An iframe from googlesyndication.com tries to access the camera and microphone

Re:An iframe from googlesyndication.com tries to access the ... by soared on Sunday December 19, 2021 @12:48PM (#29616229)

Yes - banner ads are constantly targeted by malicious actors. My employer pays a vendor something like $200k/mo for creative scanning to avoid issues like this. Google certainly spends tens of millions a year trying to avoid issues like this.

See vendors like “the media trust”

[ Parent | on HN ]

Re:An iframe from googlesyndication.com tries to access the ... by VRay on Sunday December 19, 2021 @03:04PM (#29617773)

Hey, if you want, you can give me $200k/month and I'll scan your ads to make sure they're just flat fucking image files without any arbitrary bullshit code

[ Parent | on HN ]

Re:An iframe from googlesyndication.com tries to access the ... by teej on Sunday December 19, 2021 @06:10PM (#29619521)

It took 10 seconds of searching to find a flat fucking image file exploit. I even skipped the recent NSO group zero-click exploit. Enjoy - https://www.bleepingcomputer.com/news/security/new-stegano-e...

[ Parent | on HN ]

Re:An iframe from googlesyndication.com tries to access the ... by boomlinde on Sunday December 19, 2021 @08:46PM (#29620699)

Doesn't seem like a great example since the image itself is perfectly safe. The exploit still needs JavaScript to extract and execute the payload embedded in the image, and then relied on Flash to install malware. Without JavaScript it's just an image like any other.

The NSO group iMessage exploit is a more interesting example, essentially turning a poorly bounded JBIG2 decompressor into a virtual machine.

[ Parent | on HN ]

Re:An iframe from googlesyndication.com tries to access the ... by VRay on Monday December 20, 2021 @02:17AM (#29622242)

haha, if a country wants to spend a 9 figure sum or someone comes back in time from the future to hack me, I'll be happy to consider myself pwned

It's a huge bummer that I HAVE TO block all ads as a security measure, though, and that people accept "Download advertisement.exe and run it in a half-assed sandbox or you're stealing that clickbait article" as the way things should be

[ Parent | on HN ]

Re:An iframe from googlesyndication.com tries to access the ... by boomlinde on Monday December 20, 2021 @07:05PM (#29632144)

> if a country wants to spend a 9 figure sum

After the initial investment in developing the exploit and before the vulnerability was patched, there would have been a near zero cost to hack any one user in particular.

[ Parent | on HN ]

Re:An iframe from googlesyndication.com tries to access the ... by tgsovlerkhgsel on Sunday December 19, 2021 @06:37PM (#29619782)

This gets a lot harder to pull off when the images are transcoded by being decoded in one sandboxed process that outputs a bitmap, then encoded in another sandboxed process that outputs what ultimately reaches the user.

[ Parent | on HN ]

Re:An iframe from googlesyndication.com tries to access the ... by cpeterso on Sunday December 19, 2021 @10:53PM (#29621396)

Do ad syndication networks like Google transcode images provided by advertisers? When an advertiser uploads an image, Google could transcode it using a strict decoder and their own safe encoder to produce a clean image for syndication.

[ Parent | on HN ]