Security is an important, regularly discussed topic in modern times, and will forever be as such. In modern times, cyber criminals have been finding new ways to victimise innocent users of the Internet for various purposes - usually money extortion (stealing credit card details, or ransom by force encrypting the users contents and asking for a fee to have them returned). There are many aspects of security that are important but one that is relevant here is malvertising (a portmanteu of malware and advertising).
What is malvertising?
Malvertising is the practice of using advertisements to spread malware.
How does that happen?
There are various methods:
- Webmasters have their websites compromised, and the hackers introduce it
- Poor/no checking of ads that are given to companies who host them which allow rogue ads through
- Insecure websites with vulnerabilities that allow attacks such as XSS (cross-site scripting)
Does it require user interaction?
Plugins such as Java and Adobe Flash have an incredibly ludicrus record of ridiculous exploits. However, there are other methods too - simply visiting a website can allow malicious code to run that is server-side (PHP for example) to allow the malware through. This is called drive-by.
What's more, there are special malware called exploit kits. These will deliberately scan the user's browser for vulnerabilities to exploit; software which is merely a few days out of date are incredibly vulnerable to this. So the answer is no, you do not have to interact with a webpage in ordered to be infected.
What are the possible consequences?
Java is meant to be a sandboxed environment, meaning it should not affect anything out of its boundaries (the browser). However, so many vulnerabilities have been found hat allow arbitrary code execution affect outside of your browser. The malware, once downloaded, can instantly run and some will do so silently, in absolute secret to the user.
How do you defend against this?
Cyber criminals are so advanced even tech savvy users can easily become a victim. As they aim to compromise advertising networks and major websites for the maximum victim exposure, you can take the following measures:
Common Sense
It's always a good idea to visit websites you trust and know aren't malicious. Visiting torrent sites or adult content are more likely to contain malvertisements than others.
Antivirus
As a standard defence, antivirus is advised. However most will not detect malvertising as its hard to detect due to the vulnerabilities being exploited in the browser. Still, it's better than nothing.
Up-to-date Software
Since a lot of these malvertisements exploit known software vulnerabilities, you should always keep them updated to patch these holes.
Uninstall Obsolete Updates
It was until a couple years ago Java was beginning to remove the old versions after installing the new one. Legacy malvertisements may be able to take advantage of older Java versions, so you should definitely remove the older versions.
Restrict Plugins
Java and Adobe Flash are loved by cyber criminals because they have so many exploits. Therefore you should consider restricting them, or even better and removing completely. Both plugins are superseded anyway by safer alternatives.
Extensions
These are all free to use!
NoScript
NoScript provides excellent defence against scripts. You can make it so JavaScript, Java, Adobe Flash etc only run on websites you trust. As malvertisements come from external vendors from the website visited, they can be prevented from running their payloads.
Adblock (Plus)
One unknown benefit of blocking ads is preventing malvertisement execution as the payload never arrives to the user's browser.
Web of Trust
This extension is community driven and will let you know a website's rating. If it has an incredibly poor rating it will automatically prevent you from accessing known detrimental websites.
Why did you post this on Wikia?
Because Wikia has adverts. Even if you register as a user, you can still see adverts such as on the main page. Wikia will probably not be compromised but I have seen XSS attacks in the past affect Wikia, and ad vendors can sometimes silently go rogue, or are compromised themselves.