It seems many sites use 3rd party flash ads, those ads could be design to attack user.
Do those site know which ads are safe or not? Or they just transfer any ads to user browser?
In general, how to know 3rd party ads are safe or not?
Add a comment
|
1 Answer
Unfortunately you won't know without looking at, and understanding, the contents of the ads. There are two main concerns here.
Your first concern would be if the add contents are requested and served over some sort of Transport Later Security connection. Unfortunately at this stage very few of these 3rd party advertising networks bother to implement https for the sources of the add content. You can simply check the URL where the add contents are requested from to see if it is over an https connection. If this is not the case then the contents of that add will be vulnerable to modification by a Man-In-The-Middle.
There have been proven exploits of in-app adds on Android devices where a MitM is able to get access to all the privileges (camera,contacts,photos etc) of the application by simply exploiting an add banner that received contents over an unsecured connection. Tools like Drozer are used for this exploit. You can read more on add network research here.
Secondly, even if the connection is secure you still have to trust the actual content as you correctly point out. This would mean that you have to trust the add network that actually serves the content. It stands to reason that more popular add networks can more easily be trusted but you should most certainly not implicitly trust them. There is no guarantee that they actually review the adds that they serve. In this case there is not much you can do other than to do some of your own research on these 3rd party add providers to see if there have been any previous issues or concerns.
