'Flash' scam popup coming from some ads?

Ste.phen

Got this popup on boards.ie, redirecting to what looks like a malware/virus download site, screenshot attached

( link was to

http://184.173.28.176/adobe_flashplayer_7.exe

)

I wasn't able to identify where exactly it was included from, but my guess is one of the ad networks in use?

Tigger

me also
i was getting a yellow triangle on my https line as well on chrome on the laptop
getting that popup on ios9 also

KERSPLAT!

Getting the same and the site is unusable at the moment.

joujoujou

Same here.

Tigger

tried to auto download a fake flash 7 just then

Ste.phen

Found other forums reporting the same in the last few mins - seems like some ad provider, tracking provider or similar is compromised?

http://www.geekzone.co.nz/forums.asp?forumid=4&topicid=183852

http://www.teamliquid.net/forum/website-feedback/497641-flash-plugin-is-out-of-date


edit:
Not sure what's included that's causing this, looks like pagefair at first glance, but there may have been many redirects between the first thing was included and the file that triggered the popup?

Peregrine

Getting the same pop-up here.

Ruu

Same with Firefox.

KERSPLAT!

Ste.phen wrote: »

Found other forums reporting the same in the last few mins - seems like some ad provider, tracking provider or similar is compromised?

http://www.geekzone.co.nz/forums.asp?forumid=4&topicid=183852

http://www.teamliquid.net/forum/website-feedback/497641-flash-plugin-is-out-of-date

I've ads disabled but definitely something off

BobCobb

I just clicked on the OK, thinking it was a message from my os, and it seems to have fvcked up my computer, screen went green, then fuzzy. Hope it will be OK...

martyos121

Happening to me on boards and one other website (wrestlezone.com)

Every other site I've tried since is working fine, but those two are bollixed.

Tigger

BobCobb wrote: »

I just clicked on the OK, thinking it was a message from my os, and it seems to have fvcked up my computer, screen went green, then fuzzy. Hope it will be OK...

it tried to dl abobe flash 7 so find it in your downloads and get it

GLaDOS

Was getting it constantly on my laptop, grand on my phone on touch though.

Ste.phen

I'm increasingly sure this is due to pagefair being compromised - looks like they're an ad provider that is used by many forums and who claim to still load ads despite the presence of adblock -

Their own homepage is also showing the malware popup

Tigger

any idea how to block it
i don't adblock boards but ...

yeah i'm getting the warning triange on that pagefaair page as well

Mountainsandh

For information I'm using Silk on Kindle Fire and no pop up or issues whatsoever.

GLaDOS

Ste.phen wrote: »

I'm increasingly sure this is due to pagefair being compromised - looks like they're an ad provider that is used by many forums and who claim to still load ads despite the presence of adblock -

Their own homepage is also showing the malware popup

I have ads disabled, not just blocked (mod/subscriber option) so does that still make sense?

Tigger

Ste.phen wrote: »

I'm increasingly sure this is due to pagefair being compromised - looks like they're an ad provider that is used by many forums and who claim to still load ads despite the presence of adblock -

Their own homepage is also showing the malware popup

pagefair are in dublin myst be the púca

KERSPLAT!

ScienceNerd wrote: »

I have ads disabled, not just blocked (mod/subscriber option) so does that still make sense?

They probably still load but aren't displayed... I'm not 100% tbh

challengemaster

Tigger wrote: »

any idea how to block it
i don't adblock boards but ...

edit: scrap that, even with adblock on and ads disabled it's constantly trying to redirect to the download ip.

Tigger

ok adblock boards then

BobCobb

Tigger wrote: »

it tried to dl abobe flash 7 so find it in your downloads and get it

I couldn't get the laptop to start again, it looked pretty bad.
Hopefully it will have recovered by the morning...

El Weirdo

I'm also getting it.

Peregrine

Adblock makes no difference for me. I have ads disabled as a mod/subscriber option too. Still redirecting.

GLaDOS

Ita definitely time to panic

Peregrine

I have a solution but you're not going to like it.



Turn beta on.

Tigger

challengemaster wrote: »

I can confirm:

With adblock turned on, the auto-download does not happen.
With adblock turned off, on every refresh it tries to auto-download the .exe file

Ads just being disabled through subscriber options is not enough to stop the auto-dl.


edit: scrap that, even with adblock on and ads disabled it's constantly trying to redirect to the download ip.

is everyone running hola?
with hola off and chrome on adblock off its stopped
still happening on safari on ios

The Randy Riverbeast

Mobile site appears to be fine.

Adblock doesnt seem to be preventing it. Whats the point if it fails like this.

Tigger

Peregrine wrote: »

I have a solution but you're not going to like it.



Turn beta on.

frist thging i tried
didn't help

Tigger

BobCobb wrote: »

I couldn't get the laptop to start again, it looked pretty bad.
Hopefully it will have recovered by the morning...

stick it in the dishwasher

challengemaster

Peregrine wrote: »

I have a solution but you're not going to like it.



Turn beta on.

I think I'd rather download the virus than use the beta.

GLaDOS

Peregrine wrote: »

I have a solution but you're not going to like it.



Turn beta on.

The tinfoil hats will be out in force

Tigger

the beta is the worst thing on the net

Tigger

hard restart on ios seems to have stopped it on safari
on both 5 and 5s

nope i was wrong its baaaack

Peregrine

Tigger wrote: »

Peregrine wrote: »

I have a solution but you're not going to like it.



Turn beta on.

frist thging i tried
didn't help

Strange. It works fine for me on beta but starts redirecting the second I switch back.

Tigger

Peregrine wrote: »

Strange. It works fine for me on beta but starts redirecting the second I switch back.

on ios or chrome?

beta is the only thing that stops it on ios now
kdid i mention i hate beta

joujoujou

Cache cleared. :cool:

Crap's gone. For a while at least.

Firefox on Windows.

martyos121

Don't want to jinx it, but everything is fine for me now. Didn't clear cache or anything.

challengemaster

Yup, back to normal now.

Dav

As you have figured out, something went screwy with the company serving these ads. Needless to say, I have asked that we get an explanation about WTF this was all about.

KomradeBishop

In fairness, for some users - like the one who accidentally hit 'ok' on the malware earlier, and now has a botnet client on their computer - that's a bit late now...

I know Boards has little control over ads, but it's pretty unacceptable that this can happen to anyone in the first place, and it's been warned about before.

Third parties controlling content - especially anything javascript - that ends up on the site, will lead to this happening again; it's an inevitability.

Boards really should look into much more restricted ad content - ones that do not use any kind of third-party javascript; when you play whack-a-mole with abusive (or in this case malware) ads, then you don't find out about the problem and remove/disable them, until users of the site have already had to deal with it (in this case: with some already having a virus/botnet planted on their computer).

The Randy Riverbeast

Correct me if I'm wrong but my understanding is that boards.ie and many other websites use a service which only allows what ad block plus views as "non intrusive" ads. They got hacked so that this pop up was being sent through as a non intrusive ad and being shown on pages despite having ad block plus?

KomradeBishop

Only if you have the 'allow non-intrusive ads' option checked, yes - and this is the perfect example of why you should not have that option checked

Dav

So Pagefair was hacked. PageFair are a service that works with the companies behind ad blocking plug-ins to create a list of "safe" and approved advertisers who's ads are allowed through when that option is ticked.

BobCobb

BobCobb wrote: »

I just clicked on the OK, thinking it was a message from my os, and it seems to have fvcked up my computer, screen went green, then fuzzy. Hope it will be OK...

All seems ok with the computer now...
I brought it to a repair shop just in case, but I think they just re-installed firefox.