Malware Attack Hits Thousands of Visitors to Yahoo.com

CommanderFrank

CommanderFrank

Cat Can't Scratch It
Joined
May 9, 2000
Messages
75,399
A heads up for all of you Yahooligans, a security threat has exposed hundreds of thousands of visitors on Yahoo.com to malware from Yahoo’s advertising servers.

The fact that the malware targeted flaws in the Java programming environment is an important reminder that the software has become a security menace.
Click to expand...
 
Java and adobe have always been security menaces. I think they take turns seeing who can leave the most holes exploitable.
 
michael.pa2 said:
Who visits Yahoo anymore?:confused:
Click to expand...

Working at a small computer repair shop... tons of people. Probably around 45%, another 40% with AOL accounts, rest 15% with ISP email or other.

A good chunk of Yahoo users I've seen is because baby bells have been brought back into AT&T, where they sold their email to Yahoo. Run across old @ameritech, sbcglobal, etc all the time (which work through Yahoo's site).
 
As I understand it, the supplying of ads is usually subcontracted. Why don't websites - like [H] - demand that their ad suppliers QA the ads and indemnify them?
 
This is why I can't stand people who still insist they don't need AV because they don't visit shady sites. If the site isn't eventually compromised the ad server will.
 
Ryokurin said:
This is why I can't stand people who still insist they don't need AV because they don't visit shady sites. If the site isn't eventually compromised the ad server will.
Click to expand...

Adblock ;)

(Noscript etc probably would help too)
 
Nate7311 said:
Try explaining that to the proverbial 65yo Grandmother that doesn't care about technology and just wants it to work.
Click to expand...

well of course. But AV isn't flawless either. I can't tell you how many machines I've seen, COMPLETELY infected, and Norton or McAfee or whatever are tootin' along like everything is fine.

Job security.
 
> Java exploit

Is this a new type of threat? :confused:

lol, why in the world do people leave the Java plug-in enabled for browsers without requiring manual activation? It's always been an "infect me" sign taped to your IP address.
 
colinstu said:
well of course. But AV isn't flawless either. I can't tell you how many machines I've seen, COMPLETELY infected, and Norton or McAfee or whatever are tootin' along like everything is fine.

Job security.
Click to expand...

lol so true...
 
I think this is a worthy comment from Anonymous Coward:
Indeed. I block 100% of ads my tools can identify, I consider this a routine security precaution, and I make no exceptions. Sorry to the honest site operators, I won't take offence if you decide to block me because I block your ads, but no, I won't whitelist you. This became my policy shortly after the only virus infection I've ever been aware of picking up on any computer I operate, which was a Java zero day exploit I picked up browsing normally reputable tech news sites.
Click to expand...
Amen to that bro!
 
Cerulean said:
I think this is a worthy comment from Anonymous Coward:
Amen to that bro!
Click to expand...

So... are you admitting to using adblock on this site, where you're not allowed to do such, and stating such has gotten many people banned before?

I know the quote isn't yours, but if you're agreeing with it like that, I must only assume you follow the same practices...




I never block ads, I rarely run AV, and I have gotten one virus since 04. It's all about not being a moron, and unfortunately for Yahoo, I wrote all of their services off waaaay back in 08, and before that I was only using their messenger. The reason? Yahoo attracts complete morons. They are bound to be a higher target for malware and other exploits, because their user base is generally so computer retarded that they're tied with AOL in my eyes. When I see @yahoo or @aol, I know I can just not pay attention to them, or that I can charge them more for tech services because they're morons that likely created double the work for me, while still also using a P4 with 256mb of RAM.

I should probably also mention, for the most part, I only really go to three websites, so I don't exactly have a wide range of sites - if I did, I probably would put more effort into securing the PC, but I have no reason to as is.




Therefore! The real lesson to be learned for those of us who don't already know it:

Yahoo is not good. Yahoo has not been good in a long time, if ever (I never liked them). Using websites that usually cater to complete morons is a great way to get infected through ad-hijacks.
 
pcjunkie said:
Java and adobe have always been security menaces. I think they take turns seeing who can leave the most holes exploitable.
Click to expand...

Security guru Steve Gibbon threw this out on episode #400 of "Security Now"..

Kaspersky looked at the statistics and said that Java was the vehicle for 50 percent of all cyberattacks last year (2012) in which hackers broke into computers by exploiting software bugs. And that 50 percent was followed by Adobe Reader, which was involved in 28 percent of these incidents. And then Kaspersky says, to give us some more perspective, Microsoft Windows and IE were involved in about 3 percent.
Click to expand...
 
Oracle can suck a fat one. Between trying to install malware as part of the Java installation, and Java being such a gigantic pile of shit itself, they're doing a really awesome job.

Adobe should be burned to the ground, no questions. I'd say they employ monkeys, but I've seen monkeys use tools without breaking anything.
 
Small IT shop worker here. It never fails that the worst pc's I see have an old version of Java, usually pre version 7. They also almost always have a "high end" antivirus like McAfee or Norton, though they are not necessarily to blame. Since they never update their Java they are getting 0-day exploits a year after the fact. I tell every customer that if you insist on having Java installed you absolutely must keep it updated, or better yet, use 2 web browsers one with Java enabled one without. It just falls on deaf ears.

As for yahoo, it is an absolute cesspool. I would be fascinated to see statistics on what percentage of the emails forwarded with @yahoo domains contain viruses.
 
Gweenz said:
Since they never update their Java they are getting 0-day exploits a year after the fact. I tell every customer that if you insist on having Java installed you absolutely must keep it updated, or better yet, use 2 web browsers one with Java enabled one without. It just falls on deaf ears.
Click to expand...

Yeah, people just don't seem to get the importance of keeping their systems up to date with the latest versions. it doesn't just apply to Java, it applies to ALL of your software, especially anything online or with open ports.

I don't think it will get any better either. people just refuse to believe that they have to keep their system updated, even when you tell them directly.

The only thing that could fix this is moving to a package manager type software management in Windows, like Linux distributions use, where all software released for the Windows platform uses a unified interface for managing software updates.
 
You must log in or register to reply here.
Back
Top