Malwarebytes Labs, the security firm's research blog, reports on malware, malvertising, ransomware, and Mac exploits found in the wild.
HN cites it as a source on malvertising, such as ad-network abuse on major publishers, and on Mac exploits like the dyld_print_to_file bug.
“You're free to want sites to work without JS, but to be realistic about it, that battle was lost loooong ago.”
Sites should at least work without JavaScript. Or are you saying we should just throw accessibility under the bus?
“It's probably more useful to figure out how to make the all-sites-require-js world more secure and less trackable than to try to turn back the clock 20 years.”
Blocking JavaScript works right now. Or are you saying end users should just patiently wait until these issues affecting them right now are fixed? It’s not like it isn’t happening… consider how many people have been tricked even by something like this¹. My parents are actually pretty new to the Internet, and I’ve made sure that I have them using something like NoScript. Of course, it breaks some sites for them, but that’s far preferable to them accidentally infecting their computer and putting their financial info at risk.
――――――
¹ — https://blog.malwarebytes.org/fraud-scam/2013/07/fbi-ransomware-now-targeting-apples-mac-os-x-users/
I was trying to be polite, not weasly.
https://blog.malwarebytes.org/malvertising-2/2014/09/googles-doubleclick-ad-network-abused-once-again-in-malvertising-attacks/
http://www.mediapost.com/publications/article/247982/google-doubleclick-network-hit-with-more-malvertis.html
http://www.csoonline.com/article/2924309/malware-cybercrime/advertisers-need-to-start-monitoring-ad-security.html
http://readwrite.com/2014/05/15/app-redirects-mobile-spam-ads
I would recommend an air gap, disabling autorun, removing the CD hardware, and any hardware used to connect to the internet. You could also remove any other hardware and uninstall the drivers you don't need such as a webcam.
Here is a good article on the Malwarebytes Anti-malware blog for some recommendations: http://blog.malwarebytes.org/security-threat/2014/04/windows-xp-you-have-served-us-well/
No, they don't actually serve all ads. I imagine they know not to pass off a request from a HTTPS page to a HTTP-only server (mixed-content blocking would give a near-100% failure rate) but here is an example of Google's Doubleclick network being used to spread malware: https://blog.malwarebytes.org/threat-analysis/2014/09/googles-doubleclick-ad-network-abused-once-again-in-malvertising-attacks/
https://www.ghacks.net/feed/
http://krebsonsecurity.com/feed/
http://blog.malwarebytes.org/feed/
http://feeds.arstechnica.com/arstechnica/index/
http://feeds.feedburner.com/dslreports
https://feedproxy.google.com/PetaPixel
http://rss.slashdot.org/Slashdot/slashdotMain
https://spectrum.ieee.org/feeds/topic.rss
https://feedproxy.google.com/PetaPixel
http://bensbargains.net/rss/
This is laughable. If site owners could go to jail every time a 3rd-party code they're not fully responsible for does something bad, they'd all be in jail now.
https://blog.malwarebytes.org/threat-analysis/2015/08/large-malvertising-campaign-takes-on-yahoo/
http://arstechnica.com/security/2016/03/big-name-sites-hit-by-rash-of-malicious-ads-spreading-crypto-ransomware/
Etc.