• Follow us on Twitter @buckeyeplanet and @bp_recruiting, like us on Facebook! Enjoy a post or article, recommend it to others! BP is only as strong as its community, and we only promote by word of mouth, so share away!
  • Consider registering! Fewer and higher quality ads, no emails you don't want, access to all the forums, download game torrents, private messages, polls, Sportsbook, etc. Even if you just want to lurk, there are a lot of good reasons to register!

Malware warning in Chrome - Netseer

Jump to latest Follow Reply
Sort by date Sort by votes
Clarity

Clarity

Will Bryant
Staff member
There's a discussion about this in the advertising thread, but I wanted to start a new one just so more people will see this.

If you're getting Chrome malware warnings today here or virtually anywhere and everywhere else, it's because the website of an ad company used by Google was hacked. It's long since been cleaned up according to their representative, and what's left is just the red flag in Google (Google warning about part of Google) that needs to be cleaned up.

You're apt to run into this virtually anywhere and everywhere today. Amazon.com, imdb, CNN, MSN, Washington Post, GameFAQs, ESPN ... I mean the list just goes on and on. Google's Doubleclick (which uses Netseer) is used *everywhere*.

So just to be clear. Our site is okay. The warnings at this point appear to be false positives even about Netseer itself. Indeed, I just saw a Netseer ad come through on Amazon myself, I checked it out, and there was nothing malicious about it. I expect this to be an interesting point of web history in a few hours. This will certainly be something that draws a lot of attention considering how huge and widespread it is.

My main post from the other thread with some direct info is pasted below FYI:

--

Netseer's website was hacked. Their representative says that their ad network was not compromised.

So this is an awkward case where Google flagging a web compromise blanket covered ad serving domains, which meant that it spread far and wide as (apparently) an unrelated false positive.

The funny thing here is that Netseer is used by Google... So when you're getting that warning, it's Google warning you get about something delivered by Google. I'd laugh, but I really just want to set things on fire at the moment.

http://www.zdnet.com/netseer-suffers-hack-triggers-google-anti-malware-warnings-7000010776/

from that article said:
A spokesperson for the company confirmed the successful hacking attempt at around 5:30 a.m. PT, but noted that it did not affect its advertising network infrastructure.

The company is currently working with Google to rectify the situation.

A NetSeer spokesperson confirmed that its corporate etwork had been infected with malware, and Google subsequently added its domain to a list of malware-affected Websites. Because NetSeer's corporate site has the same domain name as its advertising network, Google triggered warnings on end-user machines warning users to avoid any NetSeer ad-supported Web site.

But, visitors to these Web sites no point at risk from being served up malware from the NetSeer advertising network, the company said.

"Our operations team went into all-hands-on-deck mode and we have successfully cleaned the site of the malware issue. We are also working with Google to do an expedited review of the site and remove the site from the malware impacted site-list so that browsing behavior can be restored for all users," a NetSeer spokesperson said.
Click to expand...

Anyway, it should all be resolved shortly now that it's a known issue. If you get the warning, just reload the page fresh. You shouldn't be seeing Netseer on very many loads and you can just get a page without them that way.

I've put blocks in for Netseer where I can (again, we don't use them, but they can (and clearly still are) coming in through points downstream), so whether it's when those blocks kick in or when Netseer and Google unscrew themselves, a remedy is coming either way.

Sorry for the headache, all. The good news is it's not us. The bad news is it's basically the entire interwebs. The other good news is because it's so massive it should be gone shortly.
 
HorseshoeFetish;2317435; said:
Just an update. Chrome still wants no part of the bracketology thread. Virus protection offered up an ADWare alert after trying to log onto the page the first time. I wasn't surfing anywhere else in that time frame.
Click to expand...

I am pretty sure it was the picture someone added to the thread. The thread was fine until then, and right before I got the malware warning I could see a large black picture that looked like some sort of bracket. I changed my view style so I could reply in the thread to note that was probably the issue (if you don't change the view style the previous posts are displayed below the reply box and of course the warning comes up again).
 
Upvote 0
scott91575;2317442; said:
I am pretty sure it was the picture someone added to the thread. The thread was fine until then, and right before I got the malware warning I could see a large black picture that looked like some sort of bracket.
Click to expand...

This. When people link in pictures from strange sites, they bring the 'reputation' of that site with the picture. Which is to say that if you draw from an untrusted site (not a big name), and do so without at least loading the domain up in Google to see if there's a compromised/"this site may harm your computer" warning -- then our thread is treated as if it's infected even though it's merely drawing in an image that is. Creates headaches all around.

Said it before, will say it again, if you're going to pull in external images -- check your source before doing so. Not calling anyone out (no idea who linked the bad image), but a little prevention at the poster level makes all the difference.

The warnings often say what the name of the offending domain is (as HorseshoeFetish) noted. That's a huge help to us as we can go in and remove the offending images quickly, as opposed to having to go through each and every single post, looking at image draws and checking them against Google.

Thanks, Deety, for sorting this one out. And thanks to everyone for reporting it. We're clean, but a link like that left long enough for Google to index it means we get a blemish on our pristine Safe Site Diagnostic report for 90 days.

Please continue to report these as quickly as possible, and better yet -- think before you link.
 
Upvote 0
You must log in or register to reply here.
Back
Top