Print

Please login or register.
1 Hour 1 Day 1 Week 1 Month Forever
Login with username, password and session length

[guest]

...which describes how adverts in a browser can subvert your machine.

https://blog.malwarebytes.org/malvertising-2/2015/10/angler-exploit-kit-blasts-daily-mail-visitors-via-malvertising/

The salient point to note is that the ads being served are bid for in real time. Probably wouldn't cost much to push some malware onto the Daily Mail (which is sort of malware itself ) in the wee small hours. Likewise you could target a specific group...read on

I find it of interest as I was wondering how something similar happened to me with the ITV Player while watching Scotland v South Africa (rugby) & its nice to see it dissected into simple graphics.

Basically I don't have Flash on any machine (but its a part of various IE builds) so I enabled ActiveX/Flash in order that the ITV Player would work, watched the match, came back to the machine 30 minutes later & immediately wondered why the machine was hammering the disks. Pulled the network cable (never power-down first) & saw a whole lot of TCP connections to places like Moldova. Machine wiped & restored - thankfully this is a lot faster than it used to be.

Went past Eset AV at the time - turns out its the zero-day Flash vuln which still isn't patched by Adobe (MS will have to patch theirs too AFAIK) so make sure you have your AV updates in place.

I would STRONGLY recommend that you uninstall Adobe Flash if you have it installed. You do not need it in most cases - the beeb's iplayer will work with html5 now so get rid of it. Didn't help me (unlucky I think as it affected MS's version of the plugin) but its increasingly obvious that Adobe <anything> is a bit of a security nightmare and Flash is best taken around the back of the shed & shot.

[renluop]

.

I would STRONGLY recommend that you uninstall Adobe Flash if you have it installed. You do not need it in most cases - the beeb's iplayer will work with html5 now so get rid of it. Didn't help me (unlucky I think as it affected MS's version of the plugin) but its increasingly obvious that Adobe <anything> is a bit of a security nightmare and Flash is best taken around the back of the shed & shot.

In Chrome I have it set so I have to approve opening Flash for each page. That can be a bind, so unless there is a permanent alternative, what is the average punter to do? For PDF viewing I use another option.

[guest]

I don't really know - get infected is most likely

The ONLY place Flash exists here is in IE11 and you can't do anything other than enable it as I did for ITV Player which requires it. The ads served up before the video feed of the game wouldn't run unless ActiveX was unfiltered (thanks ITV) and the first two adverts had a "Skip" button which in retrospect is odd and was likely the injection vector.

We live and learn.

[guest]

I decided that IE11 is too much of a security risk given MS's "update trojans" so I removed it. Flash no longer exists here.

Also had a clear-out of crud like Windows Media Centre - I use VLC so why bother with WMC as its just another attack vector? Likewise XPS stuff (never use it) and Work Folders (no idea what they are, definitely don't use them). Very few checkboxes left selected on the "Windows Features" box and a lot of useless services removed.

[guest]

Oh and for those who still use it, Adobe patched the zero-day vuln which got me on 16/10/15.

It affects standalone versions of Flash for Windows (all versions), Linux (all versions) and Mac (all versions). It also affects plugins for Chrome (all versions), IE (all versions) & Edge (latest version).

There are just going to be more & more of these exploits (its clear some have been in the wild for years, many exploited by govt agencies) so IMHO the sensible thing to do is bin Flash completely. Likewise bin IE - when even the manufacturer of the software says that its verging on "unmaintainable" then its time for it to die now.

[loonylion]

I find it somewhat annoying that IE/chrome have built in flash. I would much prefer to have the option to not have any trace of flash on my computer at all; it's a security breach waiting to happen.

[Chrysalis]

rizla do you know what site was the source? as simply having a bad version of the software installed isnt enough, you must have loaded infected flash content as well.

Most of the vulnerabilities flash related seem to be spread by advertisers.

Oh and I do agree, the sooner flash dies the better, sadly I still need to use it as is services I use that require flash.

