Firefox Displays Ads When Opening New Tab

Mozilla has started displaying ads to Firefox users as they open a new tab in the browser, so the browser developer via a blog posting disclosed. The ads appear in the form of "Suggested tiles".These are ads that are based on the user's browsing habits. This would be taken into account with the users of privacy.

To make the ads relevant is a limited amount of data sent to Mozilla there. Since then it is analyzed and shared with the partners of Mozilla. According to the developer, the browser via Suggested Tiles possible to display relevant ads that users' privacy is respected and he or she is in control of the data.

The first partners who advertise via Suggested Tiles is now gone live, said Darren Herman, Vice President of Content Services at Mozilla. It involves Yahoo and several new titles including well-known Fortune Magazine and quartz, as well as "mission-oriented" partners such as Make-a-Wish Foundation and the Electronic Frontier Foundation. According to Herman, these parties are chosen because they add value to Firefox.

Mozilla is not paid for displaying the advertisements of those parties. Therefore, the advertisements are only labeled "Suggested" instead of "Sponsored". According to Herman should improve the tiles eventually advertise digitally, both increase by transparency in the industry and to ensure that users understand what is happening and how they control this themselves. So Firefox users via a single click of tiles showing off in a new tab.

Expert: Trackers Create Websites Painfully Slow

Trackers for ads and analyzing visitors are not only a privacy issue, they make websites also painfully slow which makes it sometimes seems that the time of the dial is back. This enables security expert Sean Sullivan of the Finnish anti-virus firm F-Secure.

As an example, Sullivan, the American site of Ikea, when nine different trackers rotate, according to data from Ghostery. In this case were authorized third party cookies. Sullivan then went to the Finnish website of Ikea, but did not allow cookies from third parties. In this case there were 11 trackers ago. In the case of third-party cookies had been granted, were charged a total of 49 trackers.

"If the trackers are allowed to place their cookies, they often charge more resources and slows down the browsing," Sullivan noted. "It is 2015, but many websites load as if it was 1999". The expert also advises to block third-party cookies in your browser. "The earlier trackers are disabled better Internet experience."

Google Finds 85,000 Programs That Inject Ads

Programs that are undesirable in Internet hijack the browser and then inject all kinds of ads are a gigantic problem, according to research from Google and the University of California. The researchers wanted to know how big the problem of "ad injectors" actually is. This is software that injects ads on websites or replace existing ads.

Google had in the first few months of this year, more than 100,000 complaints received ad injectors. During the investigation it was found that 5.5% of all IP addresses that Google sites visits with one or more ad injectors infected. In total, the researchers discovered more than 85,000 applications that hijack the browser and inject ads. It involved nearly 51,000 extensions for Google Chrome and more than 34,000 Windows programs. Of that total, 38% and 17% malware that also made the booty credentials in the browser.

The extensions and programs appear to have been made by a small group of software developers who control most ad injectors, which in turn benefit from the advertising ecosystem. The extensions and programs are distributed through a network of partners who are trying to create installations as much as possible, by combining the programs with popular downloads, use malware to spread or apply marketing.

According to Google would be more than 3,000 advertisers, the ad injectors have been duped. The advertisers can often only the last click that ensures that traffic is on their side, but often do not know how this movement came about. So they do not know that traffic comes from unwanted software and malware, but must still pay for here. Google has already removed 192 Chrome extensions from the Chrome Web Store, added measures to protect users from ad injectors and also warned the advertisers who are the victims of ad injectors.

Malware Destroys MBR Hard Disk During Analysis

It is known that malware creators do all sorts of tricks to analysis to prevent their creation but a new one does go very far and "destroy" the Master Boot Record (MBR) of the hard disk, so the computer will not boot. Let researchers know Cisco.

The MBR contains information about the type and location of logical partitions on the hard drive. It is essential for the computer to be able to start. The now discovered Rombertik-malware focuses on the MBR in the case of analysis. The malware spreads via email attachments and poses as a PDF file. In reality it is a SCR file the malware.

Once users open the attachment Rombertik first check whether it is running in a sandbox. Sandboxes are often used by researchers to analyze malware and is regularly checks for malware on the presence of this type of analysis environments. In case there is no sandbox is found, the installation continues. Rombertik is designed to steal passwords from browsers.

Before it does this is a final check there is still carried out in order to check that the malware is not analyzed via the memory.If this check fails to Rombertik strikes and destroys the MBR and overwrites partitions with "null byte", so recovering data from these partitions is difficult. The MBR is further adjusted so that the computer enters an infinite reboot loop. If the malware does not have permissions to overwrite the MBR will overwrite all the user's files in the home directory and encrypt.

Five Percent Google Visitors Infected With Adware

More than five percent of all people who visit websites from Google is infected with adware and within this group has at least half two or more "ad injectors" installed. This involves software that injects or replace ads on websites. According to research from the University of California that will be published on May 1, but the most important details of which Google has already put online.

According to the Internet giant ad injectors are a big problem. It is about users of both Windows and Mac, with Internet Explorer, Firefox or Chrome works. The adware is often bundled with other programs or via advertisements. Google received since January this year more than 100,000 complaints of Chrome users on ads that were injected. This makes it the most common problem that users complain about.

The researchers discovered further 192 misleading Chrome extension where 14 million people were victims become.Furthermore, it appears that 34% of the Chrome extension that injects ads as malware is to classify. For Internet users from adware and other unwanted software to protect warns Google Chrome users since late February for websites where these programs are offered. Last week, Google made ​​this opportunity available for Mozilla, Apple and other parties.

