Trust Two Times Removed

Jeff Forristal describes a post-mortem of a real-life compromise where a user's browser plugin was exploited by malware delivered via a syndicated rich-media advertisement; the incident highlights how ad networks can inadvertently serve malicious content, the resulting two-times-removed trust model (site → ad network → advertiser), and the increasing threat posed by rich-media ads. The report advocates for stronger vetting by ad vendors and notes user-side mitigations like ad blockers and NoScript as partial defenses.