[guest]

itv.com was the source, the time was around 16:30 on 3/10/15 and it was a Flash advert prior to the video feed (ie just before Scotland v SA, as said in the original post ). I don't know who the real malvertiser was (Moldovan probably given the connections seen later) but it came via itv.com.

Loonylion, you can remove IE depending on your version of Windows - Control Panel->Programs & Features->Turn Windows Features On & Off then uncheck the box for Internet Explorer, click through the dire warnings designed induce FUD and reboot. No more Flash player although I have no doubt IE still lurks somewhere in the bowels of ths OS

If you don't have that option then (from memory) you check the "ActiveX filtering" option then go into add-ons->all add-ons and disable Flash player. That's about the best you can do.

I have no idea about Chrome, frankly I trust MS more than google but its six of one half dozen of the other in terms of which one hands over more data to the US govt. A pox on them both

All the major browsers have "issues" for me these days :

1) Internet Explorer - huge pile of exploits waiting to be found, even MS admit its not maintainable. ActiveX has been a security disaster since day 1;
2) Chrome - its google & if you trust them then you have more problems than browser choice. Enough said;
3) Firefox - current build works fine, not too keen on the deprecation of XUL as it'll kill a lot of extensions. Not the quickest of browsers to say the least.

I guess I'll stick with Firefox + Adblock Plus + NoScript - never got hit by anything nasty with that before. Apart from kids downloading "questionable software/music" and overriding the AV (long ago) then everything nasty that's actually got onto machines/network has come via IE.

[guest]

Having seen that eldest daughter has installed Chrome to get past my block on Flash in IE - specifically for the BBC (who need to deprecate Flash NOW) where you can't watch anything live on iplayer unless you use Flash.

You have to wonder really - a multi-billion pound monopoly, entwined with the state since 1939, backed by jail time if you don't pay them hasn't noticed the exploits used by other nation states with Flash over the last 5 years of wiki/whatever leaks? Bless

[Weaver]

The iOS BBC iPlayer app works well, and of course no danger of any Flash on the iPad.

Alternatively, what about installing a VM and running Flash inside that VM?

[guest]

The iOS BBC iPlayer app works well, and of course no danger of any Flash on the iPad.

Alternatively, what about installing a VM and running Flash inside that VM?

Too much hassle for the dross the BBC puts out. The html5 beta works for on-demand stuff, can't think of anything the BBC shows that I'd want to watch live. The TVCatchup android app will work fine in the exceptionally unlikely event I do want to watch something live & has the added bonus of only showing adverts* which are on the TV stream rather than Flash junk inserted every time you start a stream

*I count the trailers on the BBC as adverts - the BBC has no option other than to pad out the programmes with them anyway as all TV production is based around a maximum 45 minutes of programming with 15 minutes of adverts every hour. If you doubt that then try watching BBC Worldwide That's one of the reasons I've never understood people who say the licence fee is worth the cost for not having adverts - you get the adverts anyway, they're just all for the BBC.

[Chrysalis]

the bbc are just been lazy, they have html5 for mobile devices already.

http://www.engadget.com/2015/09/25/twitch-html5-whisper-twitchcon/

I contacted the bbc to see what their stance is.

[sevenlayermuddle]

Good info Rizla, I have taken your advice, on the Mac at least.  SWMBO can make up her own mind about Windows.

I do find it amusing though....  our 'home' website has quite a few java Applettes that were written yonks ago, and which hardly anybody allows anymore.  But as the rot set in for Java a few years ago the general advice, to keep the website going, was 'convert them all to flash'.  We just never got around to it.  But nice to know that once in a while 'not getting around to it' is proven the write choice,  I may now choose that path more often.   

html5 looks tempting for a rewrite of the Java now.  But will I ever find the time?   

[guest]

OMG you just reminded me that "our" website still has "Pokemon" game applets on it from when eldest daughter was a lot younger.

* rizla suspects the website hasn't been changed in more than a decade

Edit - anyway time to get gubbed by the Aussies I fear.....

[kitz]

Don't the daily mail (like several other media outlets) use Taboola?   
They don't exactly have the best of records when it comes to being exploited.