Stealing sensitive information by using pixels of ad banners

http://boingboing.net/2016/12/07/for-two-years-criminals-stole.html

by shandor • 10 years ago

6 5 10 years ago

devoply2• 10 years ago

It's not that clever even. It's quite awesome that someone can go in there without any knowledge of the situation and figure this stuff out though. But writing the original code is trivial. The idea seems trivial too. They should have used stenography if they did not.

shandor• 10 years ago

Yeah, but actually the easier the exploit the more concerning this kind of stuff is. I mean if we can't even trump the easy stuff, how about the more sophisticated attacks?

devoply2• 10 years ago

Well yeah that's the interesting part the exploit is simple, but finding it is difficult. Which is very interesting. It's like the intelligence problem. Where hard stuff is easier than the simple stuff. I guess in the future we will scan for whether the js file is trying to read any other file which should put a stop to this sort of thing.

grx• 10 years ago

These networks aggressively scan advertisers' javascript for suspicious code

How is Javascript that (a) reads parts of a binary file to build a new routine or (b) does silent redirects to TinyUrl NOT suspicious?! What are they looking for in these cases?

ephextom• 10 years ago

Recent discussion: https://news.ycombinator.com/item?id=13129029

Stealing sensitive information by using pixels of ad banners

Related Stories