I don't know how it's done, but it happens.

Forbes Shuts Down Ads Serving Malware http://www.forbes.com/sites/thomasbrewster/2015/09/22/forbes...

I don't know how it's done either, and I've heard about them a few times. It seems somewhat unlikely that there is a remote code execution vulnerability being exploited only by adverts that hasn't been urgently fixed by the browsers.

If there genuinely is an exploit, an advert blocker isn't enough as you could put it on any website as well.

Therefore I wonder if it's possible that someone has a mis-informed definition of viruses and really it's something a little different, such as a simple link to actively download malware.

> If there genuinely is an exploit, an advert blocker isn't enough as you could put it on any website as well.

Sure, but then people need to visit that website. Ad networks are a popular delivery method because it gets your code out to millions of people quickly. Putting your exploit on a new Tumblr blog doesn't get you a big botnet.

Does it really matter? I don't see the value gained in spending my CPU power on their dark pattern BS, OR is downloading malware via exploit code.

The threat is there and I'm not interested in taking the risk.

> I don't know how it's done either, and I've heard about them a few times. It seems somewhat unlikely that there is a remote code execution vulnerability being exploited only by adverts that hasn't been urgently fixed by the browsers.

Flash. And there are a lot of unpatched browsers out there. Between the two, there are lots of users vulnerable to malvertising.

An ad blocker doesn't address the whole of the vulnerability space, but it is a significant mitigation.

Yes, exactly correct. If an ad blocker is the only thing between you and a compromised machine then you are not safe.

I'd be curious if anyone has data, but I would guess "hacked wordpress site" is a far more common vector for spreading this sort of malware than malicious ads.

Ads appear everywhere immediately when published, very few people are visiting some random hacked blogs. Ads are THE vector of choice for browser malware. You may not be safe from the browser exploit with an adblocker, but you will be safe from the method most exploits are delivered.

I've personally encountered multiple hacked sites and zero malicious ads (so far as I know). Like I said, I'd be really curious if anyone has actual data on different exploit vectors rather than just arguing anecdotes.

I think my point remains, however, that if your browser can be compromised by visiting a URL then you are in a bad situation ad blocker or not.

A non-technically inclined person might click on the wrong "download" button.

The ad network is a vector for malicious code transmission. To that end, an ad-blocker is exactly what you need. Your browser may be exploitable, but I wouldn't doubt that you can siphon up some very valuable personal information using the security model and API your browser implemented.

Just like UNIX-style permissions might, in theory, prevent an unprivileged user from completely hijacking the core system, the model says nothing about user-level applications manipulating user-owned data. I'd argue my data is much more important and valuable than whether or not I need to wipe and reinstall my OS.