The problem has been getting worse as the popularity of ad exchanges grow.

Part of the issue is the bad guys are smart enough to cloak the malware ads from the network’s detection systems. Many of these attacks are zero hour so they can work around AV. The majority are social hacks.

Unfortunately for publishers it is very difficult to spot without a 3rd party with a broader view of the ad network/advertisers.

We log all the attacks we detect and this problem is not limited to flash. Also in most cases it doesn’t infect users, typically they launch monetization techniques (stuffing, forced click) or silent hacks like XSS account takeovers, etc.

For our publisher customers we can minimize the impact of malware on their ad networks through early warning and blocking. It is a tough problem.

I ran into this same hack in a Google search, and I’m quite sure I’m not the only one. I don’t remember any articles drubbing Google for allowing their search engine to be compromised, let alone an apology from Google.

Face it, the Times is an easy target for criticism — none of which gets us anywhere, if only because I’ve yet to see any effort to explain the underlying exploit, how it was implemented, or what kind of damage it might have done. So there’s still a few things missing in this story — like everything of real importance.