Third Party Ads Found Serving Malware

[engine]

Third Party Ads Found Serving Malware [bbc.co.uk]

Booby-trapped adverts that hit visitors with fake security software have been discovered on the London Stock Exchange (LSE) website.

Analysis of the LSE site suggests that over the last 90 days, about 363 pages had hosted malware.

The LSE said its site was now safe and an investigation showed that ads provided by a third party were the culprit.

[J_RaD]

malware serving ads are getting pretty popular, some sites you visit you've just got to have your ad blocker on full blast.

the bad guys are going to eventually ruin it for all the honest guys unless something changes.

[piatkow]

Heard of this on other sites too. The bad guys put up some legit ads then swap them for the infected ones. Public blame the publisher not the advertiser or the ad network.

[wyweb]

With all due respect that's been an issue for a while now. The web ain't getting friendlier baby. It's getting downright hostile in some places.

some sites you visit you've just got to have your ad blocker on full blast.

And your AV and your firewall.

[engine]

What's new, I guess is the extent and reach of the problem. I doubt anyone would have thought that the London Stock Exchange site would give them a malware issue.

[thecoalman]

I just had this happen while visiting a local news channel. It minimized the browser so it was hidden behind a dialog box that said something along the lines of "AVG has detected malware and will now perform a security scan".

Clicking cancel maximized the browser and the page loaded an animated .gif that looked like it was scanning for viruses with "My computer" as the background and reported multiple threats.

I can see how people are so easily fooled.

[J_RaD]

Clicking cancel maximized the browser and the page loaded an animated .gif that looked like it was scanning for viruses with "My computer" as the background and reported multiple threats.

yea at that point its hands off keyboard mouse, the only command you should be running is to kill your all your web browser process, then running a full AV scan.

[wyweb]

Ad networks need to be vigilant. Webmasters need to be vigilant.

If I give you space on my website. I am responsible for that. If you get me in trouble though, if you allow creepy people to put trash on my pages that does things to my visitors computer and if they come after me, I'm coming after you. And I'll probably have a pretty good case.

I'll have read every word of your TOS and in most cases printed off a copy of it. If you're an ad network, I mean. I'll pass it off to my attorney when we're going to court because one of my visitors downloaded malware or a virus from an ad you served on my website.

That's never happened but it's not unrealistic that it could.

I can't cite precedent.

Ultimately I should be responsible for the contents of my website. I'm pretty sure if you're renting space and get me in trouble I can pass some of that responsibility your direction as well.

I'd dang sure try anyway.

[martinibuster]

What's new, I guess is the extent and reach of the problem.

It's not new, more extensive or of further reach than previous instances. This happend to the New York Times two years ago. What is curious and notable is that this happened to that sites visitors, including the workers at the website itself, for three months and none of them noticed their computers were infected.

[wyweb]

I like to learn more about this actually. The extent of liability a webmaster is exposed to if this happens especially.

What if I get hacked outright? What if that hacker subjects my visitors to malicious code? Is it enough to show server logs, get my ISP and my host involved? Show steps that I took to fix things?

This happend to the New York Times two years ago

Yes it did. It's happened to numerous companies. What I'm having a hard time doing is finding outcomes of any litigation that may have occured as a result.

Is it like landlord/tenant? I'll rent you a house but if you screw it up I can take you to court? As webmaster I'm landlord. The ad network being tenant?

Somebody take the ball and run with this. If you're putting sites online but letting others have space, and those others inflict damage on your guests, what is your liability?

[piatkow]

Even Microsoft get caught. A friend of mine had her Hotmail session blocked by her firewall because of a compromised ad today.

Of course their byzantine support process doesn't permit the user to attach a screen print to the report.