INFO FORUM ISSUES (Cont'd)

Tagged
http://forum.phun.org/showthread.php?t=1248194

 

malware warning

img230.imagevenue.com

http://forum.phun.org/showthread.php?t=1204666&highlight=jenna+ivory

showing on all photo sites now, anyway to block imagevenue

 

Great, so I am not the only one who is getting the warnings.

 

http://forum.phun.org/showthread.php?t=1247957

Funky characters in the title.

 

thanks for the info guys. It is a problem on their end so it really isnt much we can do here. If the problem persists we will have to consider our hoster options off course. But i cant see a big Place like imagevenue leaving the problem unattended for long.

 

I was trying to get on phun and chrome blocked my access for malware warning.

 

Same.

 

That's not Phun but something on imagevenue

 

I got the malware warning too. Problem is, the info offered by chrome isn't clear. Do imagevenue serve actual malware? Thanks...

 

I just send a mail to imagevenue, in that i told them about the warnings. Will see what they answer

 

http://forum.phun.org/showthread.php?t=1247495&p=7732807&viewfull=1#post7732807 not allowed host

 

It's very likely from an ad. But, it looks like it's fixed.

Usually what happens is a site will use a third party to serve ads. That third party decides, either randomly or programmatically, what ads should be displayed. The problem is that a few bad apples get through. That can mean sites trying maliciously to serve malware, hacked sites accidentally serving malware, or sites that use techniques that look, heuristically, like malware.

Then, when one site gets flagged for whatever reason, it can trigger a chain reaction where other sites get flagged. An ad network accidentally serves some flagged sites, then a site that uses that ad network gets flagged even if that ad isn't on every/any page. Then another site (phun) includes content from that site and you get a warning.

Ads are terrible. But, they are also what funds everything on the web so

 

Bastard:

Just wondering is it the ad itself that is the malware or is it malwares that hides in the ad itself?

 

What happened when Google visited this site?

Of the 4089 pages we tested on the site over the past 90 days, 834 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2014-03-04, and the last time suspicious content was found on this site was on 2014-03-03.

Google found malware installed without user consent on 20% of the site. Very bad juju. They should have a rating system for hosters so everybody knows what the average is, but 20% sounds really bad to me.

 

20% doesn't sound good to me either, and I've been going to Imagevenue everyday in that 90 day period, I guess we all have.

 

It isn't just a banner ad (an image file) if that's what you mean. Typically ads are injected into the page with JS or an iframe dynamically so that the ad network can control what ad is displayed and how. That's where the problem comes in. Being able to execute arbitrary JS allows them to do almost anything, most notably to execute code that targets known browser or plugin vulnerabilities.

That doesn't mean that's what happened, though. It could've just been some JS that looked like attack code.

First, it certainly isn't very inviting. But, I'm not sure how meaningful we can make those numbers. There isn't enough info given. All 834 of those could have been within a short period of time before being removed from the ad network. It also doesn't tell us the severity of detection. It could be something mild like JS that tries to circumvent pop-blocking etc.

I'd keep an eye on it and factor it in if making decisions about image hosts, but I don't think there's any reason for immediate panic.

 

It seems like a hit and run situation. If for instance, I was online and got a malware before it was taken down, I still got the virus. Certainly I'm happy it was removed, but sad it happened to me. Self hosting would be good if it weren't so cost prohibited. Phun did have a self host for awhile this summer,

 

Do those ad codes still run if you are using Adblocker?

 

It's not just cost, having all those images on our serves would slow down performance as well.