Online ad giant Adform was hacked, proving once again why ad blockers are needed

Online ad giant Adform was hacked, proving once again why ad blockers are needed(this.weekinsecurity.com)

73 points by speckx 2 hours ago | 8 comments

strictnein 1 hour ago |

Probably should just link to the security researcher's post, since it's far more informative:

https://doublepulsar.com/adform-compromised-to-serve-crypto-...

werds 1 hour ago |

Are the crypto addresses known/recorded anywhere? would be interesting to see on the blockchain how much was stolen this way.

strictnein 1 hour ago | |

The code in question is here: https://pastebin.com/raw/mc7psaNF

It appears to be normal Adform code plus two appended chunks at the end.

   Bitcoin: bc1qmplgt0hcg62jc2guz86wn2sms7tqrsulkkrrls
   Ethereum: 0xE7983E69df17079ADb0aD7b3458488Cac0dBc573
   TRON: TW4AgGnDc2Pk6YAynCtjCKzoKYWPg7nJe (?)

Edit: Activity for those addresses:

~$110k bitcoin

https://www.blockchain.com/explorer/addresses/btc/bc1qmplgt0...

~$55k in ETH

https://www.blockchain.com/explorer/addresses/eth/0xE7983E69...

tamimio 1 hour ago |

Ad blockers at dns level too, not just browsers. A lot of people don’t even know how to block them, check your parents or kids (or non technical people in general) phone and you will see how they are riddled with ads. I had a dns blocker installed on my parents phones and in around 6hrs it blocked 10k queries from 3 apps only..

binaryturtle 29 minutes ago | |

I personally also block access by web browsers to non-standard ports (aka not :80 or :443) via an app firewall (Little Snitch here). In this case it would have warned me when the compromised script would have called home to that endpoint on the non-standard port.

Gotta tackle such issues at different places all at once for sure. It's like wearing 5 digital condoms at once. Too bad there's still some leakage somewhere for sure. B)

Cider9986 21 minutes ago | |

DNS level is more secure but less effective because apps and website can serve the essential content on the same domain as the advertisement. It will also become less effective over time.

YouTube does this, so you need to use a browser-based ad blocker.

inigyou 10 minutes ago | | |

Let them eat cake. Setting up that ad proxy stuff is a bunch of work that many websites won't do.

functionmouse 1 hour ago |

I have a feeling everyone with understanding of the situation or even a vague malaise opening a news article and being bombarded with popups that intercept their attention knows why ad blockers are needed, and any perceived "discourse" to the contrary is one sided, from the ad agencies and media platforms that largely and subversively direct the narrative.

It's getting harder by the day to tell sentiment apart from narrative.

ksenzee 1 hour ago | |

"You will be annoyed" and "you will be served malware" are two different classes of need. The first is enough to get me running Firefox/uBlock Origin on my own devices. The second is what got me to run it at work.

amelius 35 minutes ago | |

Nobody wants ads (*) but somehow they are never banned.

Makes you wonder, are we living in a democracy or not?

(*) shown at inconvenient moments and tracking the user; yellow pages were fine

RajT88 20 minutes ago | | |

I do not recall ever hearing of an organized effort to ban ads. These days, good luck getting bipartisan agreement, especially with all the dark money in politics being legalized and normalized.

That said... The modern internet is built off many free services paid for by people who buy stuff from ads. It is hard to imagine a world without ads - many sites and services would disappear. Hosting costs money.

I could see a dystopia without ads where a government provides free hosting for citizens. That quickly becomes "thought police" when an authoritarian leading head of state comes in. If we pretend like that will not happen, I think we would have a much more wonderful internet.