Website Ad Hacking just got worse, protect yourself | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #hacker

Unfortunately, as AI Hacking continues to spread and get worse and worse for everyone involved, protecting yourself as best as you can online is getting increasingly important.

As an example, a few days ago it was revealed that a new advertising-based zero-click hack was being used. https://citizenlab.ca/research/how-discover-tech-turned-targeted-ads-into-a-pipeline-for-spyware/

What does this mean, basically just visiting a website with one of their 200,000 ads meant you would be hacked. If the ad loaded, done. No action on your part other than visiting a site displaying one of the ads.

Sure, this first known no-click ad attack appeared to be extremely targeted. The organization that made it was using it to go after journalists and others of extreme value, but like all good hacks, it won’t stop there. With the wonders of AI and profit motive of ad providers, (just look at Honey still being a thing), these are going to become common place likely in months.

So, how do you protect yourself?

Its going to be tough, if not impossible in some cases, but most of those cases will involve if you are an explicitly targeted individual, which almost none of us are.

1. First thing is first, just don’t click ads. Ads, especially if clicked, are a well known infection vector. If you see an ad for something you are interested in, instead of clicking the ad, go to your browser, search for the product directly, then click the official website for it.

2. On Desktop systems, use ad blocking and tracking blocking

This can come in many forms. If you are fine without having great browser compatibility with websites, Firefox is a great option when bundled with a combination of Origin uBlock. It allows a more comprehensive version that Chrome-based browsers are allowed to install.

For tracking blocking, at least in my experience and research, Privacy Badger is your best bet for now. Its available pretty much everywhere.

In many cases using these will cause you some extra headaches. When it does on sites you need to use like banking or others (frequent culprits), you can add those sites to the white list on the extensions.

If you are really all in (which all told I am not personally), you can use Firefox and an extension that only works on it called No Script. This blocks all Javascript which is the main mechanism through which malicious ads including no-click ads work. The downside is a lot of issues being online in general. I could see myself considering this in a few months if things continue to escalate.

3. On Mobile systems, use chrome-based browser with ad blocking and tracking

If you are on Android you already have chrome. All the same extensions as listed above are great options. You can also use Edge as I do on both my iPhone and Android devices. Google’s Chrome mobile browser does not have a built in Tracking Prevention like Edge and its built in Ad-Blocking default allows through all Google provided ads, which was actually the largest provider that allowed the known no-click hacking ads to get through.

If you are on iPhone, recommend installing Chrome or Edge. In my case, I went with Edge because as a rule of thumb, Google does a lot more tracking of users than Microsoft. Neither is super great, but one is a bit more trustworthy than the other. This is exampled by MS including an ad-blocker by default in the mobile browser, though its not a great one to use.

Edge includes AdBlock Plus by default. Its better than nothing, but it has a serious loophole. AdBlockPlus works as a business by allowing ad providers to pay them to let their ads through the protection. So in essence, pay to play. It will make it harder for malicious actors, but far far far from impossible.

In my case, I ditched AdBlock Plus and again installed uBlock in Edge in its extension menu. Its actually one of the default recommended extensions if you go into settings.

On top of this, I went into settings -> Privacy and Security. In here I make sure “Ad Blocking” is ON then click on it and make sure “Allow Acceptable Ads” is OFF. Then I go into “Tracking Prevention” and in addition to making sure it is ON, I also turn it to “Strict”. This will cause some site issues. If you encounter these and you need to use the site, you can come back to this menu to add them to the “Exceptions” list. It even has a convenient “Current URL” button if you do.

Fake accounts. Fake news. You can help stop it.

A foreign influence operation tried to use Daily Kos to spread propaganda, but we caught it. Catching them takes constant work. Bots, fake accounts, and disinformation campaigns hit our site regularly and our team finds them and shuts them down. We don’t have a billionaire backer or a paywall to pay for that work, we rely on readers like you.

Your contribution keeps independent, progressive media running and gives the truth a fighting chance. Give $5 today.

Click Here For The Original Source.

——————————————————–

…………

Related