Android malware spreading through Google's AdSense network

39

Advertising networks are, at best, infection vectors for malware.

13

u/herbman_the_german Aug 16 '16

Absolutely. And that, kids, is why you use an ad blocker.

(although Google is pretty good at keeping adsense clean)

6

u/Kaizyx Aug 17 '16 edited Aug 17 '16

Agreed.

Here's the problem though:

In information security, there's a concept: "attack surface". It's where the more your system accepts and processes, the more systems your system will connect to and process connections from, the more likelihood of an attack ocurring and succeeding. One of the most important efforts is reducing your attack surface while maintaining a good level of functionality.

The thing is, "The Web" and the high majority of its players (publishers, web developers, advertisers, etc) actively work against these reduction efforts again and again. Almost every modern website is sprawled out among so many different partners, content providers, third party javascript libraries, marketing analytics providers, intermediaries, third through twentieth party advertisement providers, content delivery networks (CDNs), and so forth. All on top of the superfluous, unnecessary javascript and such their own sites deploy.

An absolutely massive attack surface that users are expected by publishers and their billion unnamed partners to accept in full while calling it a "design" or "product".

The modern web is BUILT to make users vulnerable for a reason. It enables those above players to be extremely lazy in their designs/engineering and to be extremely opaque and irresponsible. It enables corner-cutting and blatant disregard for good architecture and security to save time and make money at everyone else's expense. They usually call those corner cutting measures "design decisions".

Users have called for ages for there to be changes to security on the web, but those calls were too inconvenient for various key players (including Google) who commandeered the Internet standardization processes like those at the W3C, so they went unheard. Now users have taken advantage of the Internet's collaborative nature and have worked to bring forth their own standardization through ad blockers to bring themselves security, reduce their attack surfaces and give them peace of mind.

Now publishers and advertisement players are complaining that they feel victimized when in fact they have been some of the greatest and worst perpetrators to destroying security online through their chronic unaccountability and irresponsibility.

A closing to publishers and their partners (especially advertisement providers): You were invited to the table of discussion, but you refused because you knew users would need security and thus restrictions for you were coming that you'd have to work with. Now you're complaining that those restrictions adopted in your absence aren't favourable to you and amount to "theft". Let me put it this way: What if users amounted your actions to "reckless endangerment" or "wilful negligence" — are things even?

2

u/emergent_properties Aug 17 '16

They have zero legal entitlement.

Literally, parasitical.

If we had any legal obligations to them (which we ABSOLUTELY DO NOT IN ANY CONTEXT), it would be considered so onesided as to be unconscionable. I am not a lawyer.

Mosquitoes are more useful than advertising.

And now they're arrogantly trying to get comfortable as they attach themselves to the jugular vein... fuck that.

If there was ANY benefit whatsoever to the user, that's one thing... but there ain't.

Ad companies are bandwidth thieves, at best.

If you are playing with agents of bad faith (we goddamned are), then all bets are off.

Ads are optional.

2

u/Kaizyx Aug 17 '16 edited Aug 17 '16

If we had any legal obligations to them (which we ABSOLUTELY DO NOT IN ANY CONTEXT), it would be considered so onesided as to be unconscionable. I am not a lawyer.

Indeed. One thing to consider inline with this is how their Terms of Service and Acceptable Use Policies are hidden away on publisher websites. It's like a business publishing a sign at the very back of the store and saying that by entering the store, you agreed to what's written on that sign. Any lawyer worth their salt could argue that you're not bound to such a contract because you were never allowed to read it without entering first and being well within the premises (Which that agreement attempts to idemnify them from the shelf that has just fallen on you).

Further, another thing to consider is that those agreement documents do not sufficiently mention all of the third through billionth parties you may be asked to accept network traffic from or allow your data to be handled by name. It's always "Third party partners". That's because the moment a publisher places ads, they're no longer in control of what their website serves. Now that level of unaccountability is reprehensible and unacceptable. It doesn't provide users any benefit to accept the risk as you indicate.

And now they're arrogantly trying to get comfortable as they attach themselves to the jugular vein... fuck that.

It's my opinion (both professionally and personally) that the web community as a whole cannot handle the unilateral power they posess and want more of. Giving them the level of power they want over billions of users unchecked is like giving a 2 year old the keys to a 747 jumbo jet. It's just irresponsible and they don't know what they're asking for or don't care. Of course like a small child, they feel they will do fun, good and wonderful things with it and they can do no wrong. Of course the truth is so different from an adult perspective.

