Malware Installed by LiveJournal Ad

Jamesday writes "LiveJournal recently introduced an ad-supported level. Over the last few days an advertiser used an ad to install the ErrorSafe malware that tried to trick people into believing they had a fault on the computer that needs them to purchase a fix. The ad used a server-side setting and targetted only those outside the US, to prevent LiveJournal's own checks from noticing it. LiveJournal has apologized for the ad and slow response." Even our readers have had to endure more than one browser-crashing ad campaign from time to time. Thanks for sticking around.

Breaking News

[PakProtector]

This just in: Capitalism and Morals do not necessarily go hand in hand.

Are there any humans around?

[Watson Ladd]

Newspapers clear ads before printing. Radio stations clear ads before airing them, and so do tv stations. Why should websites be any different?

Re:Breaking News

[cryfreedomlove]

I'm not sure if I agree or disagree but your post implies that there is an alternative to Capitalism that is hand in hand with positive morality. Please tell us what that is.

Re:This isn't too surprising

[Khyber]

I don't see any part in the TOS or User-Agreement that states "By viewing this site you agree to have shit you don't want installed on your system by our supporting advertisers."

Re:Are there any humans around?

[TommydCat]

Because those ads are not necessarily static or even served up by the publication's servers. If the ad consists of a "add_link_to_offsite_advertiser_server_here", anything that was "cleared" could change without notice. It's rather hard to dynamically change printed copy ;)

I know publishers hate ad-blockers...

[BertieBaggio]

... but they and the advertisers are the ones driving people to them.

No seriously, is it any wonder people turn to ad-blockers? Try reading an informative bit of text when there's a Flash advertisement of box jumping around and flashing like a student at Mardi Gras. I don't care if you are trying to tell me I'm your millionth visitor. You misspelled congratulations! The box makes me wish I had no peripheral vision! FOAD.

Now I know publishers want to make a buck (I have a few websites [sans-advertising] myself), but if the advertisers are going to use annoying/underhand methods, people will take steps to protect themselves. A lot of these companies would do well to look at the sort of program Google offers: inoffensive, targeted, text ads.

In short: make your advertising better -- advertisers AND publishers -- or lose that which you supposedly value. Eyeballs.

Re:Are there any humans around?

[Beryllium Sphere(tm)]

They did. The ad contains code that skips the malware install if it's running in the US, as for example when it's being screened.

A better question is why displaying an ad can install software on your computer. The LiveJournal posts say it was a Flash ad, so until we get real information it's logical to guess that it exploits one of the vulnerabilities in the Shockwave player.

simple fix

[Whammy666]

My simple fix for the security problems associated with Flash is to not install flash. Let's face it, 99.9% of flash is just obnoxious ads anyway. Who needs it.

It's for this reason that any webmaster who insists on using 100% flash to view their site deserves a swift kick to the nutsack.

Adverts?

[Karellen]

Do people still get them? I thought everyone had adblock [mozdev.org] installed.

Identify the Advertiser

[richg74]

Even our readers have had to endure more than one browser-crashing ad campaign from time to time.

The way to discourage this kind of nonsense is to make sure that the advertisers are identified and given a large public black eye. Probably that's not appropriate if the ad just uncovered a bug in the Flash player, but I think it certainly is in the case where an ad installs spyware.

Did the advertiser know this was going to be done? Quite possibly not, but they are still the ones responsible for the ad: they want the good consequences (more sales), so they have to take the bad ones as well. If their bottom line is hurt, they'll start paying more attention to what their ad agencies and other agents are doing. (This is just an application of Murphy's Golden Rule: the guy who has the gold makes the rules.)

weak effort

[v1]

While it was good of them to pull the ad from the rotation immediately, they failed in several other ways:

(1) they failed to post a notice or provide links for the removal of the malware. At best in the blog there are references that such removal instructions exist, peppered with a warning that some of them are actually malware themselves. They should have made the fix EASY and FOOLPROOF to obtain after getting their readers infected. It's been how long since they got their subscribers infected and they have done nothing more than to stop more of them from getting infected. They helped to break the computers, they should play an active roll in fixing them.

