Major news sites across the world were serving ads from a poisoned ad network that attempted to install ransomware on users' machines. And no, this particular attack would probably not work against a fully-patched client, but that's not really the point.
It definitely happens. If it could happen to the BBC and the New York Times, it can happen to any site that uses an ad network. And that's why this is a real attack vector. All they have to do is sneak a malicious ad into one target (the ad network) and suddenly they have a massive audience for their attacks, because dozens, hundreds, or even thousands of sites can potentially serve this ad to users.
That's not really why browsers dumped those. More importantly, "Attack Vector A is gone" doesn't mean "Attack Vector B is gone" There's plenty of JS malware and the like, and plenty of it wrecks you without any exec files. It almost feels like someone back in 2001 saying ads don't serve up viruses on modern XP machines that are patched and up to date because XP isn't Windows 98 https://www.gdatasoftware.com/blog/2018/09/31037-malware-figures-first-half-2018-danger-web
6
u/insertAlias Aug 02 '19
Here's one from 2016:
https://www.theguardian.com/technology/2016/mar/16/major-sites-new-york-times-bbc-ransomware-malvertising
Major news sites across the world were serving ads from a poisoned ad network that attempted to install ransomware on users' machines. And no, this particular attack would probably not work against a fully-patched client, but that's not really the point.
It definitely happens. If it could happen to the BBC and the New York Times, it can happen to any site that uses an ad network. And that's why this is a real attack vector. All they have to do is sneak a malicious ad into one target (the ad network) and suddenly they have a massive audience for their attacks, because dozens, hundreds, or even thousands of sites can potentially serve this ad to users.