Zero-Day Vulnerabilities In Flash, Windows, IE11 And Firefox Shown

During the Pwn2Own contest in Vancouver researchers have multiple zero-day vulnerabilities in Adobe Flash Player, Adobe Reader, Windows, Internet Explorer and Firefox demonstrated. The Pwn2Ownd contest is an annual event organized during the CanSecWest conference where researchers and the safety of popular browsers, and browser plug-ins can be tested.

In total on the first day of the event three vulnerabilities in Adobe Reader, three vulnerabilities in Adobe Flash Player, three vulnerabilities in Windows, two vulnerabilities in Internet Explorer 11 and two leaks in Firefox displayed. Through the vulnerabilities could allow an attacker full control of the computer without user interaction is much here for required. This involves visiting a hacked or malicious Web site or open a malicious PDF file.

None of the demonstrated vulnerabilities A security update is available, so there is zero-day vulnerabilities. However, the Pwn2Own rules state that only details may be shared with the organization. Which will then inform the relevant suppliers. Only after a security update is available researchers may publish details of the vulnerabilities.

In total, the researchers for their leak 317,500 dollars , which researcher Nicolas Joly dragging $ 90,000 knew inside. The Keen Team, consisting of several researchers, however, managed to leak in Adobe Flash Player and Adobe Reader, as well as bugs to earn the rights to increase Windows, totaling $ 140,000. Later today , various researchers are trying to re-hack Firefox and IE but there are now planned attacks on Google Chrome and Apple Safari.

Android Jelly Bean - "Expert Warns Of Default Android Browser"

An American security expert has nearly a billion users with Android Jelly Bean or an older version of the mobile operating system works warned to stop using the standard supplied browser and other browsers to switch.

The reason is that vulnerabilities in the WebView component of the AOSP (Android Open Source Project) -Browser not be patched by Google. Monday warned Todd Beardsley security company Rapid7 that no new updates come out more WebView. WebView is an important part of Android for displaying web pages. It is a separate browser window that developers can use their apps and allows to websites and pages within the screen layout of the application again.

In the latest versions of Android WebView is no longer used, but 60% of Android users is still a version where this is the case. It may therefore be years before WebView is gone everywhere and all the time users run risk, notes Beardsley. "If I were an attacker and had to choose an Android component to attack, it would be WebView. WebView is a component that is used in almost all ad-supported libraries, as well as when you are in any web app not rendering" Open link in browser "click."

The expert is therefore surprised that Google still deliver more updates for example, the audio player in older Android versions, but WebView a miss. Since Chrome, Firefox and other browsers no WebView This is an important security measure notes Beardsley. "If your default browser on AOSP Jelly Bean or earlier, then stop." The same advice applies to users who use the older browser their telecom provider. However, the vulnerable component also appears to affect all kinds of apps and ad networks, as suggested anti-virus company Trend Micro fixed earlier.

Users Report Malicious Ads On Skype

Several users report that Skype they were seeing in the use of the popular VoIP software malicious ads to a fake Adobe website creature that tried to install malware. According to the malicious website, the user must update their Flash Player.

In reality, it was malware. Users wonder how the ads could pass the filters of Microsoft. The software giant has not yet responded to the ads, though a Skype employee on the Skype forum to affected users asking whether they have a " Fiddler trace can make. " This would help to find the malignant advertisement in question.

It would not be the first time that Skype is the target of "malvertisement". Last year, the Dutch security researcher Yonathan Klijnsma did know that he had found on Skype malicious ads. A problem with the ads on Skype is a "AdBlocker" that users use their browsers not working for these ads.

Incognito Mode Does Not Protect Against Super Cookies

Users who use the incognito or private browsing mode of their browser are still to follow through so-called "super cookies", according to an online test of the British developer Sam Greenhalgh . The problem is caused by a security measure called "HTTP Strict Transport Security" (HSTS). The measure ensures that websites only be accessed through a secure connection.

In case a website HSTS enabled the browser via a special "flag" remember and ensure that there is made only over HTTPS connection. If the user specifies HTTP in the address he is automatically redirected to HTTPS. However, this automatic forwarding can also be used by a malicious website to save a unique number in the user's browser and follow him. This number can then be read by other websites. HSTS can also be used as a tracking mechanism in this way.

To give users more privacy browsers have for some time been added incognito or private browsing mode. These cookies are not shared with existing web sites and the user can delete the cookies so they can be tracked online. Because HSTS is a security measure and is not really meant for tracking, browsers go it differently than is the case with cookies.

Some browsers such as Google Chrome, Firefox and Opera are trying to resolve this issue by removing both cookies stored as HSTS-flags. According to Greenhalgh, existing HSTS-flags, unlike cookies, or shared with other websites, even if the user incognito or private browsing mode enabled. In the case of Safari, the problem seems to be even greater because Safari users on an Apple device have no possibility to remove the HSTS-flags. She even be synchronized with iCloud, so they can be returned if the user clears his extension.

"I do not know if the technique is used in the wild to track users, although that does not mean that this is not so," said Greenhalgh. He calls the technical community to see how the tracking area can be resolved while the value of HSTS retained. In a response to Google Chrome Security Team states that there are measures added to the browser to address the problem, but it is ultimately a tradeoff between security and privacy. This form of "fingerprinting" would therefore not be solved unless fundamental changes are made to the way the web works. "