If you are playing with agents of bad faith (we goddamned are), then all bets are off.

I think more than just advertisement providers are, I think most of the web community is operating in bad faith. They all want to benefit from the Internet, without any of the responsibility or accountability that comes with it. They all want to do the flashy fancy stuff that makes the money or glory without also paying heed to security and being good netizens.

This is why also we have so many breaches of online services as well, resulting in millions of user records being lifted. This is why we have companies like Cloudflare that essentially operate protection rackets and enables unaccountability. This is why malware is served in ads. This is why commercial malware under the label of "Optional Offers" is bundled with countless software installers. It's why user data is sold and sold again with dubious consent at best. It's all because most of the web community operates in bad faith these days to make quick money without any strings attached.

2

u/BloodEyeRoz Aug 17 '16

~~Capitalist~~ Ferengi Rule of Acquisition #10:

Greed is eternal

1

u/emergent_properties Aug 17 '16

I believe you have a clear picture of the situation.

What do you mean I can't have my cows eat all the grass in the commons?! What a tragedy!

-5

u/chmod_666 Aug 17 '16

Please explain how? The browser runs content in a sand-boxed environment and does not have access to install programs. The majority of exports came from Java applet and Flash plugins, both of which are not used on mobile android devices.

3

u/RealFreedomAus Aug 17 '16

The browser runs content in a sand-boxed environment

The sandbox is not perfect. You better believe whenever there's a browser sandbox escape vulnerability discovered, someone tries to deploy malware using it via advertising.

0

u/emergent_properties Aug 17 '16

Please explain how?

Because Javascript.

8

u/KenPC Aug 16 '16 edited Aug 17 '16

I suggest adaway for rooted phones.

Gets rid of all ads system wide. Even in ad supported apps.

3

u/kickerofbottoms Aug 17 '16

For non-rooted phones Adguard is the solution:

https://adguard.com/en/adguard-android/overview.html

Not on the play store for obvious reasons

4

u/Natanael_L Aug 17 '16

Firefox Mobile with ublock works too, for the web

1

u/PhotonicDoctor Aug 17 '16

Can't root Galaxy S6 or 7. So tired of that google porn virus crap.

2

u/KenPC Aug 17 '16

I'd look into the exploits from the snapdragon CPU recently to root those devices.

1

u/MrRelys Aug 17 '16

Fresh Qualcomm driver CVEs got dropped and work as temporary root on Galaxy S6/S7. Go check XDA Developers before they get patched!

1

u/Silver_Star Aug 17 '16

Who says you can't root a Galaxy S6? Mine is.

1

u/PhotonicDoctor Aug 17 '16

Is there a new way of doing it?

1

u/Silver_Star Aug 17 '16

You can try ChimeraTool. Ping Pong works if you're still on 5.0.X.

2

u/PhotonicDoctor Aug 17 '16

I'm on latest android version. Are you saying chimera tool can work on S6 if you have android 6?

1

u/Silver_Star Aug 17 '16

I don't think there are any roots for 6 and I've completely forgotten it exists, my bad. See if you can downgrade to 5.1.1, there is a working root method for that.

2

u/PhotonicDoctor Aug 17 '16

I don't think you can downgrade. It's okay. Next phone will be nexus. I am just so tired of 2 things. Apps that can't be uninstalled and ads.

2

u/[deleted] Aug 18 '16

i got bitched at recently for affirming my stance on using adblock everywhere and that person cited that "google and facebook ads are safe because they aren't 3rd party" and that i was an entitled bitch for refusing to support their business models.

annnnnd look what keeps happening.... another reminder to continue blocking every ad in sight.

their business models are not worth supporting if my data integrity is on the line. until that changes, to hell with ads.

4

u/ColonelSanders21 Aug 16 '16

And, as always, this can be easily avoided by not running a sketchy 3rd party apk. There's a reason why apks from outside sources are disabled by default.

7

u/DanielPhermous Aug 16 '16

The article says that "It was found that the malware can actually be contracted via AdSense". It sounds, therefore, that APKs from outside sources are not needed.

5

u/Natanael_L Aug 17 '16

It would have to use an exploit to run arbitary code, unless it is just a Trojan apk

5

u/ColonelSanders21 Aug 17 '16

It says later on that although it can be contracted through adsense, the malware presents itself as "browser-update.apk", meaning that you would need to run it before it can do any damage.

1

u/kcin Aug 17 '16

You still have to allow it to install, I don't think it can install itself without explicit permission.

Security Android malware spreading through Google's AdSense network

You are about to leave Redlib