.

CaptSpify3• 10 years ago

IMO: Those should just be offsite links anyway. I personally hate watching youtube videos shrunk down to fit in a small blog-column. YMMV, of course

matt_wulfeck2• 10 years ago

The vector of attack, through compromised ad networks, will also serve to inflame the debate around adblockers.

This is the largest reason I install adblockers on my own laptop and phone as well as everyone in my family. I allow zero exceptions for ads. I'm willing to pay for content via other means (for example google contributor), but attack surface is simply too large.

delecti• 10 years ago

I actually use adblockers on my phones for a different reason. On my phone I'm reasonably sure I won't be affected by malware (up to date Nexus and I know not to install unknown applications), but ads take up data and slow down browsing.

ufmace• 10 years ago

Whenever I read stuff like this, I first wonder if my setup would be vulnerable to the attack, and if not, how much stuff I would have to turn off to be vulnerable? Chrome Stable + uBlock Origin + plugins disabled by default seems to be safe from everything but targeted zero-days. At least, I hope.

rewrew• 10 years ago

A lot of this has to do with these sites using ad networks instead of/along with selling ads directly. Ad networks are very common with consumer sites, but many B2B sites don't use any at all. When you work directly with the agency or company (and you know they're a real agency or company), this doesn't happen.

Geekette• 10 years ago

I hope AdBlock (and/or similar) works out a deal with respective companies involved (Mozilla, Apple, etc) in order to be pre-installed in future downloads of major web browsers. In addition to visual chaos and privacy concerns, the risk of compromised systems due to malware via ads is too damn high and non-tech savvy users shouldn't have to suffer for it.

Major sites including New York Times and BBC hit by 'ransomware' malvertising

Related Stories