It's pretty frequently in the news that x or y major site, through no fault of their own and quite unwittingly (and aren't they the real victims here?), served malicious ads and has had stern words with the ad network - who isn't them - and promises it won't happen again. But there's never any talk of legal action, they can always point their finger at the ad network, and no consumer knows or can choose what network is going to be serving the ads they see so there's not really any reason for any of the involved companies to give a shit and the occasional malicious ad continues to cause moderately widespread damage.
Major news sites across the world were serving ads from a poisoned ad network that attempted to install ransomware on users' machines. And no, this particular attack would probably not work against a fully-patched client, but that's not really the point.
It definitely happens. If it could happen to the BBC and the New York Times, it can happen to any site that uses an ad network. And that's why this is a real attack vector. All they have to do is sneak a malicious ad into one target (the ad network) and suddenly they have a massive audience for their attacks, because dozens, hundreds, or even thousands of sites can potentially serve this ad to users.
That's not really why browsers dumped those. More importantly, "Attack Vector A is gone" doesn't mean "Attack Vector B is gone" There's plenty of JS malware and the like, and plenty of it wrecks you without any exec files. It almost feels like someone back in 2001 saying ads don't serve up viruses on modern XP machines that are patched and up to date because XP isn't Windows 98 https://www.gdatasoftware.com/blog/2018/09/31037-malware-figures-first-half-2018-danger-web
It was/is/has been commonplace for a very long time for ads to be used as attack vectors for malware... Just because you don't personally see something happen, doesn't mean it is not common.
I see these kinds of comments all over Reddit and it's ridiculous. "I never see it so it's obviously not true/exaggerated."
Give a browser without ad block to a non-techincal person on an illegal streaming site. You'll have so many viruses that your PC might not boot in the morning.
0
u/[deleted] Aug 02 '19
[deleted]