News for hackers. Stuff that matters.

A comment on Steganography Based Ad Payload That Drops Shlayer Trojan on Mac Users. Parent comment

Re:Steganography Based Ad Payload That Drops Shlayer Trojan ... by sourthyme on Thursday January 24, 2019 @12:28PM (#18990758)
Why aren't these ad scripts sandboxed? I thought you can't have arbitrary code from cross site domains have access.
[ Parent | on HN ]
Re:Steganography Based Ad Payload That Drops Shlayer Trojan ... by Macha on Thursday January 24, 2019 @03:07PM (#18992413)
Because the advertisers want to be able to load it with scripts to track stuff like viewability, fraud etc., and since they have the money they ultimately have the power.
[ Parent | on HN ]
Re:Steganography Based Ad Payload That Drops Shlayer Trojan ... by dmux on Thursday January 24, 2019 @01:47PM (#18991639)
They often are sandboxed within an iframe element: (https://www.iab.com/guidelines/safeframe/)
[ Parent | on HN ]
Re:Steganography Based Ad Payload That Drops Shlayer Trojan ... by pmoriarty on Thursday January 24, 2019 @01:48PM (#18991644)
Why do ads need to contain code at all?

Why not limit them to just static images?

[ Parent | on HN ]
Re:Steganography Based Ad Payload That Drops Shlayer Trojan ... by tinus_hn on Thursday January 24, 2019 @02:37PM (#18992118)
Because that’s not how the web works. There is only one sandbox per frame and all code in that frame is in the same sandbox. It doesn’t make much sense to do it differently because JavaScript can modify the behavior of the built in objects and thus that of other scripts in the same environment.
[ Parent | on HN ]
Re:Steganography Based Ad Payload That Drops Shlayer Trojan ... by eliya_confiant on Thursday January 24, 2019 @01:45PM (#18991614)
The industry is moving in a direction where more and more ads will be sandboxed, we are just not there quite yet.
[ Parent | on HN ]