Hacker News Reader

Comment by 0x0 | Hacker News Reader

Also, browser exploits. Blocking ads make sense as a decent antivirus strategy.

I have never had any virus despite not running antivirus, occasional visits to the seedy underbelly of the web, and often having ad block disabled or not even installed. Nor do I remember anyone I know being infected without being tricked into installing something.

When was the last time a browser vulnerability was actively exploited at any significant scale?

So I can't shake the feeling this is really more of a post-hoc rationalisation for people not entirely comfortable to screw over creators in the rather selfish pursuit of personal comfort.

A couple of years ago, a fairly well known Norwegian news outlet's ad network was hacked, and visitors were served malicious code. If the user had Java installed the code would use a 0-day exploit to _silently and without any user intervention_ install a trojan which would activate when the user later visited the online bank of by far the most common bank here in Norway.

It would then redirect money by modifying the target bank account when the user paid bills or whatnot. The web page looked entirely as it should, it would just modify the request before it got sent.

Now, the user had to have Java installed you might say, so not a big deal. Well, big deal, because the same bank, the most popular one, _required_ Java for signing in to their online bank.

Fortunately the breach was noticed fairly quickly and the harm was limited. But after that I decided no more ads.

Do you happen to have the link for a report for that incident?

This is the exploit that was used:

http://www.deependresearch.org/2012/08/java-7-0-day-vulnerab...

Trying to find the original article I read, the bookmark I had no longer works :(

Said bank has since moved away from Java to a JavaScript solution for their two-factor login.

But yeah, the main problem with ads is that the ones displaying ads have no idea what they're sending to their users.

If you run no AV, how would you know if you were infected?

If the disease doesn't have any symptoms, why care at all?

It's not uncommon for compromised computers to be used as nodes in DDOS-for-hire networks, (though compromised IoT devices seem to be in vogue at the moment) proxies for ne'er-do-wells, sending spam, and other activities that might not be apparent to the user of the computer in the slightest, but still have effects that reach out to the world at large.

Look up Typhoid Mary, please.

do you vaccinate yourself or your children?

There is a list of examples on the wikipedia article for the subject https://en.m.wikipedia.org/wiki/Malvertising

Reply on news.ycombinator.com