(2) the impression I got from their posts in their blog was that "oops sorry not our fault, not our advertiser's fault, it's one of the ad companies that subscribed to our advertiser". This is a cop-out. When you provide a service like they do, your advertisement is a bundle that comes with your service, and as such you are responsible for its content. I don't care if it's a 3rd party. You take on the responsibility for the content you deliver, regardless of how you get it. You can have legal arrangements with your content providers that provide YOU with a legal remedy, but the grief passes through you. You get sued, and then you sue the ones upsteam that caused you to get sued. You do not "pass the buck" and point a finger up the chain three levels and say not my problem good luck getting anything out of them, because the consumer has no legal recourse against those people. You as the content provider do have a legal recourse against your advertiser, and they have recourse against their affiliate who caused the problem in the first place. This pass the buck mentality is cheap and lazy, and they should be ashamed for trying to pull it.

Re:This isn't too surprising

[Nutria]

I use an ad-supported LJ account, and the mentioned advertisement was made in flash. I had to deal with it a couple of days ago. Hoo-ray for security holes. Can't we just sue the ad company for unauthorized usage of our computer's resources?

You're using Windows from an account that has Administrator privs, aren't you?

Re:Google

[whitehatlurker]

Oh MY GOD! Won't someone think of the Sea Monkeys?

Seriously, people should be making use of the adblocking functionality in their browsers, or better yet, installing filtering proxies like proxo [proxomitron.info] to halt this crap before it gets to the browser.

Re:Breaking News - spin

[burnin1965]

"This just in: Capitalism and Morals do not necessarily go hand in hand."

Caveat Emptor

Doesn't matter if its politics, economics, religion, software, hardware, or even information.

The fact that there are people running businesses with questionable ethics in no way reflects on the morality of the underlying economic philosophy. History easily shows that people who have questionable morals have no difficulty working within the structure of any social philosophy which gains any significant following whether it be economic, religious, or governmental in nature.

So when someone comes around selling their alternative economic philosophy based on the idea that the current system inherently lacks morality, caveat emptor.

burnin

Re:Breaking News

[maird]

http://en.wikipedia.org/wiki/Communism [wikipedia.org] Particularly: "communism as a political goal generally is a conjectured form of future social organization which has never been implemented" IOW, don't confuse the states that purport to be communist with communism. The USSR, China, Cuba, et al are not communist states. They are totalitarian dictatorships claiming to be communist (or that we have dubbed communist regardless of what they claimed to be). A pure communism is moral and not capitalist since there is no self-interest (selfishness) nor any need for it. There's no need to rip anyone off or take advantage of anyone. There is no need for contracts that bind the consumer to the advantage of the vendor. The truth is that communism is probably not achievable by humans, who would want to clean toilets even if you did have the same lifestyle as the head of state. Life on Star Trek starships is communist. Until matter replicators that will freely feed anyone that wants to eat are broadly available on earth communism is impossible but it is moral in ways that capitalism isn't.

Google AdWords = good

[ThinkingInBinary]

You know, Google ads are the only ads I look at any more. (Hell, I run them on my own site!) They are short, not ugly (because Google cares [google.com] about the viewer's experience), and quite often very pertinent to the content. I have to try really hard not to puke when I log in to something like Yahoo! Mail! and I see flashing banner ads for "Get your Credit Rating" or "Cheap Mortgages" or "Warning: Your system is broadcasting an IP address! Ph33rz0r teh RFC!". They are the most useless ads ever. The only reason I think they might survive is if the ad networks charge per impression, not per click--because almost nobody would click on them!

Re:Breaking News

[corbettw]

A pure communism is moral and not capitalist since there is no self-interest (selfishness) nor any need for it.

In other words, it runs counter to human nature. People are instinctually selfish, and it will never change.

Won't hold water in the end...

[OmniGeek]

As a (hypothetical) site visitor, how does simply visiting the site bind me to their terms? Also, if the malware-laden advertiser hits my machine at my first visit, before I have a chance to evaluate the TOS, there's NO way the TOS can be held to protect them.

Moreover, if the malware violates unauthorized-access statutes, the TOS would be well and truly trumped by such legislation.

Overall, they're in a very weak legal position; a reasonable person would conclude that the best course of action is to mitigate the damage to users, FAST and well, rather than take a ho-hum-not-our-fault attitude. Their response speaks volumes about them...

Re:Are there any humans around?

[rafimg]

Er, I'm just a bystander in this argument, but I believe you misread the response. The GP is saying that LiveJournal could well have cleared the ad, but that it wouldn't have mattered because they're a US-based company and the malware was designed only to download to IP's outside of the US. The point was not that the ads went through a third party server, which I agree is irrelevant, but that the ad was coded nefariously enough to appear malware-free to anyone looking at it from the US. That doesn't mean LiveJournal isn't responsible, but I do think that makes the error a bit more understandable.

Re:Breaking News

[Jacked]

People are instinctually selfish, and it will never change.

Exactly, and that's not necessarily a bad thing. It is precisely because of self interest that others are willing to offer us their goods and services. One of my favorite quotes puts it much better than I can:

"It is not from the benevolence of the butcher, the brewer, or the baker that we expect our dinner, but from their regard to their own interest." -- Adam Smith

Re:Breaking News

[mdwh2]

A pure communism is moral and not capitalist since there is no self-interest (selfishness) nor any need for it. There's no need to rip anyone off or take advantage of anyone.

No self-interest? How is that achieved? The only way you could do this was to provide everyone with everything they wanted - but no economic system can do that. As you say, we need Star Trek replicators. It's not communism which gets rid of the self-interest - it's the replicators. In a society with unlimited resources, economics doesn't really have much meaning anymore.

There is no need for contracts that bind the consumer to the advantage of the vendor.

Well, just as people often confuse communism with communist states, don't confuse capitalism with the corporatism we see in the US. Contracts like this are state intervention, and not something inherent in capitalism.

I might as well propose another system: Moral capitalism. It works just like capitalism, but everyone is nice to each other.

See, it's easy to come up with moral systems when you can assume how people behave...

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:Just one ad?

[Lord_Dweomer]

Nice story, but if you'd like it to be remotely useful for Slashdotters, could you please tell us the NAME of the game so we can avoid it?

Re:Obligatory serious responce to smartaleckiness

[TheCycoONE]

What the parent was trying to say, and what was disregarded so lightly by yourself, is that attitudes like selfishness are possibly, indeed even likely, culturally relative. I would argue even that they are not just culturally but individually relative. Though I do not disagree that there may be an urge to satisfy ones own needs (a toddler will wine when it is hungry etc.), there is also an urge for altruism. Psychologists have found that toddlers will try to help others if they know that the person is having trouble. http://www.usatoday.com/tech/science/discoveries/2 006-03-02-toddler-altruism_x.htm [usatoday.com] This would indicate competing values, and it is up to the experience of the individual, (largely determined by the culture they grow up in,) and perhaps their genetic makeup to determine which of these values is nurtured to become dominant.

Re:Are there any humans around?

[jrumney]

I'm just a bystander too, but I beleive you're missing the GP's point.

Do newspapers clear an ad, then send their paper off to the advertiser with blank sections in pages for the advertiser to fill in with whatever they want?

The internet advertising industry is broken, because the advertisers have too much control, and when they abuse that like this, it is time to take that control back. Send me your flash animation, animated GIF or whatever, and I will add it to my page. You'll have to trust me on page hits, or get an independant third party to measure them, because the ad will be served from my server. This is the way it works in print media, and for a good reason which this case demonstrates.